fb06eae4dc0fe50632b5f831bc4f404a03c6ba7f92bf0dd6728376bcade95404 | Triage™

Analysis

max time kernel
869s
max time network
869s
platform
android-14_x64
resource
android-34-x64-arm64-20260721-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260721-enlocale:en-usos:android-14-x64system
submitted
06/10/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paint+The+Town+Red_114.0_apkcombo.com.apk
Size 2.4MB
Sample261006-bweybscd29
SHA256 fb06eae4dc0fe50632b5f831bc4f404a03c6ba7f92bf0dd6728376bcade95404
MD5 a692751666f987f4885979801eb4f3ad
SHA1 cae49bd5e7a5d15d7a57ae02088a8dd2571323b4
SHA512 60518995ea57cc208182c197a5d0a8a8a3c80a4ea96e5dec145a776ae0033f8e3eee855fbdc5be1edddcabddbe571ec62ee6d8851c9990aeeaf4cf7abb45cc16
SSDEEP 49152:2ac9wgzJ+Co0HiWAkpWw+h/hEXKinXo3+Hted4hRe:2AgzJg0DJ+IXKinXo3+Hc
TLSH
T100C5F082F759EA27C8F3C33296B50B36664ACD248747E7471844B27C6DBF9C44A49BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

ioc	Process
/system/app/Superuser.apk	red.town.paint.town.red

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

description	ioc	Process
Accessed system property	key: ro.product.model	red.town.paint.town.red

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

Download New Code at Runtime

ioc	pid	Process
/data/user/0/red.town.paint.town.red/cache/1675452915457.jar	4454	red.town.paint.town.red

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

Transmitted Data Manipulation

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	red.town.paint.town.red

Queries information about active data network 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	red.town.paint.town.red

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Data Encrypted for Impact

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	red.town.paint.town.red

Checks CPU information 2 TTPs 1 IoCs

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/cpuinfo	red.town.paint.town.red

Checks memory information 2 TTPs 1 IoCs

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/meminfo	red.town.paint.town.red

red.town.paint.town.red
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4454

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Data Manipulation

Transmitted Data Manipulation

Replay Monitor

Loading Replay Monitor...

Downloads

primary.prof.MKJBNk.tmp

Path /data/misc/profiles/cur/0/red.town.paint.town.red/primary.prof.MKJBNk.tmp
Size 2KB
SHA256 6eb05161f573a015ffa12e45f855511974ad8205f963e570fe8af0dbf4dbf0d7
MD5 e0b8df582ae653a379e5e60be3c08a36
SHA1 83dba7e56b8391d74f37c0392348a85e24751e56
SHA512 34123fae7e61d4b4b83c728f48fd64badaab796dd5d9fe60b97dfe196f3c311ec641e31621e94a8bb529068052250fcf8e15ea3c266663c5194537812fb050c8
TLSH
T124415A3A3B7008A0EC0D54F3B2AED1C25A9D3FEA214156275F9A94B20220C383CA317E
MD5 SHA1 SHA512 TLSH

Submit Download

1675452915457.jar

Path /data/user/0/red.town.paint.town.red/cache/1675452915457.jar
Size 11KB
SHA256 f174040e033d1045ef13695b4337c8e1ad65331f2f103248025e2d080fccd037
MD5 600bb938c8786491180f21044aa0dd64
SHA1 fce0ae8f59adda36aa0452b65b8c40d892e2cf12
SHA512 1c12e6ab3f72f39addb1a2ce77a09cc5f90747567b7306f563d6afcfb49c46dbc18afabf61d9af2e7d6588e4dd70cff9e6cc7ad87021c57c605343e0ddcf67ba
SSDEEP 192:5WPKIGKHTMd9nBEmJx029lAtnjZau5zHnpdxcTR1lQTir:5WPHLHTM7nL2YlAtnFaMHdcTR1x
TLSH
T1E832AF8D6DEED43FCEEBD872C59E8413975DC2FC6629B60B500AD2DC18718941B80E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1675452915457.jar

Path /data/user/0/red.town.paint.town.red/cache/1675452915457.jar
Size 22KB
SHA256 0869ba6efa2a0c4abb878b75bd8063d6b1752e31618bdbfb00cddec68107a31c
MD5 216bb03e148e333071ec13a5d000cba9
SHA1 c50144c39f6ad80d7b0cb5a30701272851e66851
SHA512 df7882aa119eb88af3d859292a4a61e3852cc45d58c47466ec1adb8813622bed872fa977342e62718aa2a4c5f9a202f2a198ed1ac2aaeade0aabeac396bc4d56
SSDEEP 384:QKhDiRhyHqEXqQ7S/afBc18U0VlvuvMNbArEor0QSZ64DB88:QjCHqEXqUy0Bc1jvOgARDBn
TLSH
T130A2D763B391C5B3E6BC9A7F647E5380B761F220891393076809D7DEBCEE3A05A518C5
MD5 SHA1 SHA512 SSDEEP TLSH

Download

1675452915457.jar.cur.prof.xQfNzN.tmp

Path /data/user/0/red.town.paint.town.red/cache/oat/1675452915457.jar.cur.prof.xQfNzN.tmp
Size 218B
SHA256 b13f77b6d9fa023cea39a11c329a59d9dac4e9003656d287ddc95a2e0c4d10a0
MD5 6a38839f5ccbfac8d5aa8ed584f1e162
SHA1 c61d059efb224b297759426b339df2b60a0d809d
SHA512 94ee458f75424d4f5d15a9f73f765af8b9fbad20c0d6c0bb04677e9562dcbe548e52e9ecbcb294e5bc50b2c2b362a6a58270e95feeb0713e58196c21cde32d91
TLSH
T1EBD023CC55E90D33D74241384560AD46E35D800899516B1F9709473C8013755C7943D1
MD5 SHA1 SHA512 TLSH

Submit Download

base.4454.tmp

Path /data/user/0/red.town.paint.town.red/cache/oat_primary/x86_64/base.4454.tmp
Size 136KB
SHA256 016c5abeeec35edfd34c00a1a81d5a5358fb2de5e220481dcf724c765266e7b2
MD5 553e35a872fff6f7429d03c5ccc2faca
SHA1 c67c4f8fbcd8d6bb9cf39e5ffeb39c0c82e8f69b
SHA512 e81d6be07c04a832f68b29a87c8da527c0a398f8d4104c47bc783c85f9ce74166e6e3dd29364746e08d89c17262bf6c599d48c262b443d0b9511fa3fe1b80c1b
SSDEEP 3072:rVUzdDXMl7FBWZjFtbRGe82wZ/fUpjni6z+uvoDe8z3QY9s:yZYlhibELje/zPvoK8jQ
TLSH
T174D3095FB5524090C1A7BEF55A8A46F8EE6AC46106463E0490B1B33FA837F14EFA1FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download