Analysis

  • max time kernel
    87s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    09/12/2024, 01:46

General

  • Target

    com-penly-penly-1-59663159-a525ca6bee55a553d26453f2258e3b4a.apk

  • Size

    6.9MB

  • MD5

    a525ca6bee55a553d26453f2258e3b4a

  • SHA1

    0c88993bccb5f2ed0db36bea1b10910ba7b9b902

  • SHA256

    7fb82e43ab929fe5f0ee60a07876010cec4fd176d5e8bff876a5101a36567636

  • SHA512

    a689cd326a9038a4013c46fe58502f7b4002164025b90de8e3ff0c4bf444ec7d66bab90ee454bfee7b1d6659c371cc547ddff36ac9c12bc078aeda63d8a784d7

  • SSDEEP

    98304:LzfrHKXNei+kL/d/HxtS2jUxSOpzlf0Ot2T97u4NIFtEaiWONpY9m5+hlPqb212q:IsiDFHxtop7uZ2E9WOnYY4XY7pK

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests cell location 1 TTPs 1 IoCs

    Uses Android APIs to to get current cell information.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.penly.penly
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu pipes.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Requests cell location
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4263

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.penly.penly/cache/startapp_ads/interstitials/1215558495

    Filesize

    1KB

    MD5

    e7b0015586d446b22e2071f3b19d41db

    SHA1

    6832645acd7e7f3caa4c4de589270a57965eeb43

    SHA256

    a48116fb0baadbc1874f50b0d787513cbc2229a5bf7a6f2337737d693179372d

    SHA512

    3ef2b52a087719b8278c6d6743f025880cb48670736545caabb4d6ce149ada29eb3eaa8f250c4760877da2c7b2c2f110e716381afc24134954329fa31216121c

  • /data/data/com.penly.penly/cache/startapp_ads/keys/1215558495

    Filesize

    989B

    MD5

    a47cfd7758f7fba40b5d0e9ff6ee0928

    SHA1

    a5e80f6e43dea8123f2a30cbf981ccafa81cd3b9

    SHA256

    83e9884930b4367344eaf06d4e8550a7c97ef59471e23bca96f1ddb1112fe796

    SHA512

    a547bedb13a3c6f715848c3f91ed5cff6aada2acc733eed7eaf2eef637e0527ad24abcd2907a02112872e0e822e7710cece51991b8821e5506311f3ec537f6d2

  • /data/data/com.penly.penly/databases/OneSignal.db-journal

    Filesize

    512B

    MD5

    32a63d77e95e14c472eaa2529054a4b9

    SHA1

    4bbf5d4abe030ca62b35fb00931650df855dc6b0

    SHA256

    0a3db164eed97e6c6808bfb85917a08154458eb9c0ab3d8877ec6dd4690041df

    SHA512

    e872f811260f1eb4654068af6cdd795de909af1fb3d70cfa600ac9f89f764bf68b7b653d1627621f7e73c219b7f500ad32b49b0187815da9c2404d377bcbdf1b

  • /data/data/com.penly.penly/databases/OneSignal.db-wal

    Filesize

    64KB

    MD5

    53d8d1e4ed5d4eb700f45f5e6058270e

    SHA1

    de462d5cbec3f7ed13ec3d4d58ac06ff241f30e1

    SHA256

    9adc32e409c74cbdd7922427c0af6e5b3b0288ee23a64988324d46b2be0b4176

    SHA512

    fa9961113fda1064ea18a5e3e65d3fa903b0c213fa17a4e4595e8c1959a96fedbd0550ed5a37a20f27279001ff75cc38ef08421016f17062c75840e27894f43b

  • /data/data/com.penly.penly/databases/com.google.android.datatransport.events

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.penly.penly/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    735418f9c11c09d944eef7d534e50614

    SHA1

    6443d72c40eb9a870bd684b7d79ad41adc4d0e5a

    SHA256

    0f23cc141d3a7d5f3828d2de3d59bcc4f574cbef468c5fdfd71bcd9f19f89ff1

    SHA512

    19be5339bcffa48454f16fcf08b6babf5f8446ca9a384f4b5af302873a549412cfd55b27185c953e611ecfe7afaa550f3821316f584d20dde9c0c5f490a1ff81

  • /data/data/com.penly.penly/databases/com.google.android.datatransport.events-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.penly.penly/databases/com.google.android.datatransport.events-wal

    Filesize

    52KB

    MD5

    1d9edcc49a1938e45364588e00ea07ee

    SHA1

    32afe358bd49088914d39dc86ee8959bbdd212b2

    SHA256

    de39e46ed8ea9e709c97a4e361af83e4136cbdafb2a91e79b8af6727e78efe6a

    SHA512

    67d2dd8cfce9340f84e333d22b7ea146b3b0eda63eddc5c376da55745eedc3c74cbcbb5c1ef2103ff2ab04c985702cf4351f61e7c13cc7615fdc8e1c6068a0ed

  • /data/data/com.penly.penly/files/PersistedInstallation1317485597959844801tmp

    Filesize

    569B

    MD5

    bec09b88e6a883301851367c9e170e88

    SHA1

    b638c7f780873f9c11451821b558709968e3630c

    SHA256

    f972bb6a48db7230052304e693f3e8a5b40aa686ed8b37526b955f4c0684e85f

    SHA512

    b693a80b32183176c4ee44bd5ca27c46c9fb84d54fa33be4f1671669e690fd0b8aa1a7f5969aacd76ac8edc5b752093ec680453a14e9ecea3e9c33bbf0ad946b

  • /data/data/com.penly.penly/files/PersistedInstallation2251680152777735852tmp

    Filesize

    90B

    MD5

    9266655ae051f06df34af4be8b3b8053

    SHA1

    3655a06e5801aebbd7b8f942060ac158fb548f3c

    SHA256

    2d02f9e5b3c63376d4ef5966dc3ca81583c5adb05297bb4e1e9c3848aaaa9fe5

    SHA512

    c62fa50f03e6e0d3005f13484af837631a80c81f60783773407e07627e549019981a1cd1ab04318837fa29c634ed6f92463e98dd63cd78db6c8c385f7b5a43a1

  • /data/data/com.penly.penly/files/PersistedInstallation4873584729635595396tmp

    Filesize

    572B

    MD5

    00949fa1bbc9917ef2cbb0e43004e76b

    SHA1

    2e96d8ac7b0d95e2d78cdea135a2e772dc9d8fb3

    SHA256

    b1f94bab88c69ae9a2e171ce46284d429fde9462117529a32ea51ed3a46e3f22

    SHA512

    03c5c3c4bd2902e6dc8330e2f91bacbacbe2c911d0afafde3e6db7577903eaadd7c7833129fc81ff36782b48b92a788052806bc5bbc0bc5857502502717e6701

  • /data/data/com.penly.penly/files/PersistedInstallation7034640645839195152tmp

    Filesize

    90B

    MD5

    2927cf6d6084bae67bcd1de2b4a4263e

    SHA1

    63b93d978faa7cf510f56bf9ccce902ee2114238

    SHA256

    dc2db4c76207682d9f317edd3e8919c9607115816c6c6547604dfda5aaf43d4b

    SHA512

    31fa857dc8b23852080509d1094649c5bdf11cf6f6d8f9932e3444f7ffcdcfcb3599bd1948ba389cdb974b6f212a148f2431d295d5fa56c4acb6ba706d3a6737

  • /data/data/com.penly.penly/files/StartappAdInfoMetadata

    Filesize

    1KB

    MD5

    0bbe490374bb0fae8d7383169f262b21

    SHA1

    935b0541861529dabc22e3268a5027912a080e9c

    SHA256

    1f3183fcc6b79857493d3962fcd5009bd4afcbab84310963c50ac8f91dd8a5bf

    SHA512

    a6fcc353bceb5deaf569416a9e976204538e5c6e0f93074198ca4e28894ea256c3f4a93dadcfc0485188819ec9c64e127567e85ea6abaccd756897dea6803797

  • /data/data/com.penly.penly/files/StartappAdsMetadata

    Filesize

    2KB

    MD5

    128503719bfdef6b09d4c8feb1a096d4

    SHA1

    8ca4eba243150f61a8660ed41c42510e16f36cb1

    SHA256

    db1874b1c410bf8b36c2715ddd5b274e67146a1b75c6393be20abb9dafd6c20b

    SHA512

    038e1cc07930281bbc2e6395baf41f9d463530496933a0f26bc1a37de4f3a1d75536ee1425a6f1580f8f32cda1e2e2fa4db754288d09351d81af5aafaa4aed61

  • /data/data/com.penly.penly/files/StartappBannerMetadata

    Filesize

    719B

    MD5

    64837ec60a5def703db0471648bdabff

    SHA1

    f1eb4a00833351d6dd8040d9658faca109c0859f

    SHA256

    04e4c66980a46478b18296ce2620239907d7406143d003fd7ba7bb6382440ae3

    SHA512

    e856f892b0a8b4c645fb87d841e4faba64e2398589dbf25ee36f20e7df7a63e2e9464276232a625be4063659c924a005d8598fe03aa967c9d2a8d97b4ab68f34

  • /data/data/com.penly.penly/files/StartappCacheMetadata

    Filesize

    785B

    MD5

    e9a968e4938a9bb9632799e2f10bbbbb

    SHA1

    8c9e1e04c6784d0f9d182081e6329897c957d166

    SHA256

    8afd711f027fad53c5c96bc0d79574983b6d661af90aebaddf0f1dd858d03f2d

    SHA512

    cf76a0a9051cade548200101d5e0837b1d1eacc441fed901641e7e9fa87ffa3304a98ba674c8d20ea30ff682076f45b60cdbf260e3dd2770b8f19ff2d393f133

  • /data/data/com.penly.penly/files/StartappMetadata

    Filesize

    7KB

    MD5

    c4ca4e8126f80a1ff43cf692ce495639

    SHA1

    fc8af48e538ade9472c35f63388727e56ff5ae77

    SHA256

    4cd0d0911f30346fe0cb64a01414e84a0557df0dde32b138efe6d7d22c48f2d9

    SHA512

    7aa5931d8dcf88f353cff200fef7fc58eea624e0ab5572263c0f4a5ec0bcde6ef18484de1c0e0256bf7aeb99be03363c47909cba28226e6c85f652f5d15cd9d7

  • /data/data/com.penly.penly/files/StartappSplashMetadata

    Filesize

    1KB

    MD5

    31078fa68537bb028a691e3c10887833

    SHA1

    3accfef993d9c325c9a8707d29f8d1ceef3cab25

    SHA256

    aea38691bc87f26151492036df8200829a6b7cf6fd9d3776fefcf43b94149c6c

    SHA512

    9713aee45cb4d6e7cadbd899acef706d1d5612bea7f3453edfe60248b0d58bc16226b056f6fe3f797bc974087040688310f62e6e2b35f288d56619b423b09ae6

  • /data/data/com.penly.penly/files/back_.png

    Filesize

    1KB

    MD5

    527385c9a7dadd870919fb95ce4ff227

    SHA1

    a83ddb0ba89e4f83a07d6e0524d6ea900e800c2c

    SHA256

    3df2ccce7702c69051afd3fe66cf99e3f07e86d354956eba3888ddbaf545e717

    SHA512

    3b2f1781552f701331e91eb46fd38a982b2a9de8eb7259e912a710c63399fbe86fcdbe4c41fd8b8f34b99773a94cb02024e9ec64c38aeea68ef378de4f842355

  • /data/data/com.penly.penly/files/back_dark.png

    Filesize

    1KB

    MD5

    74860bc33c04b72a4848a5d7b97bec5f

    SHA1

    336856eed4d49ebd0d429877822ac5781b4a18eb

    SHA256

    fb479f88bc809d106fc15c465079b19f6027a01ecbd0d79267147c0529adea69

    SHA512

    9b6993ba917c3a687b0df03deaf9e5e6ac41d3606ef148e259eb32de8c41203249063059a11bd598b860f2e3d795c73cd339c5325f80a2623745e7003f6586aa

  • /data/data/com.penly.penly/files/browser_icon_dark.png

    Filesize

    1KB

    MD5

    c954c504c75c8ba2b112deb64869f78d

    SHA1

    5b594778f7a5bdac4e41de2d6c81225d5e329e0f

    SHA256

    37ee870f153d26b3956abcead4c45160b264fde6ca016bc2d330e9e36060ee46

    SHA512

    af1705681c3a2ef83427c853d310bc2dd6159f5db1c1b5a5740431a5a928b4c6541dcd5e3fcffd6c06697b87ca740a0ce2473e2cf141f21ee13730f325d4403b

  • /data/data/com.penly.penly/files/close_button.png

    Filesize

    2KB

    MD5

    4d332a5c731fb506bb4644c91c38f5fc

    SHA1

    56fdadb5d38b29161910b3c89ce57b1aae67733a

    SHA256

    43e7ff284e786cced9a54218970d357ff06374836bc1791eb63d9bf26c6a3784

    SHA512

    c791b70329e32559d99f0259b38a832bc849768cab37973567a04fe8f66e9f5477136014ac17d16d1a0df0ca0f4fdad86d6a5f29581c85068b7979fb9e73b7c6

  • /data/data/com.penly.penly/files/empty_star.png

    Filesize

    882B

    MD5

    136e73ffc6805e043bf61a12b3755b1a

    SHA1

    b7bd8ee6bd46f7bf3a2f21879e71ff4684e56361

    SHA256

    ecf9d2a4448842086066d82fecd6ec372497298bfef3c8e3fd17a97187a3e7bc

    SHA512

    62a12a8070955026e27e6c146d46bc44a345b0b4752e1c45487f06224e11c42490344b259ee6fe51fb6e9847cf4146abd7d4fbd0274d0f2c532868bc4be5d527

  • /data/data/com.penly.penly/files/filled_star.png

    Filesize

    740B

    MD5

    4ef85932c17e863921c9bbdf1394fe92

    SHA1

    f3811986d3648be1ca89162a079aff4644fe26d7

    SHA256

    0d6e7d7a915944adfb498a45a6db96efc77d0112ba1f374461868e257315dfa3

    SHA512

    1ba7939efbd515f81333a155064e248de27b2c70cc71004136ab9d3c61ad34baab7f1d00529e1c78d4cdf11deddbad2376d27d5ab1af699a9d29c5b5da7f4db1

  • /data/data/com.penly.penly/files/forward_.png

    Filesize

    1KB

    MD5

    795fe2fffc9505398b787eb2f15f440e

    SHA1

    c124812df2fbd8e4a65fb104aaab352ba300a57a

    SHA256

    976cb8c0c715b0b0e8b4769b51af1a08f06a4823d69b1f5284fec4531da21fb7

    SHA512

    c698c060692567afea47446d58d32e92b0bc922088c99e175f5125b264c20d425fe7dddc4b0d70fe9f53d41cfb87ef52965cd40934f21c9f5e2b9281dee72389

  • /data/data/com.penly.penly/files/forward_dark.png

    Filesize

    1KB

    MD5

    ae1702688d33694b08e2f990527fd179

    SHA1

    fccea348af9e98608b152c1e35307d04a1cddeb1

    SHA256

    87916bc88b54b8602b2f43695d34b196b5cc8948ccb6576b24cced2feacb245f

    SHA512

    aa0aa7306867900ec765e0645e2666ae1a913fb1bc67ba205b3b80d1b37089bd8692c2b34fca233ed3bcfe89a42f095a375df787d5c29ced86bd040981110d2c

  • /data/data/com.penly.penly/files/half_star.png

    Filesize

    881B

    MD5

    ba75be02cd7e410fa660a1783b0fff3c

    SHA1

    b5b60389112f5c6179878423c6c97eb5ab1680b4

    SHA256

    77a060cb9e3f9a5eb52654135d00106d36208f3d38878ca3b752ca1af85cf42d

    SHA512

    9985e466e1652eed843a9dd97832b8ee9bad05cd591a4b17548e876ac65c6cfa4da4f46e83dddf89f9fb1924d92dbf21ce13e66059d5cc7dbe0500cf0c0e7b0c

  • /data/data/com.penly.penly/files/logo.png

    Filesize

    2KB

    MD5

    5f93b7b61e5bcf973fd93c049061023e

    SHA1

    7c154666967abc13d9d38c9b79eb6933db64566f

    SHA256

    4e537f889054c9f1dfb4b1a30c34ea180310dbc9b9bcc9123605f0f802a24557

    SHA512

    d96bb4c9daab3b2a72a3d82682a8f66ee85a0eb525a87afd13f46de949ee8a02d9a560da6584ecd658681c93a13df03d9a0f57382fdc40f56b2541a51e858a67

  • /data/data/com.penly.penly/files/shared_prefs_sdk_ad_prefs

    Filesize

    153B

    MD5

    65026ee778e1372d9f4aed742772e893

    SHA1

    5a5f1c821d7639424f3c75a44468ab5f7dd4e8cc

    SHA256

    15070f52136d5a8332f8d70f790bd7bb04cd6a99b386d40e0abedc40c42caa3c

    SHA512

    589c4a12c6b6ec1a1cca957da758aaa900e68a23b4bc2f42524b0e8dd34f6c5378541d9293eae1ae8d478bf5b5229ce4218c058fc3b399eb5756afeb05c68616

  • /data/data/com.penly.penly/files/x_dark.png

    Filesize

    663B

    MD5

    2e42562e9d02dafe67ac6404f58289b7

    SHA1

    c37072894b2169be2643dd5e541ff8dfccecebe2

    SHA256

    2f70939006596d2496c26284508e70ef260968eae1385c220e91e74b58e0d13a

    SHA512

    a65a9fff0c6e17c322d0f0d6e0233fcca6d701a331a0fbc7da7eb21474c11875bd0e3edafc6c1df248ba85f22fc47b403d5668316405adcd8f6e4907a893d3bf

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    fb92f8c49182284fc6977beaac99a452

    SHA1

    03034c51580d24a9a12cfea9b0057400414e98ec

    SHA256

    70c5b0d916acb8c868f90f2f11ddb96ca9f6f43c41992c30c57c740c5a7383ad

    SHA512

    c03752329d825816b73765e26c9507b2a7a29a069840e200635999f3f6ea253e320f8870c580723193d833caefb4f41f4b0a95f1366fb2a8e37e89004c4e6f44

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    d821960638975e32241ed1b5f4f285b7

    SHA1

    f84b620152eea09bc8d7011d52fe82348c767f13

    SHA256

    bc1a951e6e08269abd0851a9bc2ea6f784e80fcc7a516351c6f8384a3c323911

    SHA512

    3498cca34e990e3fcd87fbef11f5f308f6e6d99967bd15f10b4caeab7935fd483dbdef2aa39adf5eef2f117e0825845c55237fa0f369fe0bdce5a22545fe32bd

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    047319d951d7fed4a431be60beff82f3

    SHA1

    168102a38f28083d65afcca5b00691c253c30a30

    SHA256

    324514a43801eff44efd29086ee7dae919f26545dec832d88f7e1ce6bfc73aa2

    SHA512

    8de5f3956dcd63bd1fd47317419103f01a76b9927526c49881a46d0a353f5c39f140de7aea9b05de2577acea19aa6430c6e710ea349242cbfe357eddbb8ad1a6

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb-wal

    Filesize

    350KB

    MD5

    1b9cac0bfaec30748573ff1fd91d2d1f

    SHA1

    7d2fb795eb88a3b4ad62cdacab2c72b6ccf237ec

    SHA256

    c87d180cac4b381f584a7bf3f5034969af49d8ca95bec769b6dc2d2ccf0a0f06

    SHA512

    cdb64400e301c7f48e56366fa8fca13ed71e017d150fafe2f90821236c7821994e892d31134861c1ceef206d6818466fef0a722594065cb1a1dc189bd8ad5082