Analysis
- user interaction
yes - max time kernel
4s - max time network
304s - platform
android-11_x64 - resource
android-x64-arm64-20260325-en - resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system - submitted
15/05/2026, 18:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ibis-Paint-X-Pro-v13-5-14-MOD-rajaapk-com.apk
Resource
android-33-x64-arm64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ibis-Paint-X-Pro-v13-5-14-MOD-rajaapk-com.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target ibis-Paint-X-Pro-v13-5-14-MOD-rajaapk-com.apk
- Size 54.2MB
- Sample260515-wlevssdw7t
- SHA256 194278225eb3101f25fb4a7af0284662ef66159f93d4bfe3963647cd7dc21e44
- MD5 4a9c164e49b30b0cfef65fcd162ba953
- SHA1 a592629bd1102b9b786fcc6aa3055849cbe63eb2
- SHA512 ea1e85152ff752112123956a88f0f78b2f5c508ab6b461279c2644919324f672f0840d4e85ec52bb4cb9e5ce988e5e343b1c227602bb3a7e170949a2fc81c639
- SSDEEP 1572864:bcEIyAT6Zt/TNgHkprLTdH2BhEh0qQImrLT/kjG:gOAWXNgHkpRD0l/LkjG
- TLSH T12DC73383F3A9D81ECEB745344F350BA313970E5282A2DFAB9624718C8AF7D480E55F95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/xbin/su jp.ne.ibis.ibispaintx.app /system/app/Superuser.apk jp.ne.ibis.ibispaintx.app - Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /system_ext/framework/androidx.window.sidecar.jar 4781 jp.ne.ibis.ibispaintx.app /system_ext/framework/androidx.window.sidecar.jar 4781 jp.ne.ibis.ibispaintx.app - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses jp.ne.ibis.ibispaintx.app - Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 36 raw.githubusercontent.com 43 pastebin.com 45 raw.githubusercontent.com 53 raw.githubusercontent.com 37 raw.githubusercontent.com 55 pastebin.com 38 pastebin.com 39 pastebin.com 40 raw.githubusercontent.com 54 pastebin.com 41 pastebin.com 42 raw.githubusercontent.com 46 pastebin.com 56 raw.githubusercontent.com 57 pastebin.com - Checks the presence of a debugger
- Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo jp.ne.ibis.ibispaintx.app
Processes
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events
- Size 56KB
- SHA256 6490b5e6b1353a89df2cf22b5d5cbf749da202e081b0eb7ef73d754ce7dac366
- MD5 f0da3174f1ff01686d7daca3ff486356
- SHA1 c1cd1e4b6f47ed8f86b51251671ff3dbbffe7085
- SHA512 91828f6968a1b66f05ddfd6b82d1ffc7c11873353d17299aa7b0a4b04c4b9019a6c0e90b020e1b6b7b884dba1aa5409159ee55e0aad272cb0f1ba54375c3d24b
- SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSo:WMEqzAiwIyNjao
- TLSH T19F43635D5A3C2220C5BE283ED3E143635B3C93DF5B22926139948CEA8DC246975354AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 5340453921956ba596104b70bb8ec0d3336c3d3dbd0f7c7d74e6d6507c1fa193
- MD5 fe3499fdecf58b672cec5ca3795d9e88
- SHA1 0f7181f384cd555788f9365a22892ea1b62c607a
- SHA512 262d51fae234aea6449e0e03502da6ea70ca4a4655793327808913307a7be715c88dde899282866d3476af33b8262f3e6ef793f3e5773e1dd484eadf0176dcba
- SSDEEP 6:7+/l9ZPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKoa0//S:7+tvqLJdeWRmBEyPbU0XS
- TLSH T1C9022288A3400C03C22D277BA0C883801E18AB289273CB4726D108542C4AECCA890D14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
- Size 512B
- SHA256 c52af0b8ff0bb2b4b1ec77b7f65bb4f5b8ca31cd3773972c905745980b571d85
- MD5 e0237b3f871a351c3662e733c9c30fcb
- SHA1 ef19028dde54621372af8f529c50d0cd20996c8a
- SHA512 d51b470cc26fc44ca818386e2a297a666b9f0dbddbb16ccd9d4eaebd08792a252b4a210735b4291201949183cb58fd7af5d973c22585caf398e1dfb8affbce90
- MD5 SHA1 SHA512
- Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
- Size 8KB
- SHA256 011d1f6b77342a948a5a8b00421445ff7e47bf45e8894be6c76b881c35b5befc
- MD5 b3c1d838a723ef62f3896ce6b6c2d795
- SHA1 e71fee50f513b7644cadc7275e3d23e4badb692c
- SHA512 17c3f67559d4ee8ffe2363d9cb46220f63ee835903e6c39fc176a99f1676cb2491982e304173e0e8b9a80c8b251f1d8ddd91e505dbf1a5655ce0e180c5f1272c
- SSDEEP 6:7+/l9c4n18g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK44:7+tAqLiuWdYRmBEyPbW
- TLSH T11B02228CE3810912CA2D16B7A0D4C3400E00A72E8165CB2796A208A46C475CCA4A0D14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.cert/cacert.pem
- Size 216KB
- SHA256 2782f0f8e89c786f40240fc1916677be660fb8d8e25dede50c9f6f7b0c2c2178
- MD5 18c68c9898be980227f33c213a2464aa
- SHA1 1057b838cf913c5e188e6ec6697b6f2b49637c29
- SHA512 0d49bd1435a25b113a34ac38b337a9c904b6ac720824fd55d410ff6d8f6d0f637b54fd92cdff31d1c632b6a77f35fe55de9c756f35365387cea94f0fd93631b1
- SSDEEP 6144:j4597qxzwd9afaNR6dTd4tL2b02dTCkMgv:j4f7MC76f4tLe0mtM8
- TLSH T14824AEA78F853D4928E3E490C9AB126EC959C362EDDBB0B31D193841C746B3D66FD08D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/internal-keys
- Size 107B
- SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
- MD5 58c6ffd18aab0e3303cd49e1d2fdb9c5
- SHA1 7dd517bc9278addca0e9c229dca834edbe030b44
- SHA512 eba20532172d1bff0a750a5293024efd98c0c5822f3f15b469d1a54ce917ea78cc7f644c3e7d7a59dabac0226a942474c2a481f970ba8b519c24bf0765c799b3
- TLSH T1B9B0126061D5EA3738F6221DAD3244C1A5910D861452C38C6F14741EFE7006E69AF97C
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/native/app.json
- Size 232B
- SHA256 088160f73f6e937a73790aea909372a50935e44e4ee4a8817639dbea3359053d
- MD5 c424b94a927dcce12e1a133e7949f640
- SHA1 586d650c449965e1a83200caa95b4b671b85444e
- SHA512 f0eff75a6e1623a1ce03b1be2eb60ea9f050897df92841eef502527e3b710c35e7591016d7752cedd53c42091cf0fff58ebf083c8efaf0fe8c5ca2f8021cc365
- TLSH T1B8D02314A62988731BB1034F82CF88F103FF30E158AB30CC1E890C1C4321DDC2204887
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/native/device.json
- Size 194B
- SHA256 697e9b12aee79ea99a03cf74cc13e5ddd415efa453794a0a4ae8cecb7752cbd0
- MD5 0f26f66a0d6df17d05e9f3b17931e5b9
- SHA1 3dd029d662800099a96c4e9279b256acee5c38f4
- SHA512 9027164a6da10d3d1c73fa0c94eb3aede88da2bd15d4cbfe77cda38dc93779d756c138c8dc14da4ba590c1fface0800bba6300526fc1f886e553b1425fedf5db
- TLSH T1D5C012B5EC7E3A6E4BD1E1C81C338E53BC6008751A4D2D2064F59D15254F854939995A
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/native/os.json
- Size 56B
- SHA256 3a5df913db77290768c5dfbdfd65b218dfa34b7999441f5cc87797e4b65e445c
- MD5 66dcd98f1fd5bca64c229cc972cfcd9c
- SHA1 08e2eb6c7a4b34a5eba69d00099d5b30f1d84f94
- SHA512 362e92c6671814ec671a70aa7df0f0a5138ad93cfa3b0e88736536ae838ae70f45012b373d2e77835cf33da17f83020aa62821a1b4a78c93ec38da94403cd8f1
- TLSH T1FC9002769880A036101203545A555E51D37014726045F0245857041152A71B80231109
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/native/session.json
- Size 127B
- SHA256 38181b38452df1056b6445f9e5dcba78076d44889deaa39f379df860ac19bac8
- MD5 9306976829ef72c884afb06e0c96abd2
- SHA1 9e5991af7fe99a4dd039859d2078338270007724
- SHA512 4fcba08c21af2324ec7634e0ee40cd0f56eb650033f83262602797e711e597048af38c947b2260374716b5c5d979676b45d438501207c0291a59b8b9f810a22f
- TLSH T189B02B721FE0A47241B7B912E915CC1006E912096DA4C80C29B000BC1250B450306C10
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/report
- Size 765B
- SHA256 959ebfa8a81a0b4818772def5a552883f885f94df07573ac45818725dbba48ba
- MD5 c2fc47d102866e3e034b5aa768e70f55
- SHA1 21c5089e9aaad581814af3ac70a513c9f3cd8da9
- SHA512 8cf0bc6da4018010b4223c6e81e2b5bd9d1d0b1b0ce9ae0862b55cc774cbeafd2834a8c81c11395135b61e2db55fab5a745c5c6661dfbbe67f4dd7af08863d39
- TLSH T1AF0120ACDB7A21380788C3CF90A5ED23D3B522ACAA13555C1DC3100502CB8BCA201CB6
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/userlog
- Size 111B
- SHA256 5bdfe63d8efa45c7c58cf68b9565745773f5fb2a971526e4fd1c1a505378ca14
- MD5 ea6e91c745c197002c4bc6fe0d73a54b
- SHA1 babf2dedfbab78e1c758270a3c78b83c88db186d
- SHA512 24df44025faea23f1b744ce1b4323bcaf43d83845994c51b6eaebea795bd60d469122aa02ed504fcacf4e99e7ab6b9ab6c08f750d6d24d059011351ed618a804
- TLSH T1CFB00241940D726BD14E7BFA4381DA4F5CE469D0979AA1B46F85525C04027912479A8E
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/userlog.tmp
- Size 16B
- SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
- MD5 c33583fae4e0b61cde1c5b9227963237
- SHA1 fe2ebe4d27469af1460f7e852031a04208ef629b
- SHA512 fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
- MD5 SHA1 SHA512
FirebaseHeartBeatW0RFRkFVTFRd+MTo4MjgwMzkxODczMTc6YW5kcm9pZDozZjkwZGU3NTlmNzkwMjhm.preferences_pb.tmp
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo4MjgwMzkxODczMTc6YW5kcm9pZDozZjkwZGU3NTlmNzkwMjhm.preferences_pb.tmp
- Size 430B
- SHA256 9e2cf5ac20ad2858d1355813056c46b41371adf1c39ffa2cf79dd1c0786ae809
- MD5 5adddaf71db5db866812c9adf46584d1
- SHA1 8a6a342c7b3ca207af8a78529f16d78591246dbe
- SHA512 b73eb99f6a7f96081d7bf8cf88eae3eeb97847aa9e6ea4b090ac393e74258f3f4d798640939e231a9935681e22a5e8eb4fd91fa499e3e3d2c6b4810f4a1e642b
- TLSH T1DBE0EC20DED11DE1186651097F54032C4F3F575532AD516531E40188F90955452C3F0B
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
- Size 285B
- SHA256 4f0722fe4869dd931e204f974135f82e42199d5892e8ca2617519977993e470a
- MD5 ff409981f27768884469bc3deddf662d
- SHA1 45b8ade1a50278609f2e151a981be214d00aca2f
- SHA512 f47baed4b4831ed9a1fca596d393bd9af1ea624cbfc329625e72cc07d44ce610280fc1ae1633b24445a2950847056eb117f8c415d15e2d6f8552802e09f68c89
- TLSH T174D02B20A63C32FB25FED0153CF4E4215E3BB608FAF6588D4BB8C30C0785E551B199A5
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
- Size 323B
- SHA256 eaeb4de17908a99517b0e047e6f7d0e0f84d6fdde046388e44cb3afde60a5419
- MD5 c973fa14dddf715bd4cb37ba50c5e781
- SHA1 22e90a866be61c36b3604a485b3e3cff1f5b584e
