Analysis

  • user interaction
    yes
  • max time kernel
    3s
  • max time network
    256s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system
  • submitted
    15/05/2026, 18:00

General

  • Target
    ibis-Paint-X-Pro-v13-5-14-MOD-rajaapk-com.apk
  • Size 54.2MB
  • Sample260515-wlevssdw7t
  • SHA256 194278225eb3101f25fb4a7af0284662ef66159f93d4bfe3963647cd7dc21e44
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Checks the presence of a debugger
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • jp.ne.ibis.ibispaintx.app
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Checks CPU information
    PID:4510

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 f3fe7ae4c0caed819a11a44e5332bf045ab390347fcce463a29a2cbc57db14b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 6e97cb95a89d87f543dddbd5dbfee0e74b16b0a148b336055cb0c1fd28988277
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 e84f018e45853ed715bb4c0eee5b7b4030c754318ae93139a6e97ddc5b84fa23
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 ddda7e639622d5296825eafcf676bfd6cb970927096758e13dc9633ddedf5942
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cacert.pem

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.cert/cacert.pem
        • Size 216KB
        • SHA256 2782f0f8e89c786f40240fc1916677be660fb8d8e25dede50c9f6f7b0c2c2178
        • MD5 SHA1 SHA512 SSDEEP TLSH

        internal-keys

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH

        app.json

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/native/app.json
        • Size 232B
        • SHA256 46f7bf43c8552ab3dcc989b4443567aab0a51f0d081304379cf7fc9612b90154
        • MD5 SHA1 SHA512 TLSH

        device.json

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/native/device.json
        • Size 194B
        • SHA256 4ff85c4413a37b4268b2a10e36292208415c96c9fb8dcc4a49d80411e8e95834
        • MD5 SHA1 SHA512 TLSH

        os.json

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/native/os.json
        • Size 56B
        • SHA256 77b886b74dd48e22effd172c38ee914ced97247f4516c319f09cb8c9ebce4c7a
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/native/session.json
        • Size 127B
        • SHA256 4fef4d339e9d985ebedb7d51ed23099ef45692b36615c26aae9932782534a23c
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/report
        • Size 765B
        • SHA256 b8deca18ae9cc1289a911370f3db7125ab79c102fbec4da363cec63e95dead82
        • MD5 SHA1 SHA512 TLSH

        userlog.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        FirebaseHeartBeatW0RFRkFVTFRd+MTo4MjgwMzkxODczMTc6YW5kcm9pZDozZjkwZGU3NTlmNzkwMjhm.preferences_pb.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo4MjgwMzkxODczMTc6YW5kcm9pZDozZjkwZGU3NTlmNzkwMjhm.preferences_pb.tmp
        • Size 430B
        • SHA256 d371a40c95f69f1e97c03f7f1052709807a1cc7be3271de05241248f212df886
        • MD5 SHA1 SHA512 TLSH

        sessionDataStore.data.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
        • Size 285B
        • SHA256 88c1bc5222c614d9ff6263d54b30b214f00d5c4e382841a09e8eb602d851e8d2
        • MD5 SHA1 SHA512 TLSH

        sessionDataStore.data.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
        • Size 323B
        • SHA256 10c07479cb344dc35c54fb20ade9a1b58f1c0c996c4fa2998f0a2adcc073e8af
        • MD5 SHA1 SHA512 TLSH

        sessionDataStore.data.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
        • Size 323B
        • SHA256 915da91d8dbb7c03f328591ed9e075ff2ed849ade5811c15f205591f0e007512
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 787675a59fb6b8c2417e88566858809794a867a676318c69d2500532562e6ee8
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 f7f6b5df8b0702d6aee70c1ddf52695322bf07d880fbee50a15c676d8924f923
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 9218407ae984a9b7e5dd7c063b0fa6be9378ba8fa207b1a5bd09753b89226763
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.window.extensions.jar

        • Path /system_ext/framework/androidx.window.extensions.jar
        • Size 123KB
        • SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 25KB
        • SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH