f468198322f763ff2d9b0d86cac743baf302d31c2c1739275b603033bb8d0798

Analysis

max time kernel
149s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
15/10/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.fr.apk
Size 676KB
Sample261015-dcsq7aba89
SHA256 f468198322f763ff2d9b0d86cac743baf302d31c2c1739275b603033bb8d0798
MD5 47f71295ed628115b866eb86719ba201
SHA1 a15f343748874b7bec7cf7fa397d571c4299ea15
SHA512 8bb5ddef0952492f587abab92706f4e5f34b57d264dc38e4a38b1d299932f9e3070379cb6b434ccff2d316521df96d769339902bb184c3fac2013cdf23c98f32
SSDEEP 12288:yuh0Kos61i1FJPGSm+JDPAeY1lax5GxZya37ZQlwbMOPKgrrvXzKykbm:yAqXE1fACuarOZyS7ZBKKvXzKy+m
TLSH
T161E4232D628CA298DD241E389D16B74F83A90DA7525BD71176707C07AEB4CEC5B22CCF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

banker defense_evasion discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4271	com.keke.t

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.keke.t

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.keke.t

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.keke.t

Hides multimedia files using a .nomedia file 1 TTPs
Android's media scanner ignores any directory that contains a .nomedia file. This hides your photos, videos, and audio from the gallery and other apps.
defense_evasion

Conceal Multimedia Files
T1628.003

com.keke.t
1⤵
- Removes its main activity from the application launcher
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4271

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Conceal Multimedia Files

T1628.003

Suppress Application Icon

T1628.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

inner.dataBase

Path /data/data/com.keke.t/databases/inner.dataBase
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

inner.dataBase-journal

Path /data/data/com.keke.t/databases/inner.dataBase-journal
Size 512B
SHA256 3ca813d22d67b748966434ef949f713b0ca5f2d691d1e1a89ba56dc7c3c3ca14
MD5 0cbdcfab0cd90d3f43b7df4de83e730e
SHA1 6515750d1018373c4a86a7c48a48440b36e3491c
SHA512 71b1456be62fac268f41e732d203672a86103c7ee973a38330acad3571f8a3a25bae15235138da91102dbc623d87bacd432d5d1219088427c6b4aa3adc349dc9
MD5 SHA1 SHA512

Submit Download

inner.dataBase-wal

Path /data/data/com.keke.t/databases/inner.dataBase-wal
Size 32KB
SHA256 9e8dc859fa735cba3cd76c9dd0b44326647b7d80323645ec191afdebe7b033f3
MD5 a366c5121ae47ece29cc3252d63fb765
SHA1 8c555319d7a3c1830f322249e22bf388ac55efb8
SHA512 771644ee0c88428f06ba29469df32e46b805bb2001497581a45cfee84b1f665a1087986d664cfca7bf307ae991deffae7c291d7a1b6c3fcf0d56a697ef42d58d
SSDEEP 12:Ksj00klzdTRmBEyPbP/aF0sTOwClS0krqSyNTSFbyYGXDbPSVc5IbokIS2gZ90uZ:KowlzyGSP/5s7lmHY1GSP/h
TLSH
T157E29E87470CE22EC71C0B776CEED3A31D71525A5AE1CF8765B01C349C82E8C2066D09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

innerlog.dataBase-journal

Path /data/data/com.keke.t/databases/innerlog.dataBase-journal
Size 512B
SHA256 a678246d64db016013bedca27b98fb8491dc2b400a278212a2142ff124d260bf
MD5 1e755d3acbd202a29e62639d056ae180
SHA1 872530b6c45f9fdc99c5b360462beadc66ce2510
SHA512 dcc38266bbc950dda989bafc9019f741854c09ee102843e8c62a32c909b295463742cd4416e895888630f0e0b3c17ae9057a8be6fdcc02d1562db50ee1ac4fe7
MD5 SHA1 SHA512

Submit Download

innerlog.dataBase-wal

Path /data/data/com.keke.t/databases/innerlog.dataBase-wal
Size 32KB
SHA256 9fd0a941d80da9c4b87d7777f4f659152a86d5d678da5623200403f404d6f384
MD5 a49cea745b8fc62358c1502cdfdad23c
SHA1 855514d7db962311696957e8b01a9e780cb72b51
SHA512 0273e6e68746127413cf3ecad8c192304972cef874781f31006fc53ed98dd64f1c48e8bfe2b79f2d4e42d206756b6794523acfa6083edc6af0fa871770e4b97f
SSDEEP 24:Kcw/wvzyGSP/Own6v6bV+wxkhquinYGSP/OwTw9g:aovzNSP/pn6v6vfuUSP/pkW
TLSH
T1E3E26D86D741055BC64C4BB3D8EC93E91DA0624DD3B7CBD7E1B148617C527895CA0E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ins.dataBase

Path /data/data/com.keke.t/databases/ins.dataBase
Size 28KB
SHA256 1962d92328b6d63e9f4ece528156912b14017ce8a4a99453e511cb5cd8d3832d
MD5 500e2b67f24bf06f30f0fb83bde54eeb
SHA1 d6020b8c73c002eee2865ad5296705224dc51192
SHA512 6e67655e28606d97f9bd3f8fa83ac1475ff9da3c3f2de03ad11e8cec84685a468473f53e400e894231c2a715ca22e9035cacd1967591385482235d1d41caa0d3
SSDEEP 12:T1eBNl/CUXVXvJtKxbcLZscDKbV+0SEbDbmTSFby4EeUSrYRPbwRmBEyPbGtOwOg:TUBNl7t7K6m3+FvmEG8GSi8y
TLSH
T1B7D29CEB87406507C50D6275ACEA83F16DB8A16F9EF88E8364B44C215DD1E057831A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ins.dataBase-journal

Path /data/data/com.keke.t/databases/ins.dataBase-journal
Size 512B
SHA256 d2131f3beacf792ca500ddad8591d45b3214ff31a5553729c7a41bd62af02f24
MD5 4f35a4c79ebbc9d591c135d992275ed0
SHA1 dab86a8430c1ffcadf065ffb291b975ce2e70c4e
SHA512 ecafd621c641416e466fd356902915d197f1e988a30ffe48fcebfe9edaca03ba731d39f04d33dbef4f107af93d86bd6de23ebe9510d0c72d0263ce19d35794fe
MD5 SHA1 SHA512

Submit Download

ins.dataBase-shm

Path /data/data/com.keke.t/databases/ins.dataBase-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

ins.dataBase-wal

Path /data/data/com.keke.t/databases/ins.dataBase-wal
Size 48KB
SHA256 632214d77693f3fd8b80063aedabe5012d311a95fc56e3d22d05831278d26ee8
MD5 b7b7f850ec21abb67494be0e3238a01a
SHA1 03b15ec4c8ada4b1b543869990aabed09745090d
SHA512 4e76b37ed73d4d491f27a4e7332225ef76e74f444995a5422aa2f12d9ff5acf439b67f41de534f55b5cd571efce4328988e415719ef30b027ea6d4afc553a4e9
SSDEEP 48:kQ1CyzNSP/DB6YpUHl7t2iFvy7SP/DWb14QI6I:kQ0C0P7wXlx2q6+P7Wh4QI6I
TLSH
T11E2390D6A7441DA7C14A527158DAC3A1DDE653AFAAA08A4B20704C25DC81F146422D0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keyg.dataBase-journal

Path /data/data/com.keke.t/databases/keyg.dataBase-journal
Size 512B
SHA256 9c0fae8f913bf2ca60fd9e7c7e5132f4a78ce05f8e7c11c31e160c65d17ec357
MD5 70f274079222429dd075749fb3c3d522
SHA1 ce8735d003aa297da98885133de5d6398ec9be46
SHA512 789e8d2e173c19ce991ec974e0772b0bb7434db74924877f83741e65d480866d95e637840ff64f60412f42c50eb673a86d33f1559012202d24f5977a7c96f294
MD5 SHA1 SHA512

Submit Download

keyg.dataBase-wal

Path /data/data/com.keke.t/databases/keyg.dataBase-wal
Size 32KB
SHA256 6de9497b3284976c7775a2084ab2d32f94094c0168dd0682c409128d9e15eb3b
MD5 d0b2ba348c51d472ca6a4bb8ec783444
SHA1 38e2999a745ecd2472f47113f0f37088a45b69eb
SHA512 f52c7e3bef03bcb54cc8704f692e95286ec90b13da40db005e79114d9e5d3be41f2ef2c7ad55dead66a220ebd2de406a5ce75667115e871444c078af97c9fb56
SSDEEP 24:KnLkezyGSP/pmHVTAih7Z+0FP9C4zjwcGSP/pxDRa:qzNSP/0AEFP9piSP/T
TLSH
T153E29ECA4B84846BCB0D0BB6F8DDC3962D61215BAEE19B8765B44C346CC3F4871E6D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keylog.dataBase-journal

Path /data/data/com.keke.t/databases/keylog.dataBase-journal
Size 512B
SHA256 29ffc2a7231ecdfd0b6fbaf86df387b5735580b419f30db3f33c8aba39640504
MD5 e6f1a180791c512fa5c92a8801d59f4c
SHA1 325877d80d7d5920a03ee51bcf90746819406ec8
SHA512 2fc48b03e114aca9d4eee28354663936ec38a0da822197864644c87c73a5a0ea6e7553b05cef2aa99a7be022780fc4632f09c70098f97a0cb6b59350ecb247ff
MD5 SHA1 SHA512

Submit Download

keylog.dataBase-wal

Path /data/data/com.keke.t/databases/keylog.dataBase-wal
Size 32KB
SHA256 062270ce360e1a55c7260056c402cd8be32aa557557bc8a3d7fbecbda4827d89
MD5 cfc747c39bee4cef21716713d03a80ec
SHA1 e125a7a36568cd22e91ca9903586b986ba13e3f2
SHA512 8e49dbb96571fe2be89be8e63ef5dd285c6175efaf79ae3d69859c2f0484f5a334ae73682ad64d1900d7f08e2fa3d56d22345899dd9efb954d29c27caea224ec
SSDEEP 12:KQOjzdTRmBEyPbP/M/+OwClJeXDhlyNTSFbyQnkZcj5DbxeRmBEyPbP/W7X4Iz:KQOjzyGSP/9iouincClGSP/d
TLSH
T1D5E29CCA9B46156FD18C6373D8ECD3826F60725AD3F6DB8721F20C696C4174CA1A8E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pop.dataBase-journal

Path /data/data/com.keke.t/databases/pop.dataBase-journal
Size 512B
SHA256 0764327d8db17593d196588ae2d907461b4dbbb74e560544f68daf7353d038dc
MD5 b86419dcbe0565c60eaff8aea5d411dc
SHA1 6fbbf9fe2a125946902410eaf3e22c3eca37f9b5
SHA512 3e1b64c0dfe48330eeac44126749cebcf2df0006d69c669c7fc799b6cf780e268f0a7cd5f40b6aac608d9c084832687082eb2badb1aa6723927ee291b3f3546c
MD5 SHA1 SHA512

Submit Download

pop.dataBase-wal

Path /data/data/com.keke.t/databases/pop.dataBase-wal
Size 32KB
SHA256 7d6f3881d9cc7b16a3e9da35bfd52e72d6ad1e62a8a529fa90d30fd7887a64f5
MD5 e081a5ab3570a22346dfdf08490a5955
SHA1 41c33a56a1a0c32e3e0f96f73b61c9108bc1db60
SHA512 af4c8e499d907427dc4df431f7c004ddedd9a0eccdb1ccc32cf096522319623b8e8a6a0c497921e579520fd6acbae77748e7c346f6a65742fc3eec587d370e23
SSDEEP 24:KdZJGzyGSP/zqxt2CZJKKj4QUEC4zUwcGSP/znl:EZJGzNSP/zqxtlJKKj4QUEpnSP/znl
TLSH
T119E289875384102FCB0C8F7164FDC3A12D72613A9AE58BCB15B64C746C8BE883466D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

poplog.dataBase-journal

Path /data/data/com.keke.t/databases/poplog.dataBase-journal
Size 512B
SHA256 4ea47b7efae74b1d4748247c23b5de1fdbbfda9e38955deda42633879d32b8be
MD5 9de7fac04f1429e6b911e77de1bd55cf
SHA1 fe7d185603956343ca9e3343013319ede0058d41
SHA512 03df9b9cbbc60fba3dc88f1cc1a24298da0d71b6c7aede1e4ad8a17652a271c61c367c907fe1389f11dda81d2bc16f557cd624e5af9cbe3bfd9612355552865b
MD5 SHA1 SHA512

Submit Download

poplog.dataBase-wal

Path /data/data/com.keke.t/databases/poplog.dataBase-wal
Size 32KB
SHA256 9b1da944ed260af2186cd434c83348a45d5f2a1c35eb86145b1df59be2810fbf
MD5 201f4383e8d343aac5ebbf5bf8005a05
SHA1 448c797e72b2703af508da688bd2eead5dd93e18
SHA512 26bbc4a5ee25023fe61463b6c8254b18e90975153b17239dd20f9f84acf664f99ba9911b4f5ba000c57fa381c28da70c038d91d383ddd8ccc98ad9daa566ac18
SSDEEP 12:KTNzdTRmBEyPbP/L4xHbwi+OwCltDf/UyNTSFby9gG/DbxeRmBEyPbP/OHmUBlEl:KRzyGSP/L4xHsbW7BBGSP/PU
TLSH
T109E2DCC2A7049413F6090339A8E3834D1CA65ECED3C28F8361B028356C0574860F1E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

popweb.dataBase

Path /data/data/com.keke.t/databases/popweb.dataBase
Size 20KB
SHA256 855b2c8f91a221df154b728b66138071944ff3ce7c429df7a359a8f3fb1df1c3
MD5 ba29772fa9fd5d2b9a9dd60da5dc9bb8
SHA1 776210acc8655436833e9ea2b6361225574c1db2
SHA512 4c839eefd97307171a6cdc35634024c5331a1b73623457b26df1223e9408cce843b42d5ddd2b442fb89770d1a0aefc17d37b8940fc3e098bf800e6e831eb2a66
SSDEEP 12:TmYyNTSFbyH9vVwhFUjnrAW9jSWaMdOeRmBEyPbAVOwG:TEN9vVwOaGSEG
TLSH
T1E7925C874B086117C79D4AB1F8FAD3E578A0111FEBD98A93B4F45C309C81A4435A2F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

popweb.dataBase-journal

Path /data/data/com.keke.t/databases/popweb.dataBase-journal
Size 512B
SHA256 c205223b012c16355c3f68add844baf1c042c6e73c384bb0bee93b706811e6bd
MD5 c28b8bf0181643817f39e5c2d7b0df41
SHA1 ccce193549184329ff466b9bf22e9e508c49cb84
SHA512 35d4cfde708b955bc3e9c469c4e706c479508c275107e2f6c08784479e038f80a04a60e6f33dd92c2e634ca20deca1bbdd6c00b2f7392fb92c8311dfc1e5ca45
MD5 SHA1 SHA512

Submit Download

popweb.dataBase-wal

Path /data/data/com.keke.t/databases/popweb.dataBase-wal
Size 36KB
SHA256 9e58ce9b321413197a24d58405b21a1e095a13b4251bcdc878adad95728ec4e2
MD5 2c0bcb1d8659e8b7ec0e2a187bd68859
SHA1 0cc74a5d51e9327b79b25fe8f17c8771ec35ce59
SHA512 5f01e3feabe7613b5b6720589c26cb11f87e90f75064dd3f44e37284d2c4aa23f35e0c535a1a235a86e5e7483d74002eb1dfcf5d30eefdbdf144be309ceb7db1
SSDEEP 12:KLnlYnQ5zdTRmBEyPbP/loDqSzOwClCn2S8mYyNTSFbyH9vVwhFUjnrAW9jSWaMV:KrzyGSP/CDZVCEN9vVwOaGSP/SET
TLSH
T167F2CED2AFC41453C299C671AAEB83952C50598BD3F6CB8320F8C830ECC164864B3E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads