Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    15/10/2026, 02:52

General

  • Target
    jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.fr.apk
  • Size 676KB
  • Sample261015-dcsq7aba89
  • SHA256 f468198322f763ff2d9b0d86cac743baf302d31c2c1739275b603033bb8d0798
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

Processes

  • com.keke.t
    1⤵
    • Removes its main activity from the application launcher
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4818

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        inner.dataBase

        • Path /data/user/0/com.keke.t/databases/inner.dataBase
        • Size 20KB
        • SHA256 7571fe6825dbac4e48cfb86eb49f46450600c665f2a1d8245dc9b974ec93b95d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        inner.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/inner.dataBase-journal
        • Size 512B
        • SHA256 cfff0afee2a10d3da6644bbc734e7db2dfa638fa103c6f995ebdb3a5f1f572c7
        • MD5 SHA1 SHA512

        inner.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/inner.dataBase-journal
        • Size 8KB
        • SHA256 58cd5e9b703d009ce823c201534563e83c36f40af9d8da0b4c2b3aadcd25b6d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        inner.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/inner.dataBase-journal
        • Size 8KB
        • SHA256 e3751d2961b6541d9d5bf9e83e7190ba75c347b2787925918e3625eda39ee91a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        innerlog.dataBase

        • Path /data/user/0/com.keke.t/databases/innerlog.dataBase
        • Size 20KB
        • SHA256 82eaa8d3096f7d6f0dd403b61e7706410e6049e12ec86f9211e39c3655cb72a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        innerlog.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/innerlog.dataBase-journal
        • Size 512B
        • SHA256 3f45c6ae6e72d34001264939aecfec3ba400eff568bac985ee496fdb1b89d1ea
        • MD5 SHA1 SHA512

        innerlog.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/innerlog.dataBase-journal
        • Size 8KB
        • SHA256 bb382c4f2929f80a2008a4680e5d476c8da4b8bcfe1c39ba8c22fedfa2a7186f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        innerlog.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/innerlog.dataBase-journal
        • Size 8KB
        • SHA256 d058ef5bbc3d8954862abf8a7f65ba791eb7b288977cfec2305b90a0a4f3ae9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ins.dataBase

        • Path /data/user/0/com.keke.t/databases/ins.dataBase
        • Size 28KB
        • SHA256 a8902beed443daf0c8088adce10bff450b6b455a7f0e84ed6f335375cdfca147
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ins.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/ins.dataBase-journal
        • Size 512B
        • SHA256 2e765eea3841687d98882251f4741fec03eda7b99c43340a17668f7cb1171007
        • MD5 SHA1 SHA512

        ins.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/ins.dataBase-journal
        • Size 8KB
        • SHA256 14148cdc5df47f389b73f752149e678628e9dd040490acafed40c84a2756d59c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ins.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/ins.dataBase-journal
        • Size 8KB
        • SHA256 211db4b6b9891a014f1b4924a004afee10efb0d2f977ccd7ddd807c00e71c155
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ins.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/ins.dataBase-journal
        • Size 12KB
        • SHA256 75222ceba398672e6d7a579f77d7020f27340cb01fd254bcc8c6afa0baf7e5d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keyg.dataBase

        • Path /data/user/0/com.keke.t/databases/keyg.dataBase
        • Size 20KB
        • SHA256 c567900a6ff7b6e8cc28ac94e8d372fee38861b10b1f06eef3c7985d263a2ff6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keyg.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/keyg.dataBase-journal
        • Size 512B
        • SHA256 88c93963117969a4f7232a68deca0ed769cfa482ed624d7e44a7500a931c694b
        • MD5 SHA1 SHA512

        keyg.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/keyg.dataBase-journal
        • Size 8KB
        • SHA256 752c1b9bf9230ebac899f2500662dfa13d381e69d36b3b0348337f66004a310a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keyg.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/keyg.dataBase-journal
        • Size 8KB
        • SHA256 6dea0e1b3ea756ce810a27528ba3bd2d0fe72d99c71fe63759212cbe92ec99ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keylog.dataBase

