Analysis
- max time kernel
21s - max time network
150s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
26/09/2026, 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
pal-iris-0.3.1.apk
Resource
android-x86-arm-20260721-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
pal-iris-0.3.1.apk
Resource
android-x64-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
pal-iris-0.3.1.apk
Resource
android-x64-arm64-20260721-en
4 signatures
150 seconds
General
- Target pal-iris-0.3.1.apk
- Size 7.9MB
- Sample260926-w2n4eafg36
- SHA256 15080ac67fe811bd63a546fca66f4318b9cc5f10a54000e3425b50acdfe19e2a
- MD5 6f3b0af4c49ebc8003f61871ae795a5a
- SHA1 a50315288d8897eaf257138d572dc1759295e2bf
- SHA512 8a5569b2f85a53d886e406be528e2ee5dba15d9d569c80826b709bc6c7120b4cb4a0c2c3fe48e4bc8c3868b19a2d79123dbb3754995f791ade877b1499425e5d
- SSDEEP 196608:A1Idk0RuY1FqDQyvcFJbcTsNI0NCvQobRNI0NCB5f9J:85cuvDQOUx9j2y5f9J
- TLSH T194862382E7E61D3ECC3B90360F9B473117569E4A8A97D3078614362C6CBB6C85F49BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.paliris.app - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.paliris.app - Checks the presence of a debugger
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.paliris.app - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.paliris.app - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.paliris.app
Processes
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.paliris.app/files/profileInstalled
- Size 24B
- SHA256 8e29f2aaed999335deae346b508d53e3926d395581d30d8e7fdfb3714fd9f17f
- MD5 374892816f73832982c5a8392aada235
- SHA1 fdc2270fc9c51d1b661601b67965b4688d0b75bc
- SHA512 5a20e3ae2031ba0fd14b431c8f5a70438135854c9b7cd539a63cbfb1d2acd3c4bd6d448911881995583243524811cb7e63ece8224d525daca14f55d741802a16
- MD5 SHA1 SHA512
- Path /data/data/com.paliris.app/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
- Size 8B
- SHA256 fd9a1eda0d04fa207eb9ae338d2cf8c06bd0a680382473246042fbf7c3db847e
- MD5 34bf318f3efc3ab286a51cb08258910a
- SHA1 2a508a6a1780d159ad638e09b98b092389186fcc
- SHA512 d881f1ef4682b955aca1a743f5a1582cab588f3a2914ac9136a3f135dc9ff998f4f374f4a39bd7be14a25da47a296eb023c5f5831e6543c856290248d27da4b1
- MD5 SHA1 SHA512
- Path /data/misc/profiles/cur/0/com.paliris.app/primary.prof
- Size 2KB
- SHA256 f7b93418651f3b25fd7d2137cbf50f88b48e6062a141871f7439089939df9307
- MD5 ecf4104983958d5dcf8e6314fa947ab4
- SHA1 cb8b19f855c27f75fb2a5df808c3d100d7d8dc95
- SHA512 08296ba28943a7ca9eeae60357d5cd37adaef65315320d7e51f9405fa7fcc4d49b4946bc2043a374cddaa33a517212248612cd493275f51249649350328aebdb
- TLSH T159512A0CAC8A44B09A39B65DAF3117C7B3EBD6C066307D9152D83C260E30AB3165C2A7
- MD5 SHA1 SHA512 TLSH