Analysis
-
max time kernel
48s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system -
submitted
09-12-2024 01:46
Behavioral task
behavioral1
Sample
com-penly-penly-1-59663159-a525ca6bee55a553d26453f2258e3b4a.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
com-penly-penly-1-59663159-a525ca6bee55a553d26453f2258e3b4a.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
com-penly-penly-1-59663159-a525ca6bee55a553d26453f2258e3b4a.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
com-penly-penly-1-59663159-a525ca6bee55a553d26453f2258e3b4a.apk
-
Size
6.9MB
-
MD5
a525ca6bee55a553d26453f2258e3b4a
-
SHA1
0c88993bccb5f2ed0db36bea1b10910ba7b9b902
-
SHA256
7fb82e43ab929fe5f0ee60a07876010cec4fd176d5e8bff876a5101a36567636
-
SHA512
a689cd326a9038a4013c46fe58502f7b4002164025b90de8e3ff0c4bf444ec7d66bab90ee454bfee7b1d6659c371cc547ddff36ac9c12bc078aeda63d8a784d7
-
SSDEEP
98304:LzfrHKXNei+kL/d/HxtS2jUxSOpzlf0Ot2T97u4NIFtEaiWONpY9m5+hlPqb212q:IsiDFHxtop7uZ2E9WOnYY4XY7pK
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 8 IoCs
ioc Process /system/sd/xbin/su com.penly.penly /system/xbin/su com.penly.penly /data/local/su com.penly.penly /data/local/bin/su com.penly.penly /data/local/xbin/su com.penly.penly /sbin/su com.penly.penly /system/bin/su com.penly.penly /system/bin/failsafe/su com.penly.penly -
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
ioc Process /dev/socket/qemud com.penly.penly /dev/qemu_pipe com.penly.penly -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.penly.penly -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.penly.penly -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.penly.penly -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.penly.penly -
Requests cell location 1 TTPs 1 IoCs
Uses Android APIs to to get current cell information.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.penly.penly -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.penly.penly -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.penly.penly -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.penly.penly
Processes
-
com.penly.penly1⤵
- Checks if the Android device is rooted.
- Checks known Qemu pipes.
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Requests cell location
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4794
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5e50e029ec0226f794da6d3fc0535d4f6
SHA1027173bb3c775e8ee027c1e22930d9b1607195c3
SHA256c776d1acf90c60f95a89ee4db8222acedc8e0b097d5606297aa641a3403821ee
SHA5124f12a39bd359554fccacb8ac31e2276c38fa69a2de927f43216c9012bd3aeee0e1a0f47a48d114c6e45309e069cdd5a6979d90d21f2e60f0087f42b8364672ca
-
Filesize
512B
MD50aee291259df43dc9f1e3dbac09c475d
SHA1151f15565dd1664b77d2cb21ade1caf828c3713c
SHA25683ccac098a5759d75700cdb308a5a075328c29dd368464a15f3c9322686a6b6f
SHA512365df5750ac3e0307489428da2a0f254e17037cad1e60e6167ddb73960336157b50e131359a3aefa006d4dac907f28712c6c477246aac9d7f1b1acd9284d9955
-
Filesize
8KB
MD59aeb1373432d19dcf5751f6503ae13f0
SHA1ca726de1c0ffbcad863db9ba72e34e38d85c9f74
SHA25603b2b78b907306ed2b989805f315e2ae85e9e7caa0e9cf55ddc494a903f903f9
SHA51223833441a055fca4aa20b7607d54a95c15d2a12d24d3ed4c04615fc943b703b98ea8b5a6a983e1c2617d0294bb9b98996e1ccc3c91ebfdfa00a7489fab7c36c3
