Analysis
- user interaction
yes - max time kernel
3s - max time network
256s - platform
android-13_x64 - resource
android-33-x64-arm64-20260325-en - resource tags
arch:arm64arch:x64image:android-33-x64-arm64-20260325-enlocale:en-usos:android-13-x64system - submitted
15/05/2026, 18:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ibis-Paint-X-Pro-v13-5-14-MOD-rajaapk-com.apk
Resource
android-33-x64-arm64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ibis-Paint-X-Pro-v13-5-14-MOD-rajaapk-com.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target ibis-Paint-X-Pro-v13-5-14-MOD-rajaapk-com.apk
- Size 54.2MB
- Sample260515-wlevssdw7t
- SHA256 194278225eb3101f25fb4a7af0284662ef66159f93d4bfe3963647cd7dc21e44
- MD5 4a9c164e49b30b0cfef65fcd162ba953
- SHA1 a592629bd1102b9b786fcc6aa3055849cbe63eb2
- SHA512 ea1e85152ff752112123956a88f0f78b2f5c508ab6b461279c2644919324f672f0840d4e85ec52bb4cb9e5ce988e5e343b1c227602bb3a7e170949a2fc81c639
- SSDEEP 1572864:bcEIyAT6Zt/TNgHkprLTdH2BhEh0qQImrLT/kjG:gOAWXNgHkpRD0l/LkjG
- TLSH T12DC73383F3A9D81ECEB745344F350BA313970E5282A2DFAB9624718C8AF7D480E55F95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk jp.ne.ibis.ibispaintx.app /system/xbin/su jp.ne.ibis.ibispaintx.app - Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.extensions.jar 4510 jp.ne.ibis.ibispaintx.app /system_ext/framework/androidx.window.extensions.jar 4510 jp.ne.ibis.ibispaintx.app /system_ext/framework/androidx.window.sidecar.jar 4510 jp.ne.ibis.ibispaintx.app /system_ext/framework/androidx.window.sidecar.jar 4510 jp.ne.ibis.ibispaintx.app - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses jp.ne.ibis.ibispaintx.app - Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 17 pastebin.com 34 raw.githubusercontent.com 56 raw.githubusercontent.com 57 raw.githubusercontent.com 58 raw.githubusercontent.com 13 raw.githubusercontent.com 60 pastebin.com 64 raw.githubusercontent.com 10 raw.githubusercontent.com 12 pastebin.com 59 pastebin.com 65 pastebin.com 11 raw.githubusercontent.com 14 raw.githubusercontent.com 61 raw.githubusercontent.com - Checks the presence of a debugger
- Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo jp.ne.ibis.ibispaintx.app
Processes
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events
- Size 56KB
- SHA256 f3fe7ae4c0caed819a11a44e5332bf045ab390347fcce463a29a2cbc57db14b8
- MD5 e0822a35a318cfee6da9286e4920783b
- SHA1 5cd047403d4d46d290f13400ae143e8e00c18344
- SHA512 3ab8275e6a61bcf5d6a5c7337fa2365f3f802733bb157733e29e4e52e691be5061ea79e156a6907a7032affe72088101360bb54ccf8cd9fe3e12d7845701304c
- SSDEEP 48:TF59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSk:9MEqzAiwIyNjak
- TLSH T11243745D5E3C2220C5BE283ED7E143635F3C93DF5B23922239948CFA8DC246974354A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 6e97cb95a89d87f543dddbd5dbfee0e74b16b0a148b336055cb0c1fd28988277
- MD5 87f768e17040313c8665984fab35c32e
- SHA1 b618b4d029021b28bdce90b1cdff4bd75afe982b
- SHA512 7c72b0b72252cb104cf6b658c6a856844c92a274134d07dfc9f3c0bdfa4d0cc5bd912511f2bdabe9c31d0febb1d67d24c76d6e0409bb641c21057a60f68ea638
- SSDEEP 6:7+/l9DiOSFPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKybkt/2q:7+thirBqLJdKBRmBEyPbLoD
- TLSH T1250222C8A3410803C91A57B790D983401F55EF16C323CF87055008542C036CCA890D40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 e84f018e45853ed715bb4c0eee5b7b4030c754318ae93139a6e97ddc5b84fa23
- MD5 08a519e6d20053d8937b17c68cb57e57
- SHA1 a416aa6fca7134fa3d231bbb738e11a3b46b5159
- SHA512 519aa7389cf5f4186f96138be2a50c3b8f308eaec1bd96ac7883958dd7d3134a809b71c40f84c4832dba035e8e056ed444c2841c84be9f4c129a8cbedceddcbd
- MD5 SHA1 SHA512
- Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 ddda7e639622d5296825eafcf676bfd6cb970927096758e13dc9633ddedf5942
- MD5 bbb665b7fed6e0e1a644ebc3d4d0c26b
- SHA1 bc71867263a9336261dd950228259bf852064092
- SHA512 3f39543b2c67d5ae0725527c90db44bfa030edd66f4ab030dc254e12dd6855eff9d68632d10af0b0b7205ad44158e803bd8ac4b3577ecb1c60a2f55f5d17e325
- SSDEEP 6:7+/l968Hn1e+Wg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKT:7+tECWqLiuWd7RmBEyPbc
- TLSH T10F02C09C63802813FC1E677790E483580D01E7188272CB0B059008A43C034CCE4A0D48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.cert/cacert.pem
- Size 216KB
- SHA256 2782f0f8e89c786f40240fc1916677be660fb8d8e25dede50c9f6f7b0c2c2178
- MD5 18c68c9898be980227f33c213a2464aa
- SHA1 1057b838cf913c5e188e6ec6697b6f2b49637c29
- SHA512 0d49bd1435a25b113a34ac38b337a9c904b6ac720824fd55d410ff6d8f6d0f637b54fd92cdff31d1c632b6a77f35fe55de9c756f35365387cea94f0fd93631b1
- SSDEEP 6144:j4597qxzwd9afaNR6dTd4tL2b02dTCkMgv:j4f7MC76f4tLe0mtM8
- TLSH T14824AEA78F853D4928E3E490C9AB126EC959C362EDDBB0B31D193841C746B3D66FD08D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/internal-keys
- Size 107B
- SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
- MD5 58c6ffd18aab0e3303cd49e1d2fdb9c5
- SHA1 7dd517bc9278addca0e9c229dca834edbe030b44
- SHA512 eba20532172d1bff0a750a5293024efd98c0c5822f3f15b469d1a54ce917ea78cc7f644c3e7d7a59dabac0226a942474c2a481f970ba8b519c24bf0765c799b3
- TLSH T1B9B0126061D5EA3738F6221DAD3244C1A5910D861452C38C6F14741EFE7006E69AF97C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/native/app.json
- Size 232B
- SHA256 46f7bf43c8552ab3dcc989b4443567aab0a51f0d081304379cf7fc9612b90154
- MD5 83f34ca13763b7763715e39c50683d9a
- SHA1 7a50a94368ba579b632c819064d89109c5b83915
- SHA512 f4fdece9bbd80481f6f268eec3407bfc1e762503ea3f79e10794a762286ad6b8d0713be395ff6b1d0eb727cc0b3aa30844241eb64dbc6ce2cb642ccc8ae7208f
- TLSH T1E5D09720A824943363E5134F41CBC4E107FB30E146A922CC6E480C9E0321ED81200446
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/native/device.json
- Size 194B
- SHA256 4ff85c4413a37b4268b2a10e36292208415c96c9fb8dcc4a49d80411e8e95834
- MD5 b35193696574cd9494b082a9c5f9ba69
- SHA1 ed9881cc33d869105d6f1a3f6bf8c7c4a43b608c
- SHA512 903e0b10b6385218199f502857b645d7144e70ea68259fa82df7ac398f0900a898de3b9e6767a97722d3be63832c2187e285102b506706781c4c19b9dd3d4516
- TLSH T136C012F5EC7E3AAE8BD1E1942C378E53FC7508341A4D6D2064F58D15240F8949399969
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/native/os.json
- Size 56B
- SHA256 77b886b74dd48e22effd172c38ee914ced97247f4516c319f09cb8c9ebce4c7a
- MD5 87e2b9d6edc06545b88235933e703881
- SHA1 b29448a47c87bfe3a59286e3cf4e02eb72581a7e
- SHA512 ccccd682e14a485c8c8d13ca0105d196d00fe02bed941d939154a199c14e741eac6522f378f509ed14a52efd38e479930ae223f6f317a35b0787d82e553db3a6
- TLSH T16E9002B69880A036105203545A555E51D37014726045F0245897041112A71B80231109
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/native/session.json
- Size 127B
- SHA256 4fef4d339e9d985ebedb7d51ed23099ef45692b36615c26aae9932782534a23c
- MD5 cda3400a02f5d171ef9ec32ff0395f40
- SHA1 3ec4667a99c4cb51f79296704d8b8d903af28fb7
- SHA512 292676ada2ab50e74312e72641d4e611fc263045bbc82782ff287df6749d0f6d4d903cd60a785c186aca80966dc39d0bdbb42093e91c7662873aa48239b5c4e9
- TLSH T186B02B782BE0347012E35C52E022CD3442A4020A1D10C81609F001591610A040302C51
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/report
- Size 765B
- SHA256 b8deca18ae9cc1289a911370f3db7125ab79c102fbec4da363cec63e95dead82
- MD5 b88b0b8d4361aff8104e4fd38010278b
- SHA1 778ac3c4c5a08c49411af7fc02835e5808af4daa
- SHA512 2c8612904661d79f420a62b193cb5d16cbdbae05d838ce2f0a714ef4ca400a794ece7959f59649d4f170a5adf182dd7a3314f2d86b9e1ff9b785c535ed2fe020
- TLSH T1C5011578DBB9313842C9F34BA056ED57D7743364A71291CC6ED70247129F8FC1202535
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5C03440001119EE2B7CB066015/userlog.tmp
- Size 16B
- SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
- MD5 c33583fae4e0b61cde1c5b9227963237
- SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
- SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
- MD5 SHA1 SHA512
FirebaseHeartBeatW0RFRkFVTFRd+MTo4MjgwMzkxODczMTc6YW5kcm9pZDozZjkwZGU3NTlmNzkwMjhm.preferences_pb.tmp
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo4MjgwMzkxODczMTc6YW5kcm9pZDozZjkwZGU3NTlmNzkwMjhm.preferences_pb.tmp
- Size 430B
- SHA256 d371a40c95f69f1e97c03f7f1052709807a1cc7be3271de05241248f212df886
- MD5 508e4a13e132306890ec6e2d26afa44e
- SHA1 202735b4574396a5bd49a201c4efcfa1145f7686
- SHA512 908e8e43d6b3e20ac1cba2dd012ee4f677d2827a96a01caa821efe0b27f76741b0bcaa981224c09bec0e5bbf92386abc042444de209e0c8794af5036b21fc621
- TLSH T18DE02320DED15DF11827510D7F54032C4F3F575532BD516531E40188F90D65556C3F0B
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
- Size 285B
- SHA256 88c1bc5222c614d9ff6263d54b30b214f00d5c4e382841a09e8eb602d851e8d2
- MD5 86b6ab672384fecd36d4bf43aad2e9b7
- SHA1 58c3d50ed5014a05eb90656fda570e9e2d611d85
- SHA512 ff4a3dcbf9f43f5eaac634f67e2131d8a3832681a5c18e6b51d7ebc1ebdd61669d8dc59623eb43512f79376728f35a037714b614f1ad2d92f6a3f58140bd7273
- TLSH T127D0EB10DA0820BB1F90D1063CE4C0314E3B341176FA880CC8E98B4C8E3C89A173638E
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
- Size 323B
- SHA256 10c07479cb344dc35c54fb20ade9a1b58f1c0c996c4fa2998f0a2adcc073e8af
- MD5 2f8a8312006ec7206bc581313b79b26a
- SHA1 0be33c96a656bdd4ee524f2b5f599a59e85edbb0
- SHA512 50680f2729bf254d2077445728fcd0cd681d746e31f0e1890555f2e99ba3aa90f7d36a4440ce910c9a993ae4e93a89d56101538c235914d3b272cae70c96b0be
- TLSH T18FE07D10DA1810AF6B60D1067CA4D5314E3F35126AF9495CC8F98B4C4B7E85D173678E
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
- Size 323B
- SHA256 915da91d8dbb7c03f328591ed9e075ff2ed849ade5811c15f205591f0e007512
- MD5 b431cb2cc4f747ef689b95696487119c
- SHA1 595cdcdfdd36f9b846a79d65419a05a0967e6280
- SHA512 4ef4921f1b1bfed812b01bf3c9a3b4945bbbdbf03c71abd34e3832ad5d2f150c2864dca3ea439d24013c17758df6ebd66fed678357253100eacc38f4a4356d1a
- TLSH T1B7E07D10DA1811BB2B50D1067CE4D6315E7F351266F98E5CC8FA8B4C4A7D89D173638E
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
- MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
- SHA1 fee434f784e73cc7916322e949f727caf8363102
- SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
- TLSH T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 787675a59fb6b8c2417e88566858809794a867a676318c69d2500532562e6ee8
- MD5 f04835cdb7d614c31341773b3e1f8f15
- SHA1 4437db056fcd4865e5177e0563475850a64c17f4
- SHA512 c9e0e8da249bc4f2df4662f4ad6131978202e13a508839f2a8d84a1713b82be48274722380260d09a75b0921f6c169635c389519bede468c42f5d97a6e4e6884
- MD5 SHA1 SHA512
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 f7f6b5df8b0702d6aee70c1ddf52695322bf07d880fbee50a15c676d8924f923
- MD5 cf25aa01fe3e396c3026a0746b43b1ea
- SHA1 f257977c10941442089b59bc73a1da5f24335747
- SHA512 014c0abbc6b511eab981b5041856fa65a1b61d1ada4965d2130c205294494f90fc13d430ad48def4cfb4581473018e5be8a2af64c8d62d216236060195136a50
- SSDEEP 6:K6zq35l9FZdKEAlOERX4PBX4ogLugMBX4suuK+/8y/sLHkRsTOw2:KeyzdKBRmBEyPbP/COw2
- TLSH T11272C2ACB3C01B33C90A437350F4A34D0E12969F9792CF0715501822BD017CCA864E08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-wal
- Size 112KB
- SHA256 9218407ae984a9b7e5dd7c063b0fa6be9378ba8fa207b1a5bd09753b89226763
- MD5 10b1669e339552533490868427b2d38a
- SHA1 7e89dba10207945d4b92389f9c519a303fd84ab0
- SHA512 b18710bebcc2cbdfd880dcf7a72916fd8d8a2f83e4830bc5a2a935a8b65629d9a706586c40cc72b88fcd3f23779fc72e478637fc52be3599981be35a042d1065
- SSDEEP 96:cq327EWITDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:5327EdnndjnHt9S/f8JzSV+6D86T0ED
- TLSH T100B3118D2F992610C8AAA4F095F01FA1793F812FD393E7D165914076EDC2921ED25CFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.extensions.jar
- Size 123KB
- SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
- MD5 3056e1bdb7d4e19789d0319eff484bd0
- SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
- SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
- SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
- TLSH T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 25KB
- SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
- MD5 29469324e59dfcc052f24b5af4e7b2c4
- SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
- SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
- SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
- TLSH T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
- MD5 SHA1 SHA512 SSDEEP TLSH