- SHA512 57ba3a22acadba9274104ab7bf9e380dfeec181e672b4e859d6c2fd7ce626689ca7cd2f98deb96d4ba6b6fdd9a6da8e91230e537694ff00db13d0e7985d5b214
- TLSH T108E02610A67C31EB21EEC0153CF4E8100A3B7209FAF61D8D4AB8C31C0285A551A198A1
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
- Size 323B
- SHA256 eae6ce1ad1b5efd393684bdd56caa3385bae0bd386d39876f10146bcb34286ae
- MD5 712066713a8b1a340175ab8105118d50
- SHA1 f22f8109b269b6b504162f6ae085cb16d535b1cb
- SHA512 8e2fc2582668e989d92c0d1912ba73d0805eab090844e038e57ac5d85f12232bc78006f8fd80b83f7673492f8494fe88796869e5d90f15fdc5fa8edc0463ea56
- TLSH T1C0E02610A63C31EB21FAC0157CF4E8100A3B7209FAF6598D4AB8C30C0285A491A198A1
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb
- Size 4KB
- SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
- MD5 7e858c4054eb00fcddc653a04e5cd1c6
- SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
- SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
- TLSH T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
- MD5 SHA1 SHA512 TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-journal
- Size 512B
- SHA256 f407fbc68575ad255b729ab426a42cf12154e2ce04292eaf83f3fe35b35d4052
- MD5 7c0eb34442558e4726b84a05d43fdbb6
- SHA1 9b09584327079ed30a3fa7e6f90a0f44094454ab
- SHA512 c9ceec99a2e6e7382c590a04b1f2d47506d66e15ff20e37515da46b2ce57be71d4768fe82f6ec7d8a8c08c4485044c76aeb2afd134102453ec33c69be48f58dc
- MD5 SHA1 SHA512
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-wal
- Size 16KB
- SHA256 4fce8845e723f08f7c84a8e869bfc8ee7d29ad0353070cfdf3cd6af136f594e0
- MD5 aff3ec4d8aac1f43c57c47986cac24a3
- SHA1 3404f60addef1c6790f14b81fd795c698c8b956e
- SHA512 04ef9c9ed2b1cfff0d8301aff82fb4ef0b0903036fa03c1d74ab98850c1a232cc763b9fb6677f7ac243fc6212f47809aa7697d4be1a50d796cb539c9cc491d0d
- SSDEEP 12:KjDSKDsDzdeWRmBEyPbP/ZDbJrVotiOw2:KjpADzKGSP/ZRia2
- TLSH T19F72C24893905653C11D5376E0C6C3480F71772E633ACF4712A18D313C03BAC9464D08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-wal
- Size 112KB
- SHA256 669232532b4edd95a50f686b6c1ed92f6b36b911a42ae56ad01e8e147c04ba20
- MD5 433982cca69aa1439a4007d3d8a9d921
- SHA1 3ec9cefaac05fa039d9df5cdc302f08a4f327952
- SHA512 33a9add139d0f88c4fc657f78013814709495d4ff16ae35bf040a15d7f84c3c88deaa1e96e0b81484f9f0e3474452173e543f2d4b999d31085d3abb607f0863e
- SSDEEP 96:yoMpdedFu5DJDycJPijGKL/9n7ymEuWCDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+61:SQKirndjnHt9S/f8JzSV+6D86T0ED
- TLSH T1D5B3108E0F693500C0A964B0D5D00FA17A3F622E93A7E7E165A14075BDC7931DE2DCFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /system_ext/framework/androidx.window.sidecar.jar
- Size 12KB
- SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
- MD5 bdf3529e80318eb14e53a5bf3720c10d
- SHA1 25c9ace4b1af6e80ebb2572345972c56505969ba
- SHA512 48b9c2d01171bb651b9b54826baa51f4add48431a3efd8ceb5f7cc3bcd6f8f37edf47fabb24349dd15b3a02329cd450f90a8d164bf4f8dfae554bf3b35a8a55b
- SSDEEP 384:6BDL3KyMB6PluKnxH1ybbC0t7dvBvi22OUHpR1H:C/8B6PluKXybbrZvBvi22OUHpRl
- TLSH T17D42C65B72100D27DAFED7BF696B074B4A388285A683176E1A14D1807DC23C7968F3DD
- MD5 SHA1 SHA512 SSDEEP TLSH