fb06eae4dc0fe50632b5f831bc4f404a03c6ba7f92bf0dd6728376bcade95404

Analysis

max time kernel
874s
max time network
874s
platform
android-15_x64
resource
android-35-x64-arm64-20260721-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260721-enlocale:en-usos:android-15-x64system
submitted
06/10/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paint+The+Town+Red_114.0_apkcombo.com.apk
Size 2.4MB
Sample261006-bweybscd29
SHA256 fb06eae4dc0fe50632b5f831bc4f404a03c6ba7f92bf0dd6728376bcade95404
MD5 a692751666f987f4885979801eb4f3ad
SHA1 cae49bd5e7a5d15d7a57ae02088a8dd2571323b4
SHA512 60518995ea57cc208182c197a5d0a8a8a3c80a4ea96e5dec145a776ae0033f8e3eee855fbdc5be1edddcabddbe571ec62ee6d8851c9990aeeaf4cf7abb45cc16
SSDEEP 49152:2ac9wgzJ+Co0HiWAkpWw+h/hEXKinXo3+Hted4hRe:2AgzJg0DJ+IXKinXo3+Hc
TLSH
T100C5F082F759EA27C8F3C33296B50B36664ACD248747E7471844B27C6DBF9C44A49BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	red.town.paint.town.red

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

defense_evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	red.town.paint.town.red

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	red.town.paint.town.red

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	red.town.paint.town.red

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	red.town.paint.town.red

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	red.town.paint.town.red

red.town.paint.town.red
1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:3332

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

primary.prof.hUn3IV.tmp

Path /data/misc/profiles/cur/0/red.town.paint.town.red/primary.prof.hUn3IV.tmp
Size 1KB
SHA256 06b4b7c151e2321ab17f6dc97354d1d14146864c3791c4661177ffe8176f681c
MD5 193ad9d453e001b15abf9e21342742b8
SHA1 b3bed57905961cd7fcc9612f7af7ce7fce0fcd4a
SHA512 8b5b74f82e2ce557a3f0d3069da7771095a27af94515e5e1b9e85a375257ced00cfef35c8d92140669543e5722bff8d5be170d524130ee79e757d8d5871e13e5
TLSH
T16031A7E743F50696D81A3F32F538140415366921301CB6DFEB423C4182D6969AFAD76B
MD5 SHA1 SHA512 TLSH

Submit Download

1708042440713.jar

Path /data/user/0/red.town.paint.town.red/cache/1708042440713.jar
Size 10KB
SHA256 4e983048ec350842cbbbaafd0393d962bd977422549f85c45ed36d908f708643
MD5 b505176427d7a39e061376ac2386dde1
SHA1 4b18624a8d042c59a9d7bc52c9e5d2c0c5a28784
SHA512 1e723bec59538a838b6721e55a653633fe8c41a5a46be1a4eedc3a85fa405e5ef9a0cf81c2b531231e8f0abcfa3a3f1f5e5fe7ebfed0cacaf9b46ddb7e70e3ca
SSDEEP 192:v6P5J5wtSJGeWJy/qXDPLJlzFEMOd9htTcq9LGBjGUJ7zy7zQw3R:yZzoJyMud9hJcqmGYzy7zQk
TLSH
T11322B0474AA18A13C15392B8ADEBE3D79BFE465B1190A3350470D28FFB75F70E14D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1708042440713.jar.cur.prof.x4ndV2.tmp

Path /data/user/0/red.town.paint.town.red/cache/oat/1708042440713.jar.cur.prof.x4ndV2.tmp
Size 173B
SHA256 e0d7f451532dc238e351921f14961449e9d8b9a93ebe47178edf386cbd918437
MD5 095c0d41166a9fea050a08950105de1c
SHA1 1c374f6aecfc86ccb99a764d3e8cded324458387
SHA512 81d098a11dbc2a4c607bd6705da740d1cca95d3c21d28157e3aa92bbd04627028a22618848a719fb1ae5238f3e630ef4f65093e2021a2a60fd054eb1f1f83253
TLSH
T1BFC02BE356E46546D6A79E7A04CE213238C8C4172EC7EF628420D15F93137A7A10F983
MD5 SHA1 SHA512 TLSH

Submit Download

base.3332.tmp

Path /data/user/0/red.town.paint.town.red/cache/oat_primary/x86_64/base.3332.tmp
Size 132KB
SHA256 3546699e4f4d345b8b57a3c20fd13750656ae493a948d6c6540025e91b3b42c5
MD5 1de7f37baafb032eb0a68893cd05a70b
SHA1 e90a15e2ae25071cf0d4d3eb875a0f07edfb6c0d
SHA512 a5c6d147b4727dd74f0ad40e8e61ebfc8142a5b2cfb568a1194cdd21db4e5560ab6c91bb8e7f669588c2e945fcb6fb3504038f01642d25278419416df5a5d509
SSDEEP 3072:LzL3NqT4i62SY4XasatDQKHNRMm8RAQ04LZ9zZkz0eovBE2lG:5XOlzsapQ3RO4RoovBEr
TLSH
T1DED3E74FEAA39110C2E6EEF39B8656ECF91DC426165E191094B0377EE43AE14E750FE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads