fb06eae4dc0fe50632b5f831bc4f404a03c6ba7f92bf0dd6728376bcade95404

General

Target
Paint+The+Town+Red_114.0_apkcombo.com.apk
Size 2.4MB
Sample261006-bweybscd29
SHA256 fb06eae4dc0fe50632b5f831bc4f404a03c6ba7f92bf0dd6728376bcade95404
MD5 a692751666f987f4885979801eb4f3ad
SHA1 cae49bd5e7a5d15d7a57ae02088a8dd2571323b4
SHA512 60518995ea57cc208182c197a5d0a8a8a3c80a4ea96e5dec145a776ae0033f8e3eee855fbdc5be1edddcabddbe571ec62ee6d8851c9990aeeaf4cf7abb45cc16
SSDEEP 49152:2ac9wgzJ+Co0HiWAkpWw+h/hEXKinXo3+Hted4hRe:2AgzJg0DJ+IXKinXo3+Hc
TLSH
T100C5F082F759EA27C8F3C33296B50B36664ACD248747E7471844B27C6DBF9C44A49BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	red.town.paint.town.red

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.extensions.jar	4444	red.town.paint.town.red
/system_ext/framework/androidx.window.extensions.jar	4444	red.town.paint.town.red
/system_ext/framework/androidx.window.sidecar.jar	4444	red.town.paint.town.red
/system_ext/framework/androidx.window.sidecar.jar	4444	red.town.paint.town.red
/data/user/0/red.town.paint.town.red/cache/1664557424545.jar	4444	red.town.paint.town.red

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	red.town.paint.town.red

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	red.town.paint.town.red

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	red.town.paint.town.red

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	red.town.paint.town.red

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	red.town.paint.town.red

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	red.town.paint.town.red

red.town.paint.town.red
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4444

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Process Discovery

1

T1424

System Information Discovery

3

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1664557424545.jar

Path /data/user/0/red.town.paint.town.red/cache/1664557424545.jar
Size 10KB
SHA256 8ba015cb192f34326e6a46f765c6712d87c3797661541275c84b9a30ee449eec
MD5 dfb68e70e8eb84d844c9ce623ee069c1
SHA1 369e761858a904fe9fb89efcfc9bd3e6e56ee44f
SHA512 0d5f8ff91d3cd5c976cadf774b8d5cd6f276793b9eb9f3d8e7168eae122b0bfcffd833be9762de441d4b52f7bb3eb3850479aea37ac327be9b71910c6fdc566a
SSDEEP 192:JlxJb2vJP3IIM2zheLykwFZEJlS6bJsQw2TUDgklwP:Jlxw53FM2zheLyfZEJlS6F1t
TLSH
T130329EAA7FDDD80EE551CD73795CD467B9E80E38947B707B0086B1A486287012AC9CCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1664557424545.jar

Path /data/user/0/red.town.paint.town.red/cache/1664557424545.jar
Size 21KB
SHA256 9f2d7ff525ca785553557c351812252c0beface31440517e2f19929fe76472b1
MD5 722310b17c81cc3d780d23e1a63eb450
SHA1 0a0c1a939f923570e5da88aa5c7b105052f056e3
SHA512 1a48e9383a0befb0c6b4755a8b56f352fba317910308f701e13ce8189c465cade6b0af510165d586745f1913a61cc68f91395949202394336a59c34596691a91
SSDEEP 384:F5cphh0zSEscEJ1D9tR4VD/NJ5zR39hVl7VaLPnpZwTuDAK:F5cn+sThtchJ5zRNaMiDAK
TLSH
T1EAA2B683B3228663D57CDA3F6C3F9380AB21B221891397271584ABEDBCF53995E45DC4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

1664557424545.jar.cur.prof

Path /data/user/0/red.town.paint.town.red/cache/oat/1664557424545.jar.cur.prof
Size 204B
SHA256 824bbcddd3542a3d5e9af2c1e77b4c897baf3d31d9640577d084f48d9fae0bec
MD5 5df231c9bc34e8147d2cef5b3d60f951
SHA1 30ac0f2413c85f077af1070fdc991bda7a3faae4
SHA512 37142f7944978e3e8b0efc228cee92d55e84d87a5db3e3e70ec86f6672eb7e80db04b493c5205c4d393de3472525d6dfa3681852cdf38c36d8cf1b6097894c8e
TLSH
T199D0C0A649B0BD77C3BB0CF370A4031DFD16540430E1AF0E00B0436C02092839D44CC0
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.window.extensions.jar

Path /system_ext/framework/androidx.window.extensions.jar
Size 123KB
SHA256 8e6331a07c9f2ac139214c527dcaff2c82d126bbe7bd3420cdc36d6a8c9204b0
MD5 3056e1bdb7d4e19789d0319eff484bd0
SHA1 6791ae47aa9466fe0bca27ad6643f846853bbee4
SHA512 c790980fd68d9f89e32743bc28846807d5e5947c555f494de47714dec5cbd0c08d81c3260fa463759d1b17a953af3c44ec30b14fb08bf6b29db3837346c9f658
SSDEEP 3072:8Pmsa8v0v8FYNMhpjLXZ/pziNQdysk4p26PQ:Qmsa8vXhRLXXOQGJ
TLSH
T19DC31951FA4159A1DEAE933B959B1301AB30A648AB2383137654D0BCFCD73C39F87AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Download

androidx.window.sidecar.jar

Path /system_ext/framework/androidx.window.sidecar.jar
Size 25KB
SHA256 9195dc6a1c75a841384050240dfc972e48178964993fba6619788625f4b40d1a
MD5 29469324e59dfcc052f24b5af4e7b2c4
SHA1 10c1e17ac6f598037bb51baa07945663645de4eb
SHA512 5e27c2b1431369a248298f2f749136a575005584f9999f2a4c204a0c47adce2e33c8df9f058bdafa1bde1c99e46d175560cedfcddcd8581718ed1d9973c37cc2
SSDEEP 768:bjydnTmp8WNAupUuvkg5NrtsESOMXIpc3dRwQA0:bjydCpF0uhtsxOQIqdSj0
TLSH
T1A5C2F716E7400C63E9FF9A3B6A5B13009F35E3A4AA43471B640585A4BDC63D3D9EE7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads