Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    07/10/2026, 08:14

General

  • Target
    jokesphone-4-0-290526-341_N_A_APKPure.apk
  • Size 12.9MB
  • Sample261007-j43ncsvwa1
  • SHA256 1c43ecdda7af79320017e458c9be04f1c85a27ddc136747ab675ef23681bade4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.cashitapp.app.jokesphone
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Schedules tasks to execute at a specified time
    PID:3355

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1f18901a60b6d179dc603a21e6d28c88c03b469c26a229e3be4da351dc99aa76.0.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/1f18901a60b6d179dc603a21e6d28c88c03b469c26a229e3be4da351dc99aa76.0.tmp
        • Size 266KB
        • SHA256 c0e3a5608a3632470e9a33ed184ea85a9e2986b9101fc72ca3dbd426ea014b3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2794a66de8a1573602560f4fa28ed4f18be42492cba18b73ed56286e1e3702f2.0.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/2794a66de8a1573602560f4fa28ed4f18be42492cba18b73ed56286e1e3702f2.0.tmp
        • Size 58KB
        • SHA256 3d0ee271002e9f38b04b85f8186ce278b39cf32dd049003c674e7d4398f36b69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        45de6faa63ba48b33c984e320050226101a34488062eb0f57a6ed7ea10073692.0.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/45de6faa63ba48b33c984e320050226101a34488062eb0f57a6ed7ea10073692.0.tmp
        • Size 57KB
        • SHA256 b9e2688684e30bb2acfa6c00a332a50fbb93e1ab690fc9974fe42dba6ad22448
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5be74429d8f055c6ec9dad347ecac40e4a3c2dc60d3e651e8d4a5b8a01e53534.0.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/5be74429d8f055c6ec9dad347ecac40e4a3c2dc60d3e651e8d4a5b8a01e53534.0.tmp
        • Size 52KB
        • SHA256 9547c4603c5d64a2b9c8a47d9764be29836ce9ef87b9409b9aba8ee0768cc096
        • MD5 SHA1 SHA512 SSDEEP TLSH

        62fa1e0a15837fa46b9c983742163deef6167ca4bb21bfabfd476f9ab7da7215.0.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/62fa1e0a15837fa46b9c983742163deef6167ca4bb21bfabfd476f9ab7da7215.0.tmp
        • Size 67KB
        • SHA256 b08541b42bd39d75eb60fb7727396ee37dfa110edc721c1b96e86f83231fc407
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cceaaef9273013651f6005ffeadf97f44cdf0f37a36b10f4b3b6413fb9284c09.0.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/cceaaef9273013651f6005ffeadf97f44cdf0f37a36b10f4b3b6413fb9284c09.0.tmp
        • Size 54KB
        • SHA256 4e977a17b6aba44f91301c76c7f3b28bcbc683cf237858f617f77f54bb026c60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        e21a4c938f292d2f975374e6d9e5242740dbd64cf9aa440aeeb62b9906a821c3.0.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/e21a4c938f292d2f975374e6d9e5242740dbd64cf9aa440aeeb62b9906a821c3.0.tmp
        • Size 51KB
        • SHA256 e692586cd36b04c3ebc8e563f70e08d4ac77a3341a65fe530e7efe11f434169b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        journal

        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/journal
        • Size 1KB
        • SHA256 0d0f634052b49421a22d4fdd72c44c20a09f0b250ccd62073c8f6782fba96bf9
        • MD5 SHA1 SHA512 TLSH

        journal.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        base.3355.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/cache/oat_primary/x86_64/base.3355.tmp
        • Size 1.1MB
        • SHA256 983c3cd8bb73c93fb9962e127f0fba0331506c41729e3a53615acd14c8d4cefc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events

        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events
        • Size 112KB
        • SHA256 3e56047c692638d15151e4ac7d45a1b4df1ade6f73bdf070992112056c7ce6b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 5a336f162648ea1da382831f217fda4c72f839b4bf70a8d22f559b38c6a3bf19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 24KB
        • SHA256 7df1c565139ed0afce156d56efb7ec6b5f5468aea6d47b9262ee0598e7838036
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 16KB
        • SHA256 85547c6584761764631bfec34ebc9304fc64d505e2d1389742ad43d944ca3ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 76KB
        • SHA256 81a4494160f3d8979370864becd11413bbfc7fd972d9c3efbd35c9ea19bf61b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 977ecdb118b6a16504386b8ac0b93cc1d7be6a22b8681f102e35129c8ecf0458
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 bfa2442e9ea2d0e5f806ce395f6c3e3c5c0f146f01b9af5a920f4205f276ec34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 8281d817cce60dc045bf53b22832c89bc140a83dc8d11eea509f11d8fa837a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 0124b587fc77db6540a996538051eaec7c0a9499850228da59916c97510002db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 90716a129640c1190aae9ca973cd6fd551d65006fb8a356cbdaeb7db5a73ad46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 de7990a2871b01de0b56aecdb11de90acf0387931ca0797e6f19bccb54e2f43a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 7bec2fcc119d42ad0e978d44b223d690adac5651b0da064a3b94d2edcee8fc7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db
        • Size 16KB
        • SHA256 0b1c356f5527e33e4a79386b23b578bbe88b5bd2cadb265b0a8c45c8a2d138d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 512B
        • SHA256 5b96659b710ea936f6a90cb57ce89c3b1d2149611c8b1e5f8387464fcb5a7a15
        • MD5 SHA1 SHA512

        google_app_measurement_local.db-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 35beaf4eb559c7afb206326410be07605c6599c3efc6be5ef3b7c87a0c1e86ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 4KB
        • SHA256 3142c47067e83982830806e88d06e03e558bb103c80af48c7ff870f65271e8d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 04daea8b2c27dceb83de33caba570aff6de62820deede4e7c30a38c76463b9a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 93238fe2dff81d7da77437716a26e7f0f854dd8307ea139983a5fd7d04d07c22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        google_app_measurement_local.db-journal

        • Path /data/data/com.cashitapp.app.jokesphone/databases/google_app_measurement_local.db-journal
        • Size 8KB
        • SHA256 0016101169771818581b908fcab311f49a414e6ae1198f594b18f4adb4d611df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.crashlytics.settings.json

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/com.crashlytics.settings.json
        • Size 777B
        • SHA256 9acd879877a6b74eba3f2b25f862191b5482d315a0e2efc298ec8c60d1755d05
        • MD5 SHA1 SHA512 TLSH

        event0000000000

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/event0000000000
        • Size 19KB
        • SHA256 5d38c2fc6ae9aa699ccc1ffcdf1d00c39b9bf4c1de9ee290a9778fedf325d0d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        event0000000001

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/event0000000001
        • Size 6KB
        • SHA256 067cb25611b228e757af4d9ed9dc0e58437d710b81d3d39c335a4840882684cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keys

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/keys
        • Size 13B
        • SHA256 10e7f80f7117924b2618b43af4253b9b7f95a09cc3c0bae0c7479363fca8d775
        • MD5 SHA1 SHA512

        keys

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/keys
        • Size 69B
        • SHA256 4ade93a6669e80afd7dccb7e3515dcf543fa0e39a654ccf7edebb8d778069e54
        • MD5 SHA1 SHA512 TLSH

        keys

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/keys
        • Size 85B
        • SHA256 7c636a9136a916115c81c08dc5c2f59f2ebb300660c3e536288119ba86c5a593
        • MD5 SHA1 SHA512 TLSH

        keys

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/keys
        • Size 196B
        • SHA256 53037995d593435345b1b4f9dc51d134b3dfb15263b42f729b0ad02ba8fcbcc0
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/report
        • Size 824B
        • SHA256 651e6a346b94e88cd5f89947a979e6558a1fc2cadbf200ef8b307adffb6a8e37
        • MD5 SHA1 SHA512 TLSH

        user-data

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/user-data
        • Size 40B
        • SHA256 21500c7a14d77cf74415bdeb6588108c57f24ccc3dc56b5b2c3363a96a87cf1e
        • MD5 SHA1 SHA512

        userlog

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/userlog
        • Size 4KB
        • SHA256 b0331b755a6d0c7bdd6f797d80d02f846862834150ed9b8b81e5eb83b49d561b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        userlog.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/files/.com.google.firebase.crashlytics.files.v2:com.cashitapp.app.jokesphone/open-sessions/6AC5FF5F02FB00010D1BBA3F97C6161C/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        PersistedInstallation3398793901973160739tmp

        • Path /data/data/com.cashitapp.app.jokesphone/files/PersistedInstallation3398793901973160739tmp
        • Size 90B
        • SHA256 5f1747a6b3853fed468ed9efa38ac77ca6856abd2f9af3a9822bc5eb37c2ae80
        • MD5 SHA1 SHA512 TLSH

        PersistedInstallation9202634435895185773tmp

        • Path /data/data/com.cashitapp.app.jokesphone/files/PersistedInstallation9202634435895185773tmp
        • Size 568B
        • SHA256 7d2866b98c9db7ee153c36e8b5fa6015a44518ea879c723c4bd187f496963747
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_data.preferences_pb.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_data.preferences_pb.tmp
        • Size 50B
        • SHA256 9ab0a720bbc2b1356807ddbc7a475303beb7ca52a37aa5501b36bbe5add123cd
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 33B
        • SHA256 a4aaa2a4e0cb12123b405a9d33bdd7edf8cbb41ea92e75deb1ba21bf1db5b2a6
        • MD5 SHA1 SHA512

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 75B
        • SHA256 1e58e88b20702d0a80025c1fbacc9ad5fe2565311e2230d581d669fbd7e8b0ef
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 121B
        • SHA256 232f9626cbee2e063e25f61a08f46575d019b62f02a6753c1325957a95e1c513
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 163B
        • SHA256 7495b9faf55ff02d0a2906ca3e3f4b356abd96e421815f9d07f893682da6eaf2
        • MD5 SHA1 SHA512 TLSH

        firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp

        • Path /data/data/com.cashitapp.app.jokesphone/files/datastore/firebase_session_Y29tLmNhc2hpdGFwcC5hcHAuam9rZXNwaG9uZQ==_settings.preferences_pb.tmp
        • Size 212B
        • SHA256 119012c85991e462e7375d8cdcbcd887116ede13ccfe9293fc64b4a0f3b58cd4
        • MD5 SHA1 SHA512 TLSH

        frc_1:764775673839:android:fa25aebe22ca35e538d01a_fireperf_fetch.json

        • Path /data/data/com.cashitapp.app.jokesphone/files/frc_1:764775673839:android:fa25aebe22ca35e538d01a_fireperf_fetch.json
        • Size 1KB
        • SHA256 34def751d3db10549a49ca70154452bdc4f562c94103c146c28313cbcc09528d
        • MD5 SHA1 SHA512 TLSH

        profileInstalled

        • Path /data/data/com.cashitapp.app.jokesphone/files/profileInstalled
        • Size 24B
        • SHA256 3ed37a9e549169ee3d191c9927e346526c33bfd5f4080cbdb4b598d5194beed5
        • MD5 SHA1 SHA512

        primary.prof.LT6jcH.tmp

        • Path /data/misc/profiles/cur/0/com.cashitapp.app.jokesphone/primary.prof.LT6jcH.tmp
        • Size 13KB
        • SHA256 81da2c50a9416df5b19e37112fb7fb5646be558fd61a2b85f08a6e9663bc14dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        primary.prof.iIqYDP.tmp

        • Path /data/misc/profiles/cur/0/com.cashitapp.app.jokesphone/primary.prof.iIqYDP.tmp
        • Size 13KB
        • SHA256 2e6b04238bb45ca5484be70ff105771dcf84851a8b41108a744d593433321bce
        • MD5 SHA1 SHA512 SSDEEP TLSH