        • Path /data/user/0/com.keke.t/databases/keylog.dataBase
        • Size 20KB
        • SHA256 31a978714f8c41fd6a7f4a3ad6c0a7458632eb52831bd701ebefa063be35213d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keylog.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/keylog.dataBase-journal
        • Size 512B
        • SHA256 1aa9fe49079b42b97cb81ea7631f61a162ef44f040640841874084f56920d092
        • MD5 SHA1 SHA512

        keylog.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/keylog.dataBase-journal
        • Size 8KB
        • SHA256 3a64379504feabc976509698f91d3fd006474661b2b1c149a67a7b7050452278
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keylog.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/keylog.dataBase-journal
        • Size 8KB
        • SHA256 248b71e5c6f9792c8b69fd4c7cf804d922c8f356081e31306da3580834938c4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pop.dataBase

        • Path /data/user/0/com.keke.t/databases/pop.dataBase
        • Size 20KB
        • SHA256 0284e2aee0f293999eb638baabf1c911a9faca8f07a97f35bec5be1527e74c7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pop.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/pop.dataBase-journal
        • Size 512B
        • SHA256 593484e698e1dd35ce980e8a92d16fa54321d3f133ab2a746e886cc3ef0676a4
        • MD5 SHA1 SHA512

        pop.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/pop.dataBase-journal
        • Size 8KB
        • SHA256 ab68cf755fc95cece9ae4499b2e68398b686aad352ecdc17ab0e8044075a4294
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pop.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/pop.dataBase-journal
        • Size 8KB
        • SHA256 c6bffd4dec561dc30413ec15beb68d2038efd23e5588a79af3e9cff42eb70e86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        poplog.dataBase

        • Path /data/user/0/com.keke.t/databases/poplog.dataBase
        • Size 20KB
        • SHA256 48b5760c7d5042c827b0e5f9cd8edb81f87ead673baaaf8894b3acd8db8bea30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        poplog.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/poplog.dataBase-journal
        • Size 512B
        • SHA256 b3f923dde7ec7638e37df7542484285b950d34c61523e5c50d11a19df6174778
        • MD5 SHA1 SHA512

        poplog.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/poplog.dataBase-journal
        • Size 8KB
        • SHA256 30aa9cf898fd01e9530c2a9d5559265b5ebbd0a83624d32092123a98304e31d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        poplog.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/poplog.dataBase-journal
        • Size 8KB
        • SHA256 7f6f2e70769c8f148f84ce2f20e6689d1ce679d870c0061899f69310c9fdd725
        • MD5 SHA1 SHA512 SSDEEP TLSH

        popweb.dataBase

        • Path /data/user/0/com.keke.t/databases/popweb.dataBase
        • Size 20KB
        • SHA256 a1781319ebf44c186ff7e8152df85c78ccc7b06aca88d5c642b9072a7f2db237
        • MD5 SHA1 SHA512 SSDEEP TLSH

        popweb.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/popweb.dataBase-journal
        • Size 512B
        • SHA256 0682bf8697309de40ceda1004630bda1f8615e3b21e7fe29c3638470e6ab00d1
        • MD5 SHA1 SHA512

        popweb.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/popweb.dataBase-journal
        • Size 8KB
        • SHA256 8d11d0331b4b2074cf9aad3c5e44c1e74af28045326b721181af40a67091d6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        popweb.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/popweb.dataBase-journal
        • Size 8KB
        • SHA256 6c75c05bdc9cb3f9d05a1efbc7f822c8d5b5c90e9d758215512eceb242406984
        • MD5 SHA1 SHA512 SSDEEP TLSH

        popweb.dataBase-journal

        • Path /data/user/0/com.keke.t/databases/popweb.dataBase-journal
        • Size 8KB
        • SHA256 460e5365ad7046e8469ed16dfc281a9be718567942c35b68b7c79159ab2c495e
        • MD5 SHA1 SHA512 SSDEEP TLSH