-
Filesize
8KB
MD505554bae3202e15119273bab355ce254
SHA1744e84603d006c12fbdb6b9c5fe3312a8a3951fb
SHA256b0f7e7aea9eb8d98198d3d618a11541011b11bc8705766c86cf9d1daffb42075
SHA512f3b5949a21f4901a9529d2aee4aa0211fd6e2c68c50b149165a0c28ea79face1ecb39f2cb3d12bbfa081e0ba90a3755c510fa7f9daae3546df567009884d9c5f
-
Filesize
40KB
MD51cf3f63c021d755a21623e6d0e86dbc6
SHA1e40e0f1faa61abcca7ba3394c54c92ff7334b49b
SHA256100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895
SHA51238d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466
-
Filesize
512B
MD54c9f0b05ebc761fd7a07d2d7dc871773
SHA13101abe803940a5c2de3a8b46577cedf559dd25a
SHA256e3103adce806fccfa17b3cc158898b76693f3aae404fe995299a91e277ae7fcd
SHA512c025a0b7c0919b63cc0a50de38967d6d9c00e73b81f83af1bc6282ccb8758a9e983ba164f054511293dc377928453749ae8e6c271c7a8f35ea05e3d5147fc45b
-
Filesize
8KB
MD5fd7c9773b9289a46ca4e147626c3d88f
SHA1d6a6b5eb59a35982433237f9e75f24a45f6ecf8b
SHA25655953991c7cd7f4ec5b441648a0b1204db559121331b449b22773adf147fabad
SHA5122156cf3496e3945c0bf8270e1f060d3169cf44d8cd279cdfb4905a4f363aeeb1785caab50fad2e50068acc8f66bf4b2857d3bfc6108f90a086b17713fa495e3a
-
Filesize
8KB
MD5ec67d988409fdf747997ff98370d553c
SHA1097b0b8533634aef6008ea923259d0ec39ce632f
SHA25654daa1e85c34424194d49ec59d25c321d354ad83a1dd72dffc72af73c92a6d47
SHA512fc68278ad9f798aa4d433105e456e2f582223332d3fecb4ca76765af0d4dd18d405f8269ba80bcabb97f157bb27b3c83f9d345e197a3bd82699b6ce0d277a8a5
-
Filesize
90B
MD534fff951a2c59bfc75781b13b57da6c6
SHA1e80c0f568ea574b96124f128f5e866cd5f541a7c
SHA256a081a0af8c4eb3a3e2bfe3b17595534489da63e7b62701b8ef70cc85d8c1c109
SHA512b0f54930feb2412751e1961091a4ae45d00dcf30066df6f1ff02b5df39ef2c61ef941f57b5b5e36be356e7c23fb51b03b9afd4475c1e9502fc7e664d45ddba3b
-
Filesize
90B
MD5352bce79fa1ad882c7cc675cab69ba1b
SHA154e4f4bcdeae872fea01b13664d681b6d49497a1
SHA256505d29531e505b1da0542284e88f11eb163a5079f3f51ea78161228c77c439ef
SHA512f4aa5e336e42081d2246813e5e5ac588470c25b7c5cd992cc0ef96aa321484e33fde448b26ce02d25ad18500dcea11e9500ec983d66af6182836625c1b02878c
-
Filesize
572B
MD59fc496f0655c4f4b6468fe129d357760
SHA13d8559f0f42aa546eeb46f2b64f6ebb435d87e8a
SHA256e89544172c32e6ffce97d8d8112da31213d61ba5f89dfae2caed059e66e607bd
SHA512b39483c147510b1553394384a22420106632125c706a9b585f2b5ca376eed6f58fd76a9229f5ceae686e3404464b2f96083605ebe4687d4b09abbe52d9d232d6
-
Filesize
567B
MD53f4166a754d2f6464290f5e8deff7d12
SHA1bebe4044ad8d73dddfadf061fad12c64729b6cf1
SHA2568590c5b271e99d5fe52043162b6928b82791ca6e16e627a24403b37f4cb32161
SHA512e703a471ef05fc67df568ce536e820414b78da20a462adf8227fecafb5eccc484ac3e43ac3c4778748ca1ada40176f6b08c704535a07b28ebd9937d8aebf4b24
-
Filesize
1KB
MD5cd52145e84fe4284b9db3654917ac5e2
SHA1725938a469c50fedfe30dd572bb20f9a2dcb37ec
SHA2567dcf0ffbd9b74186b8763d56f2baeeb8e1fd20883dc2c5ee05f8792da585ed07
SHA512eff0fb0c337e40351dc7129bad737416e07c4ad640099912941fbd5f9fa13d8c33f9f39b38c0da8279b73239db8fd3a90eb3e12c317a0086fa1f84a3bdd66d35
-
Filesize
2KB
MD5128503719bfdef6b09d4c8feb1a096d4
SHA18ca4eba243150f61a8660ed41c42510e16f36cb1
SHA256db1874b1c410bf8b36c2715ddd5b274e67146a1b75c6393be20abb9dafd6c20b
