Analysis

  • max time kernel
    48s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20240910-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
  • submitted
    09-12-2024 01:46

General

  • Target

    com-penly-penly-1-59663159-a525ca6bee55a553d26453f2258e3b4a.apk

  • Size

    6.9MB

  • MD5

    a525ca6bee55a553d26453f2258e3b4a

  • SHA1

    0c88993bccb5f2ed0db36bea1b10910ba7b9b902

  • SHA256

    7fb82e43ab929fe5f0ee60a07876010cec4fd176d5e8bff876a5101a36567636

  • SHA512

    a689cd326a9038a4013c46fe58502f7b4002164025b90de8e3ff0c4bf444ec7d66bab90ee454bfee7b1d6659c371cc547ddff36ac9c12bc078aeda63d8a784d7

  • SSDEEP

    98304:LzfrHKXNei+kL/d/HxtS2jUxSOpzlf0Ot2T97u4NIFtEaiWONpY9m5+hlPqb212q:IsiDFHxtop7uZ2E9WOnYY4XY7pK

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 8 IoCs
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Requests cell location 1 TTPs 1 IoCs

    Uses Android APIs to to get current cell information.

  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.penly.penly
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu pipes.
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Requests cell location
    • Schedules tasks to execute at a specified time
    • Checks CPU information
    • Checks memory information
    PID:4794

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.penly.penly/databases/OneSignal.db

    Filesize

    52KB

    MD5

    e50e029ec0226f794da6d3fc0535d4f6

    SHA1

    027173bb3c775e8ee027c1e22930d9b1607195c3

    SHA256

    c776d1acf90c60f95a89ee4db8222acedc8e0b097d5606297aa641a3403821ee

    SHA512

    4f12a39bd359554fccacb8ac31e2276c38fa69a2de927f43216c9012bd3aeee0e1a0f47a48d114c6e45309e069cdd5a6979d90d21f2e60f0087f42b8364672ca

  • /data/data/com.penly.penly/databases/OneSignal.db-journal

    Filesize

    512B

    MD5

    0aee291259df43dc9f1e3dbac09c475d

    SHA1

    151f15565dd1664b77d2cb21ade1caf828c3713c

    SHA256

    83ccac098a5759d75700cdb308a5a075328c29dd368464a15f3c9322686a6b6f

    SHA512

    365df5750ac3e0307489428da2a0f254e17037cad1e60e6167ddb73960336157b50e131359a3aefa006d4dac907f28712c6c477246aac9d7f1b1acd9284d9955

  • /data/data/com.penly.penly/databases/OneSignal.db-journal

    Filesize

    8KB

    MD5

    9aeb1373432d19dcf5751f6503ae13f0

    SHA1

    ca726de1c0ffbcad863db9ba72e34e38d85c9f74

    SHA256

    03b2b78b907306ed2b989805f315e2ae85e9e7caa0e9cf55ddc494a903f903f9

    SHA512

    23833441a055fca4aa20b7607d54a95c15d2a12d24d3ed4c04615fc943b703b98ea8b5a6a983e1c2617d0294bb9b98996e1ccc3c91ebfdfa00a7489fab7c36c3

  • /data/data/com.penly.penly/databases/OneSignal.db-journal

    Filesize

    8KB

    MD5

    05554bae3202e15119273bab355ce254

    SHA1

    744e84603d006c12fbdb6b9c5fe3312a8a3951fb

    SHA256

    b0f7e7aea9eb8d98198d3d618a11541011b11bc8705766c86cf9d1daffb42075

    SHA512

    f3b5949a21f4901a9529d2aee4aa0211fd6e2c68c50b149165a0c28ea79face1ecb39f2cb3d12bbfa081e0ba90a3755c510fa7f9daae3546df567009884d9c5f

  • /data/data/com.penly.penly/databases/com.google.android.datatransport.events

    Filesize

    40KB

    MD5

    1cf3f63c021d755a21623e6d0e86dbc6

    SHA1

    e40e0f1faa61abcca7ba3394c54c92ff7334b49b

    SHA256

    100c67650ba652d547d8a1128edc550a8e95541a1d9268a199d1b924294d0895

    SHA512

    38d72e14f3513ffd26989cbda3df46ed3dd6e731bdfae56440eff6b64760cc13f91014281c9add61e018fe3529e49c63a6892ca22479515816c768b546244466

  • /data/data/com.penly.penly/databases/com.google.android.datatransport.events-journal

    Filesize

    512B

    MD5

    4c9f0b05ebc761fd7a07d2d7dc871773

    SHA1

    3101abe803940a5c2de3a8b46577cedf559dd25a

    SHA256

    e3103adce806fccfa17b3cc158898b76693f3aae404fe995299a91e277ae7fcd

    SHA512

    c025a0b7c0919b63cc0a50de38967d6d9c00e73b81f83af1bc6282ccb8758a9e983ba164f054511293dc377928453749ae8e6c271c7a8f35ea05e3d5147fc45b

  • /data/data/com.penly.penly/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    fd7c9773b9289a46ca4e147626c3d88f

    SHA1

    d6a6b5eb59a35982433237f9e75f24a45f6ecf8b

    SHA256

    55953991c7cd7f4ec5b441648a0b1204db559121331b449b22773adf147fabad

    SHA512

    2156cf3496e3945c0bf8270e1f060d3169cf44d8cd279cdfb4905a4f363aeeb1785caab50fad2e50068acc8f66bf4b2857d3bfc6108f90a086b17713fa495e3a

  • /data/data/com.penly.penly/databases/com.google.android.datatransport.events-journal

    Filesize

    8KB

    MD5

    ec67d988409fdf747997ff98370d553c

    SHA1

    097b0b8533634aef6008ea923259d0ec39ce632f

    SHA256

    54daa1e85c34424194d49ec59d25c321d354ad83a1dd72dffc72af73c92a6d47

    SHA512

    fc68278ad9f798aa4d433105e456e2f582223332d3fecb4ca76765af0d4dd18d405f8269ba80bcabb97f157bb27b3c83f9d345e197a3bd82699b6ce0d277a8a5

  • /data/data/com.penly.penly/files/PersistedInstallation2341589784355762673tmp

    Filesize

    90B

    MD5

    34fff951a2c59bfc75781b13b57da6c6

    SHA1

    e80c0f568ea574b96124f128f5e866cd5f541a7c

    SHA256

    a081a0af8c4eb3a3e2bfe3b17595534489da63e7b62701b8ef70cc85d8c1c109

    SHA512

    b0f54930feb2412751e1961091a4ae45d00dcf30066df6f1ff02b5df39ef2c61ef941f57b5b5e36be356e7c23fb51b03b9afd4475c1e9502fc7e664d45ddba3b

  • /data/data/com.penly.penly/files/PersistedInstallation2520289609540735013tmp

    Filesize

    90B

    MD5

    352bce79fa1ad882c7cc675cab69ba1b

    SHA1

    54e4f4bcdeae872fea01b13664d681b6d49497a1

    SHA256

    505d29531e505b1da0542284e88f11eb163a5079f3f51ea78161228c77c439ef

    SHA512

    f4aa5e336e42081d2246813e5e5ac588470c25b7c5cd992cc0ef96aa321484e33fde448b26ce02d25ad18500dcea11e9500ec983d66af6182836625c1b02878c

  • /data/data/com.penly.penly/files/PersistedInstallation4395252000347901633tmp

    Filesize

    572B

    MD5

    9fc496f0655c4f4b6468fe129d357760

    SHA1

    3d8559f0f42aa546eeb46f2b64f6ebb435d87e8a

    SHA256

    e89544172c32e6ffce97d8d8112da31213d61ba5f89dfae2caed059e66e607bd

    SHA512

    b39483c147510b1553394384a22420106632125c706a9b585f2b5ca376eed6f58fd76a9229f5ceae686e3404464b2f96083605ebe4687d4b09abbe52d9d232d6

  • /data/data/com.penly.penly/files/PersistedInstallation8291956259810854139tmp

    Filesize

    567B

    MD5

    3f4166a754d2f6464290f5e8deff7d12

    SHA1

    bebe4044ad8d73dddfadf061fad12c64729b6cf1

    SHA256

    8590c5b271e99d5fe52043162b6928b82791ca6e16e627a24403b37f4cb32161

    SHA512

    e703a471ef05fc67df568ce536e820414b78da20a462adf8227fecafb5eccc484ac3e43ac3c4778748ca1ada40176f6b08c704535a07b28ebd9937d8aebf4b24

  • /data/data/com.penly.penly/files/StartappAdInfoMetadata

    Filesize

    1KB

    MD5

    cd52145e84fe4284b9db3654917ac5e2

    SHA1

    725938a469c50fedfe30dd572bb20f9a2dcb37ec

    SHA256

    7dcf0ffbd9b74186b8763d56f2baeeb8e1fd20883dc2c5ee05f8792da585ed07

    SHA512

    eff0fb0c337e40351dc7129bad737416e07c4ad640099912941fbd5f9fa13d8c33f9f39b38c0da8279b73239db8fd3a90eb3e12c317a0086fa1f84a3bdd66d35

  • /data/data/com.penly.penly/files/StartappAdsMetadata

    Filesize

    2KB

    MD5

    128503719bfdef6b09d4c8feb1a096d4

    SHA1

    8ca4eba243150f61a8660ed41c42510e16f36cb1

    SHA256

    db1874b1c410bf8b36c2715ddd5b274e67146a1b75c6393be20abb9dafd6c20b

    SHA512

    038e1cc07930281bbc2e6395baf41f9d463530496933a0f26bc1a37de4f3a1d75536ee1425a6f1580f8f32cda1e2e2fa4db754288d09351d81af5aafaa4aed61

  • /data/data/com.penly.penly/files/StartappBannerMetadata

    Filesize

    719B

    MD5

    64837ec60a5def703db0471648bdabff

    SHA1

    f1eb4a00833351d6dd8040d9658faca109c0859f

    SHA256

    04e4c66980a46478b18296ce2620239907d7406143d003fd7ba7bb6382440ae3

    SHA512

    e856f892b0a8b4c645fb87d841e4faba64e2398589dbf25ee36f20e7df7a63e2e9464276232a625be4063659c924a005d8598fe03aa967c9d2a8d97b4ab68f34

  • /data/data/com.penly.penly/files/StartappCacheMetadata

    Filesize

    785B

    MD5

    e9a968e4938a9bb9632799e2f10bbbbb

    SHA1

    8c9e1e04c6784d0f9d182081e6329897c957d166

    SHA256

    8afd711f027fad53c5c96bc0d79574983b6d661af90aebaddf0f1dd858d03f2d

    SHA512

    cf76a0a9051cade548200101d5e0837b1d1eacc441fed901641e7e9fa87ffa3304a98ba674c8d20ea30ff682076f45b60cdbf260e3dd2770b8f19ff2d393f133

  • /data/data/com.penly.penly/files/StartappMetadata

    Filesize

    7KB

    MD5

    61c2e0b110472868bfe1701cc12d20d9

    SHA1

    cb63d5929af0c46175ca935ad9a9b41fb047849c

    SHA256

    ca2c10d481457b236ddb29b96ffe97ec130b87c524eb1eb62518c0d25578e717

    SHA512

    559946ba51f57361f5cbafe2b2c44bd276c9b60ad885b7bd10450e08e113754bfe32b3e1c39a53d230d5e07e2350e080c96005aedc754b7d68454d958efae676

  • /data/data/com.penly.penly/files/StartappSplashMetadata

    Filesize

    1KB

    MD5

    31078fa68537bb028a691e3c10887833

    SHA1

    3accfef993d9c325c9a8707d29f8d1ceef3cab25

    SHA256

    aea38691bc87f26151492036df8200829a6b7cf6fd9d3776fefcf43b94149c6c

    SHA512

    9713aee45cb4d6e7cadbd899acef706d1d5612bea7f3453edfe60248b0d58bc16226b056f6fe3f797bc974087040688310f62e6e2b35f288d56619b423b09ae6

  • /data/data/com.penly.penly/files/back_.png

    Filesize

    1KB

    MD5

    ebc06fd3d86c27a426932a83325eeffb

    SHA1

    461c990e677114de3baba2a33f0a60c0a10bb9d2

    SHA256

    ada010f03b82133ccddb4ac69a7c81a1d507121ef1d276c7c191bb55401c2230

    SHA512

    3b3c682dc3876f7c813bff1a38e53e0c20f6c776eeb8362a8a750b81d0a3132a207b01740a493c61a03261748399e020aec5fcb7354c723e4f5703efe5418b2b

  • /data/data/com.penly.penly/files/back_dark.png

    Filesize

    1KB

    MD5

    355eb0af21063fefca005d93d6afa9c9

    SHA1

    f854e3d2f0c0470a54e55f31017f9c499bd3671d

    SHA256

    b50339f939827a8e5a918ee4ed1d8213e27f6d546a98313f90449b27a1ebc00d

    SHA512

    ffff59e303636383dccc1282dea4c13b8c46d9aea1d646d745f7d26607cfabc25aea8001af873942749129291abef5dc5a858e7360cbfc145f870b80689b34e9

  • /data/data/com.penly.penly/files/browser_icon_dark.png

    Filesize

    1KB

    MD5

    cac9a26c27728066be7a285defc0df6c

    SHA1

    9931d42eea7663aaec4eb901bcf279b246c19e34

    SHA256

    9347cbd8e6e2af4d09759e55b7595474648619da07992d6485b9756ab4d8170d

    SHA512

    11a3abfc4558e6c887f1f809a3837ffe6f4c1702407db945319acacaa5e677f6b117c07ca676cda6438639a1ebc447a2993e0ff31be8ef797bd219700f508ba5

  • /data/data/com.penly.penly/files/close_button.png

    Filesize

    2KB

    MD5

    2d858e8af5d9426fe061df5c82ffa6ff

    SHA1

    bc1b2eab876aa221b6449d11e482de24b777d58f

    SHA256

    73d875bdb982c50c666e30ba2b8ae2dceecc63cd0d5f8a35158edfe5f3303835

    SHA512

    aabaa75856cfc07bf65f3f2dae118e357cba83a45f0a900aa625f576de47c2753b0a00fb1913e45c1d743acc0f6e0100a4a6a326f402b0f4664ba181ad670c0c

  • /data/data/com.penly.penly/files/empty_star.png

    Filesize

    895B

    MD5

    76ce13c6312eb334fd351e3b5cff4bf4

    SHA1

    203bd863b812c071ab3ae25bf4ab2f9c4d42942b

    SHA256

    f0a8e8d6b8bcb84e466f921dfb20a91fdd4e4b1777d9b0be6ad4d03d4a253af8

    SHA512

    d06ba34786090e3b027670a17910d2e35f48eb7bc639e6da1d08214534215797dadd1a56be44422b176801e5d1a1345cd2bf29e73acb6a49bc9a2f7670710783

  • /data/data/com.penly.penly/files/filled_star.png

    Filesize

    753B

    MD5

    317f802aacfab6282b8f74f280e841c1

    SHA1

    3b746a76f6322e97fd6c09a43d03ac14631d93e1

    SHA256

    f37f9a17c20ca3068f4f9db08c262c62b7b86544532f612a78421bdee92f4196

    SHA512

    a714f902ede615507cef840dcc03a5eca183c21c82cc419a924587f38b6974f5aa45fcfcc2bac4d6cf82b81d1b6ad452540e0581751bfcad72e524c83757a301

  • /data/data/com.penly.penly/files/forward_.png

    Filesize

    1KB

    MD5

    9ee047a6801bec9459a9dd5ec7068078

    SHA1

    1aaaffc208e2d86e53fc031e8413169850e65746

    SHA256

    9f63f6c9ed9d33f235c30508df34c3358b55cac8bfb4967fc3e15afc61a6fd12

    SHA512

    8245818df5ffe06c8f369c8d77479f9f2163d10dac36b0e37c834018b713dc8b063ec1de1862fe16a8c1a769b496652be880ddd48d6fcd24ad766a395bc3ff24

  • /data/data/com.penly.penly/files/forward_dark.png

    Filesize

    1KB

    MD5

    12bfe20382337a84c0fc004a52b9ba9b

    SHA1

    ead15f7ef372c16f78060b8f8c5fc6e0ca6a96f9

    SHA256

    621fbcd864a7dceacffddb00a682148042732aeb675e22cd42b1a0937c6717a5

    SHA512

    7a346febc49154dd348be77f88c6e7ed5c7a531c2fed981f12c40e22a19e4e1a5c51fa766b3122898d97f05e1546a6f2a29b598b0ff441cc7de5e3c505aa33c4

  • /data/data/com.penly.penly/files/half_star.png

    Filesize

    895B

    MD5

    a40e6a567b7aef329bda0ac200f7a23d

    SHA1

    2fa463649c7ba586b28670675a15e0d7a630c7e0

    SHA256

    ee0933e12dd4e302b1e18572d22f48861e8125e5d0201603e024d18ef5e38556

    SHA512

    5e77ca21445a09aa903ca08c10c1bcaf769d8273368b7981aacf1bbab08cefb7a521687e78d280828f46b625c99fde02050f5c914dd4d07fd742723f7713ee4f

  • /data/data/com.penly.penly/files/logo.png

    Filesize

    2KB

    MD5

    45c24a8686a0978086c99f7039accc17

    SHA1

    c63ae2601322045390c7a4f230602b74ae18d2d8

    SHA256

    bc9c4aa36a0dd7efe16a8b3bca9172d970fd13d70d3e718aad17a78269079912

    SHA512

    d5861c64b9dc9139904c3bfc7da26fa6f3d9676a5b4203ad617c661d54d3716508fb02f282f5c204bf9d6a0c7162bbb565a44f2ceb96d825177065818b797727

  • /data/data/com.penly.penly/files/shared_prefs_sdk_ad_prefs

    Filesize

    153B

    MD5

    65026ee778e1372d9f4aed742772e893

    SHA1

    5a5f1c821d7639424f3c75a44468ab5f7dd4e8cc

    SHA256

    15070f52136d5a8332f8d70f790bd7bb04cd6a99b386d40e0abedc40c42caa3c

    SHA512

    589c4a12c6b6ec1a1cca957da758aaa900e68a23b4bc2f42524b0e8dd34f6c5378541d9293eae1ae8d478bf5b5229ce4218c058fc3b399eb5756afeb05c68616

  • /data/data/com.penly.penly/files/x_dark.png

    Filesize

    676B

    MD5

    1b759349f0bf3e55c51e2a2c2802b3cf

    SHA1

    5a608a093fa5f513d1ba52e8a9e01f693c47da98

    SHA256

    59d83bb6ebc5394c048273ea9e1516a2bc7a6f80212d53f81ee44cb1f9b65443

    SHA512

    3b39d22d0f8368dac2e36884b0316c5aba24180f51cb3a993fdefcdcfd5a36823d6c02c75863cd5a3bc0808223dcadf9934d548c433332bb9528f0eb8cecc0a6

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    7e858c4054eb00fcddc653a04e5cd1c6

    SHA1

    2e056bf31a8d78df136f02a62afeeca77f4faccf

    SHA256

    9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad

    SHA512

    d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb-journal

    Filesize

    512B

    MD5

    ff13173c4b2a0238bf8db7650dc1daa7

    SHA1

    62b97e7fef270a58b71ba712cd01cc33577ed1fc

    SHA256

    9d50113409990947670fc751ec192f3bb0729188d906d9910158ae9e49b4fb02

    SHA512

    bce05c8c3844354e0b24b3527eb1f86a61a64f3b3bde5fc77e87744fc286407b83d8edb9708b4a12584a14e5462cfdcf6415b166d73aa6ffb0a2865b44d887fd

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    346c835b26b080ab8e00731631cd081c

    SHA1

    f7e786123a74f5276934adf1f6539641953300c7

    SHA256

    ea0b3520749940c4f5cf4fef32332775244b84a61c2b9c94cd3d152728dda6a8

    SHA512

    901400a16e455cdf32c2ef71cfc13833dc8d9cb7da9737ef6e7370572ecf042e685d66e84241e4d6d87ccaea2dfc6e29c7e7814733e3e199a6fb179ea7e02024

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb-wal

    Filesize

    261KB

    MD5

    d37ac8274b6f6030b22a2b47ef9ab8fa

    SHA1

    f10a65d451d95c9f299be53d9e31a4566d99ce1b

    SHA256

    019ba9c6632382806fe8260993357dbf5b00844a13e76d4427f01643efffe85f

    SHA512

    1ad36b142a99b1e64e0431e9c02c583515174e0f2f2e1d0e81761b67bc1f09ffa04000e4592ce7e61147693a55d15e780da1f7240b93055b8e92d8eecf9ac3e5

  • /data/data/com.penly.penly/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    5b2dda8c31160c5029e6e847e2dfb8b7

    SHA1

    217216b047fc1ad2ba3c954205be704ba6edb4db

    SHA256

    dadaf1ceb9765f9d8f2fab47a19c040d426587f6c9ec08f8349e32477aa459d3

    SHA512

    64a245cab400c16080df0ab590daf15e625667a4c135802a0cba092fd59a701cb9cec0f462a033fb1d6c44559b5337d42113f35810b43d947f27f404484d5e00