Analysis

  • user interaction
    yes
  • max time kernel
    4s
  • max time network
    304s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    15/05/2026, 18:00

General

  • Target
    ibis-Paint-X-Pro-v13-5-14-MOD-rajaapk-com.apk
  • Size 54.2MB
  • Sample260515-wlevssdw7t
  • SHA256 194278225eb3101f25fb4a7af0284662ef66159f93d4bfe3963647cd7dc21e44
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Checks the presence of a debugger
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • jp.ne.ibis.ibispaintx.app
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Checks CPU information
    PID:4781

Network

        MITRE ATT&CK Enterprise v16

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        com.google.android.datatransport.events

        • Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events
        • Size 56KB
        • SHA256 6490b5e6b1353a89df2cf22b5d5cbf749da202e081b0eb7ef73d754ce7dac366
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 5340453921956ba596104b70bb8ec0d3336c3d3dbd0f7c7d74e6d6507c1fa193
        • MD5 SHA1 SHA512 SSDEEP TLSH

        com.google.android.datatransport.events-journal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
        • Size 512B
        • SHA256 c52af0b8ff0bb2b4b1ec77b7f65bb4f5b8ca31cd3773972c905745980b571d85
        • MD5 SHA1 SHA512

        com.google.android.datatransport.events-journal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/databases/com.google.android.datatransport.events-journal
        • Size 8KB
        • SHA256 011d1f6b77342a948a5a8b00421445ff7e47bf45e8894be6c76b881c35b5befc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cacert.pem

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.cert/cacert.pem
        • Size 216KB
        • SHA256 2782f0f8e89c786f40240fc1916677be660fb8d8e25dede50c9f6f7b0c2c2178
        • MD5 SHA1 SHA512 SSDEEP TLSH

        internal-keys

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/internal-keys
        • Size 107B
        • SHA256 2e5b79823384123598ae879303e552f5ae0bbb28f2c96b74e82a2e8abcb6840f
        • MD5 SHA1 SHA512 TLSH

        app.json

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/native/app.json
        • Size 232B
        • SHA256 088160f73f6e937a73790aea909372a50935e44e4ee4a8817639dbea3359053d
        • MD5 SHA1 SHA512 TLSH

        device.json

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/native/device.json
        • Size 194B
        • SHA256 697e9b12aee79ea99a03cf74cc13e5ddd415efa453794a0a4ae8cecb7752cbd0
        • MD5 SHA1 SHA512 TLSH

        os.json

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/native/os.json
        • Size 56B
        • SHA256 3a5df913db77290768c5dfbdfd65b218dfa34b7999441f5cc87797e4b65e445c
        • MD5 SHA1 SHA512 TLSH

        session.json

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/native/session.json
        • Size 127B
        • SHA256 38181b38452df1056b6445f9e5dcba78076d44889deaa39f379df860ac19bac8
        • MD5 SHA1 SHA512 TLSH

        report

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/report
        • Size 765B
        • SHA256 959ebfa8a81a0b4818772def5a552883f885f94df07573ac45818725dbba48ba
        • MD5 SHA1 SHA512 TLSH

        userlog

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/userlog
        • Size 111B
        • SHA256 5bdfe63d8efa45c7c58cf68b9565745773f5fb2a971526e4fd1c1a505378ca14
        • MD5 SHA1 SHA512 TLSH

        userlog.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/.crashlytics.v3/jp.ne.ibis.ibispaintx.app/open-sessions/6A075F5E0194000112AD343AAA6BD502/userlog.tmp
        • Size 16B
        • SHA256 35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
        • MD5 SHA1 SHA512

        FirebaseHeartBeatW0RFRkFVTFRd+MTo4MjgwMzkxODczMTc6YW5kcm9pZDozZjkwZGU3NTlmNzkwMjhm.preferences_pb.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo4MjgwMzkxODczMTc6YW5kcm9pZDozZjkwZGU3NTlmNzkwMjhm.preferences_pb.tmp
        • Size 430B
        • SHA256 9e2cf5ac20ad2858d1355813056c46b41371adf1c39ffa2cf79dd1c0786ae809
        • MD5 SHA1 SHA512 TLSH

        sessionDataStore.data.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
        • Size 285B
        • SHA256 4f0722fe4869dd931e204f974135f82e42199d5892e8ca2617519977993e470a
        • MD5 SHA1 SHA512 TLSH

        sessionDataStore.data.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
        • Size 323B
        • SHA256 eaeb4de17908a99517b0e047e6f7d0e0f84d6fdde046388e44cb3afde60a5419
        • MD5 SHA1 SHA512 TLSH

        sessionDataStore.data.tmp

        • Path /data/data/jp.ne.ibis.ibispaintx.app/files/datastore/aqs/sessionDataStore.data.tmp
        • Size 323B
        • SHA256 eae6ce1ad1b5efd393684bdd56caa3385bae0bd386d39876f10146bcb34286ae
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
        • MD5 SHA1 SHA512 TLSH

        androidx.work.workdb-journal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 f407fbc68575ad255b729ab426a42cf12154e2ce04292eaf83f3fe35b35d4052
        • MD5 SHA1 SHA512

        androidx.work.workdb-shm

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 4fce8845e723f08f7c84a8e869bfc8ee7d29ad0353070cfdf3cd6af136f594e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.work.workdb-wal

        • Path /data/data/jp.ne.ibis.ibispaintx.app/no_backup/androidx.work.workdb-wal
        • Size 112KB
        • SHA256 669232532b4edd95a50f686b6c1ed92f6b36b911a42ae56ad01e8e147c04ba20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        androidx.window.sidecar.jar

        • Path /system_ext/framework/androidx.window.sidecar.jar
        • Size 12KB
        • SHA256 bbc8300dd1e9cd08de8f66560c1ac2c928615b72b51cef9649f88974f586d64b
        • MD5 SHA1 SHA512 SSDEEP TLSH