Overview

overview

8

Static

static

6

jokesphone...re.apk

android-14-x64

8

Resubmissions

05/08/2026, 16:01

260805-tgeccswta18

05/08/2026, 15:47

260805-s8ea1abp218

05/08/2026, 15:44

260805-s6z5pazglf8

05/08/2026, 15:33

260805-sy6x9szerb8

Analysis

  • user interaction
    yes
  • max time kernel
    108s
  • max time network
    216s
  • platform
    android-14_x64
  • resource
    android-34-x64-arm64-20260325.1-en
  • resource tags

    arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
  • submitted
    05/08/2026, 15:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jokesphone-4-0-290526-341_N_A_APKPure.apk
  • Size 12.9MB
  • Sample260805-s8ea1abp21
  • SHA256 1c43ecdda7af79320017e458c9be04f1c85a27ddc136747ab675ef23681bade4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    defense_evasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Checks the presence of a debugger
    defense_evasion
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence

Processes

  • com.cashitapp.app.jokesphone
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    PID:4419

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1b68472e282d077e09b99b24f07ebf481b875bac19f1df209cb42e820d7906e4.0.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/1b68472e282d077e09b99b24f07ebf481b875bac19f1df209cb42e820d7906e4.0.tmp
        • Size 58KB
        • SHA256 3d0ee271002e9f38b04b85f8186ce278b39cf32dd049003c674e7d4398f36b69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1f18901a60b6d179dc603a21e6d28c88c03b469c26a229e3be4da351dc99aa76.0.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/1f18901a60b6d179dc603a21e6d28c88c03b469c26a229e3be4da351dc99aa76.0.tmp
        • Size 263KB
        • SHA256 b24cdd93914577195ddd1a8e629c094876e3262280f6822a5e0ccaddb944f7f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        5be74429d8f055c6ec9dad347ecac40e4a3c2dc60d3e651e8d4a5b8a01e53534.0.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/5be74429d8f055c6ec9dad347ecac40e4a3c2dc60d3e651e8d4a5b8a01e53534.0.tmp
        • Size 52KB
        • SHA256 9547c4603c5d64a2b9c8a47d9764be29836ce9ef87b9409b9aba8ee0768cc096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        journal
        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/journal
        • Size 476B
        • SHA256 4ee2b0fd2efec68583eb6efaa45e933ff3b2e8121631e837c52a9dc28ebfaf87
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        journal.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512
        Submit Download

        base.4419.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/cache/oat_primary/x86_64/base.4419.tmp
        • Size 920KB
        • SHA256 0faf9a0a1ec570cbb63b2d6fb508bc9917fed2454c93591443164b33ff9e371e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events
        • Size 84KB
        • SHA256 13e3b56682f901c0d298b214583cd74aebdaf6045863b4dfe3293661fb24ae60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 177b92817193caab8f2c60ec9dee3c0a555b3ea4443df37e194cd534bd93c656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 81aaa92bfabf24d10d178cfdec3c22e750458d2c8c04900d96930e6398e730f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 77d3d516326c0bba4ac8602e336136d7befa3a50c93a09dbfedd0f99a26f8db7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 48KB
        • SHA256 9e813042dc218b2a8591887b5c6509c9274ec521ba1c8059ad7feccf06fa063d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 8e37e8c8cd05a45f7cdcfc8448071613a706c44ac7dca60301665575f0199cda
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.datatransport.events-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 a6e11998ef6a40fbed47a823dc232929648c4e691f048abbf955a691494db132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 59118f98382dc1f47d88c0d88cbc196ad8db63d0a63cbbc034b8496431b407b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 c1badd4246eed4f2888d31d77ea9d5a275ee6710537da4a45194c0acb9525ebc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 edf8775b0e0788f69a2bbc00fb67b422ab6bbc115e40ea7eb73ec7e13f829add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 ad4e650f78acbd65e4ec339b4e597548b1ffa4431d2d00a47d52c4d4c22ecf8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 9f3fb5e587d758b6f02167367be0d68bb7ec8ce2e0919aa896442af86ed88bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 6a4b8fe2b545565b17cff2b0f86183600d238f7815d1b6db15278ff259ca78e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 51437a0fade8b17d37c53d14abfe7b13e6f081e8e59a0d61f5acf6629f69818c
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 f0a3de46ff12106eb5902bab4a864ef67e7b38eea95b65fa6dc0ce0c7a4b627d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 fc7f25bd13cdb40bddc14bd28e2018c5ca30b60f41c50c5859de3a7c2bef74f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 2707cd5541f478ee35738a455b664ecd0b7311b12d3c102981948583334c0c43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 531f9bf1b458f9bb5ea993f2529ea85f83307633ecbf557f468292b948a795f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 7fbc22d3c17de53751ee1572cc32c9a2e296e23f45ed148e28220814aa63b17f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        com.crashlytics.settings.json
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/com.crashlytics.settings.json
        • Size 777B
        • SHA256 cbce04b5a2ae2a5281545a306ad92c47b4a4cacc7f6270f54169b4af2aa78cc5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        event0000000000
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/event0000000000
        • Size 18KB
        • SHA256 297c1763ea9fa6296901e127d011231b9784c54931f8dd70a0c1cbdaeac4a2e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        event0000000001
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/event0000000001
        • Size 5KB
        • SHA256 a1964e27c11c8eb2ce056d1ff2718315acc730021b2e043da1cb9f58f7dab5b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keys
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/keys
        • Size 13B
        • SHA256 10e7f80f7117924b2618b43af4253b9b7f95a09cc3c0bae0c7479363fca8d775
        • MD5 SHA1 SHA512
        Submit Download

        keys
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/keys
        • Size 69B
        • SHA256 9317a35974b80937e73528cb034e8f3399e6365e0a42c07aa31153b651386744
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        keys
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/keys
        • Size 85B
        • SHA256 7b3c68fb872f8ba80a6cc963e41d5570dff9b4399def2e47d502193e3259d376
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        keys
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/keys
        • Size 102B
        • SHA256 4d9e91d69add5bef4bdb0f42e203e3c88ce65343b45ec80da7de0585499605cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        keys
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/keys
        • Size 196B
        • SHA256 38bdc30e132c20202c8a02775b955d85d755b579f150c6a3f71126deb27075aa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        report
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/report
        • Size 824B
        • SHA256 7393f58f9e35911fe252c00333c4c58790d324e77048c8fc7505ff33ecaee0d1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user-data
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/user-data
        • Size 40B
        • SHA256 eb94bc6bec9e76c1a3d0ed148c43ab20ec3fafa130b3b96de012ac8e6c2006f2
        • MD5 SHA1 SHA512
        Submit Download

        userlog
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/userlog
        • Size 2KB
        • SHA256 e13307106e0ab8bf7a16ba13a1047e5b36d33287b32f045097fd0e342e950217
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        userlog.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6A735B37023700011143F00D99CEA60F/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512
        Submit Download

        PersistedInstallation8230594774899804867tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/PersistedInstallation8230594774899804867tmp
        • Size 569B
        • SHA256 bd1e7dbe3e9b4cd84a85db25c978305d1729f55b7f4d1322cdbee356f8d6e966
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        PersistedInstallation8503282990825241385tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/PersistedInstallation8503282990825241385tmp
        • Size 90B
        • SHA256 b4af98cdf9db0c4aca06ebc4df9ae797c3472256b78c8a65c40ab68011bda607
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_data.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_data.preferences_pb.tmp
        • Size 50B
        • SHA256 84e071ddf20ba2dc5502c45cbe68746aef0586bc1f7cee6c77d5217a32cbbe8f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 33B
        • SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
        • MD5 SHA1 SHA512
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 75B
        • SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 121B
        • SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 163B
        • SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 212B
        • SHA256 3a6b54199564619ae1813c36bf47fb4a131051ace6fc9a29a4ea615c392ee4df
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        profileInstalled
        • Path /data/data/com.cashitapp.app.jokesphone/files/profileInstalled
        • Size 24B
        • SHA256 c149f36e09e759dbbcfad6d16444d25887481980b1beee2c5b17291e65e5e95f
        • MD5 SHA1 SHA512
        Submit Download

        primary.prof.cPYcUh.tmp
        • Path /data/misc/profiles/cur/0/com.cashitapp.app.jokesphone/primary.prof.cPYcUh.tmp
        • Size 19KB
        • SHA256 cbdfa0ee4c69d5e8c9695731b907944cdd6f679fad330951578d4929fbea15b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download