Overview

overview

10

Static

static

7

Paint Art_1.3.apk

android-10-x64

7

Paint Art_1.3.apk

android-11-x64

7

Paint Art_1.3.apk

android-9-x86

10

Analysis

  • max time kernel
    107791s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    12/12/2022, 12:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Paint Art_1.3.apk
  • Size 4.1MB
  • Sample221212-p7rcdsbd39
  • SHA256 0f41adb9d470c2450c2987c1c6b3a2ddcf8bcc47fad7a54ee4ec064afd0b8a3e
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
ransomware

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Reads information about phone network operator.
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.nuklis.artpainting
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4458

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Cookies
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/Cookies
        • Size 64KB
        • SHA256 e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cookies-journal
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/Cookies-journal
        • Size 1KB
        • SHA256 d468dd55e454d59da901619f6fe7f40604a9fb86d746406f323c55e9e5ca0ce0
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/GPUCache/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/GPUCache/index-dir/temp-index
        • Size 96B
        • SHA256 24b309b78b1b6c59413181d3e72df580defe158e36abdbb1243c63a44c62795c
        • MD5 SHA1 SHA512
        Submit Download

        000001.dbtmp
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/Local Storage/leveldb/000001.dbtmp
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512
        Submit Download

        000003.log
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/Local Storage/leveldb/000003.log
        • Size 496B
        • SHA256 a39c8fce8cc3eeaba829b5b32288d01c47ece8f52e5cfd3b30aa584c23474653
        • MD5 SHA1 SHA512
        Submit Download

        LOG
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/Local Storage/leveldb/LOG
        • Size 140B
        • SHA256 f83cdec993aadca453d6d0147758aafcb12f18814dd0d8a49a81ac2ac6119a63
        • MD5 SHA1 SHA512
        Submit Download

        MANIFEST-000001
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/Local Storage/leveldb/MANIFEST-000001
        • Size 41B
        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
        • MD5 SHA1 SHA512
        Submit Download

        Web Data
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/Web Data
        • Size 120KB
        • SHA256 8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/com.nuklis.artpainting/app_webview/Default/Web Data-journal
        • Size 2KB
        • SHA256 7fea2f32b4203c1ad3d903e0e76410028c59dfdd7c13f5d6ca7f45fadd67b5ed
        • MD5 SHA1 SHA512
        Submit Download

        webview_data.lock
        • Path /data/user/0/com.nuklis.artpainting/app_webview/webview_data.lock
        • Size 28B
        • SHA256 8460d968b62705b7644c1dde1f64aadda02fdd1776d32c2394ade0d27d825590
        • MD5 SHA1 SHA512
        Submit Download

        1633031840514.jar
        • Path /data/user/0/com.nuklis.artpainting/cache/1633031840514.jar
        • Size 19KB
        • SHA256 b8d90074a4efd78bcdecc27a24d4249d53b0b76134590750733d1136d9ad964e
        • MD5 SHA1 SHA512 SSDEEP
        Download

        settings.dat
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Crashpad/settings.dat
        • Size 40B
        • SHA256 969b7a692d2566794e2dd046db414fee1bd336924dfe0dde6fe8812ea27945b0
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Default/HTTP Cache/Code Cache/js/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
        • Size 96B
        • SHA256 e2a85d6b9e5b66b245cc59987df789d09d031e2d27e492effee9ffdeb7ef6a44
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
        • Size 96B
        • SHA256 73bd1ae3a40c84057a782040d75da84d50fedb503a8507e6a17e2c473e4ec57b
        • MD5 SHA1 SHA512
        Submit Download

        dfe6b2497a7513ba_0
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Default/HTTP Cache/dfe6b2497a7513ba_0
        • Size 12KB
        • SHA256 60fd529c06d80787b9ae8cbffeb6acdbbae957c0b4ec124269c089848dabc75c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        f038e94cb33282ab_0
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Default/HTTP Cache/f038e94cb33282ab_0
        • Size 247KB
        • SHA256 e7d1718295868fcc2744ebbef3e16279a6f74332b65902f5a4e0094cbb08f601
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        index
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Default/HTTP Cache/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Default/HTTP Cache/index-dir/temp-index
        • Size 144B
        • SHA256 c20d1271b79f18d3bcd67167e6cfe60a59ab436af0bcaf9b591b27195a7112eb
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/Default/HTTP Cache/index-dir/temp-index
        • Size 192B
        • SHA256 58c9a5e307918956ee3573eeecd66555315425e2f0002bee4da6e5542ef56c66
        • MD5 SHA1 SHA512
        Submit Download

        font_unique_name_table.pb
        • Path /data/user/0/com.nuklis.artpainting/cache/WebView/font_unique_name_table.pb
        • Size 57KB
        • SHA256 0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PAINT_ART.DB
        • Path /data/user/0/com.nuklis.artpainting/databases/PAINT_ART.DB
        • Size 88KB
        • SHA256 1a781cd15e8ceb685a08cd43cf2b722e87124e4fb4cdf4072ebd1b51d3ec936a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PAINT_ART.DB-journal
        • Path /data/user/0/com.nuklis.artpainting/databases/PAINT_ART.DB-journal
        • Size 1KB
        • SHA256 ce607ac32ff610a64e3963e3b377dc989edb741523b5436c2c17d766a48d87e1
        • MD5 SHA1 SHA512
        Submit Download

        layer_1_1670849941622.png
        • Path /data/user/0/com.nuklis.artpainting/files/temp/layer_1_1670849941622.png
        • Size 844B
        • SHA256 289e9ebd3e31faf2cf2293aa0eb5f5293fdfc04de8c9bd6bd00b7ef587e975a6
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb
        • Path /data/user/0/com.nuklis.artpainting/no_backup/androidx.work.workdb
        • Size 8KB
        • SHA256 4b34cf505050facf47aa7936e4e7667e1969105665c632b3eefe7ecddf9a6935
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-journal
        • Path /data/user/0/com.nuklis.artpainting/no_backup/androidx.work.workdb-journal
        • Size 1KB
        • SHA256 87238603fcde0162e66ab059d5601b11051a594d34678577cd610b09a26bf9d7
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/user/0/com.nuklis.artpainting/no_backup/androidx.work.workdb-shm
        • Size 16B
        • SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-wal
        • Path /data/user/0/com.nuklis.artpainting/no_backup/androidx.work.workdb-wal
        • Size 217KB
        • SHA256 cb55d8ecbe3a004145bbf8e5b8be0d18c7a2ef2838c8f6b7b529e6a560b55653
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/com.nuklis.artpainting/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd
        • MD5 SHA1 SHA512
        Submit Download