SHA512038e1cc07930281bbc2e6395baf41f9d463530496933a0f26bc1a37de4f3a1d75536ee1425a6f1580f8f32cda1e2e2fa4db754288d09351d81af5aafaa4aed61
-
Filesize
719B
MD564837ec60a5def703db0471648bdabff
SHA1f1eb4a00833351d6dd8040d9658faca109c0859f
SHA25604e4c66980a46478b18296ce2620239907d7406143d003fd7ba7bb6382440ae3
SHA512e856f892b0a8b4c645fb87d841e4faba64e2398589dbf25ee36f20e7df7a63e2e9464276232a625be4063659c924a005d8598fe03aa967c9d2a8d97b4ab68f34
-
Filesize
785B
MD5e9a968e4938a9bb9632799e2f10bbbbb
SHA18c9e1e04c6784d0f9d182081e6329897c957d166
SHA2568afd711f027fad53c5c96bc0d79574983b6d661af90aebaddf0f1dd858d03f2d
SHA512cf76a0a9051cade548200101d5e0837b1d1eacc441fed901641e7e9fa87ffa3304a98ba674c8d20ea30ff682076f45b60cdbf260e3dd2770b8f19ff2d393f133
-
Filesize
7KB
MD561c2e0b110472868bfe1701cc12d20d9
SHA1cb63d5929af0c46175ca935ad9a9b41fb047849c
SHA256ca2c10d481457b236ddb29b96ffe97ec130b87c524eb1eb62518c0d25578e717
SHA512559946ba51f57361f5cbafe2b2c44bd276c9b60ad885b7bd10450e08e113754bfe32b3e1c39a53d230d5e07e2350e080c96005aedc754b7d68454d958efae676
-
Filesize
1KB
MD531078fa68537bb028a691e3c10887833
SHA13accfef993d9c325c9a8707d29f8d1ceef3cab25
SHA256aea38691bc87f26151492036df8200829a6b7cf6fd9d3776fefcf43b94149c6c
SHA5129713aee45cb4d6e7cadbd899acef706d1d5612bea7f3453edfe60248b0d58bc16226b056f6fe3f797bc974087040688310f62e6e2b35f288d56619b423b09ae6
-
Filesize
1KB
MD5ebc06fd3d86c27a426932a83325eeffb
SHA1461c990e677114de3baba2a33f0a60c0a10bb9d2
SHA256ada010f03b82133ccddb4ac69a7c81a1d507121ef1d276c7c191bb55401c2230
SHA5123b3c682dc3876f7c813bff1a38e53e0c20f6c776eeb8362a8a750b81d0a3132a207b01740a493c61a03261748399e020aec5fcb7354c723e4f5703efe5418b2b
-
Filesize
1KB
MD5355eb0af21063fefca005d93d6afa9c9
SHA1f854e3d2f0c0470a54e55f31017f9c499bd3671d
SHA256b50339f939827a8e5a918ee4ed1d8213e27f6d546a98313f90449b27a1ebc00d
SHA512ffff59e303636383dccc1282dea4c13b8c46d9aea1d646d745f7d26607cfabc25aea8001af873942749129291abef5dc5a858e7360cbfc145f870b80689b34e9
-
Filesize
1KB
MD5cac9a26c27728066be7a285defc0df6c
SHA19931d42eea7663aaec4eb901bcf279b246c19e34
SHA2569347cbd8e6e2af4d09759e55b7595474648619da07992d6485b9756ab4d8170d
SHA51211a3abfc4558e6c887f1f809a3837ffe6f4c1702407db945319acacaa5e677f6b117c07ca676cda6438639a1ebc447a2993e0ff31be8ef797bd219700f508ba5
-
Filesize
2KB
MD52d858e8af5d9426fe061df5c82ffa6ff
SHA1bc1b2eab876aa221b6449d11e482de24b777d58f
SHA25673d875bdb982c50c666e30ba2b8ae2dceecc63cd0d5f8a35158edfe5f3303835
SHA512aabaa75856cfc07bf65f3f2dae118e357cba83a45f0a900aa625f576de47c2753b0a00fb1913e45c1d743acc0f6e0100a4a6a326f402b0f4664ba181ad670c0c
-
Filesize
895B
MD576ce13c6312eb334fd351e3b5cff4bf4
SHA1203bd863b812c071ab3ae25bf4ab2f9c4d42942b
SHA256f0a8e8d6b8bcb84e466f921dfb20a91fdd4e4b1777d9b0be6ad4d03d4a253af8
SHA512d06ba34786090e3b027670a17910d2e35f48eb7bc639e6da1d08214534215797dadd1a56be44422b176801e5d1a1345cd2bf29e73acb6a49bc9a2f7670710783
-
Filesize
753B
MD5317f802aacfab6282b8f74f280e841c1
SHA13b746a76f6322e97fd6c09a43d03ac14631d93e1
SHA256f37f9a17c20ca3068f4f9db08c262c62b7b86544532f612a78421bdee92f4196
SHA512a714f902ede615507cef840dcc03a5eca183c21c82cc419a924587f38b6974f5aa45fcfcc2bac4d6cf82b81d1b6ad452540e0581751bfcad72e524c83757a301
-
Filesize
1KB
MD59ee047a6801bec9459a9dd5ec7068078
SHA11aaaffc208e2d86e53fc031e8413169850e65746
SHA2569f63f6c9ed9d33f235c30508df34c3358b55cac8bfb4967fc3e15afc61a6fd12
SHA5128245818df5ffe06c8f369c8d77479f9f2163d10dac36b0e37c834018b713dc8b063ec1de1862fe16a8c1a769b496652be880ddd48d6fcd24ad766a395bc3ff24
-
Filesize
1KB
MD512bfe20382337a84c0fc004a52b9ba9b
SHA1ead15f7ef372c16f78060b8f8c5fc6e0ca6a96f9
SHA256621fbcd864a7dceacffddb00a682148042732aeb675e22cd42b1a0937c6717a5
SHA5127a346febc49154dd348be77f88c6e7ed5c7a531c2fed981f12c40e22a19e4e1a5c51fa766b3122898d97f05e1546a6f2a29b598b0ff441cc7de5e3c505aa33c4
-
Filesize
895B
MD5a40e6a567b7aef329bda0ac200f7a23d
SHA12fa463649c7ba586b28670675a15e0d7a630c7e0
SHA256ee0933e12dd4e302b1e18572d22f48861e8125e5d0201603e024d18ef5e38556
SHA5125e77ca21445a09aa903ca08c10c1bcaf769d8273368b7981aacf1bbab08cefb7a521687e78d280828f46b625c99fde02050f5c914dd4d07fd742723f7713ee4f
-
Filesize
2KB
MD545c24a8686a0978086c99f7039accc17
SHA1c63ae2601322045390c7a4f230602b74ae18d2d8
SHA256bc9c4aa36a0dd7efe16a8b3bca9172d970fd13d70d3e718aad17a78269079912
SHA512d5861c64b9dc9139904c3bfc7da26fa6f3d9676a5b4203ad617c661d54d3716508fb02f282f5c204bf9d6a0c7162bbb565a44f2ceb96d825177065818b797727
-
Filesize
153B
MD565026ee778e1372d9f4aed742772e893
SHA15a5f1c821d7639424f3c75a44468ab5f7dd4e8cc
SHA25615070f52136d5a8332f8d70f790bd7bb04cd6a99b386d40e0abedc40c42caa3c
SHA512589c4a12c6b6ec1a1cca957da758aaa900e68a23b4bc2f42524b0e8dd34f6c5378541d9293eae1ae8d478bf5b5229ce4218c058fc3b399eb5756afeb05c68616
-
Filesize
676B
MD51b759349f0bf3e55c51e2a2c2802b3cf
SHA15a608a093fa5f513d1ba52e8a9e01f693c47da98
SHA25659d83bb6ebc5394c048273ea9e1516a2bc7a6f80212d53f81ee44cb1f9b65443
SHA5123b39d22d0f8368dac2e36884b0316c5aba24180f51cb3a993fdefcdcfd5a36823d6c02c75863cd5a3bc0808223dcadf9934d548c433332bb9528f0eb8cecc0a6
-
Filesize
4KB
MD57e858c4054eb00fcddc653a04e5cd1c6
SHA12e056bf31a8d78df136f02a62afeeca77f4faccf
SHA2569010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
-
Filesize
512B
MD5ff13173c4b2a0238bf8db7650dc1daa7
SHA162b97e7fef270a58b71ba712cd01cc33577ed1fc
SHA2569d50113409990947670fc751ec192f3bb0729188d906d9910158ae9e49b4fb02
SHA512bce05c8c3844354e0b24b3527eb1f86a61a64f3b3bde5fc77e87744fc286407b83d8edb9708b4a12584a14e5462cfdcf6415b166d73aa6ffb0a2865b44d887fd
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
108KB
MD5346c835b26b080ab8e00731631cd081c
SHA1f7e786123a74f5276934adf1f6539641953300c7
SHA256ea0b3520749940c4f5cf4fef32332775244b84a61c2b9c94cd3d152728dda6a8
SHA512901400a16e455cdf32c2ef71cfc13833dc8d9cb7da9737ef6e7370572ecf042e685d66e84241e4d6d87ccaea2dfc6e29c7e7814733e3e199a6fb179ea7e02024
-
Filesize
261KB
MD5d37ac8274b6f6030b22a2b47ef9ab8fa
SHA1f10a65d451d95c9f299be53d9e31a4566d99ce1b
SHA256019ba9c6632382806fe8260993357dbf5b00844a13e76d4427f01643efffe85f
SHA5121ad36b142a99b1e64e0431e9c02c583515174e0f2f2e1d0e81761b67bc1f09ffa04000e4592ce7e61147693a55d15e780da1f7240b93055b8e92d8eecf9ac3e5
-
Filesize
16KB
MD55b2dda8c31160c5029e6e847e2dfb8b7
SHA1217216b047fc1ad2ba3c954205be704ba6edb4db
SHA256dadaf1ceb9765f9d8f2fab47a19c040d426587f6c9ec08f8349e32477aa459d3
SHA51264a245cab400c16080df0ab590daf15e625667a4c135802a0cba092fd59a701cb9cec0f462a033fb1d6c44559b5337d42113f35810b43d947f27f404484d5e00