bc6c061f6f2a7dcdebf83f511358e147df617660bc69b4d73b0adc3d460f254a

Analysis

max time kernel
96s
max time network
152s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
27/10/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
peel-v0.54.0-arm64-v8a.apk
Size 94.9MB
Sample261027-d2mapsce98
SHA256 bc6c061f6f2a7dcdebf83f511358e147df617660bc69b4d73b0adc3d460f254a
MD5 b931768b65d402306a4ee655a5da7089
SHA1 cdf9d99798ae5cc33747815bcb14fe8b6de747e7
SHA512 4941f4d279162be4da486f9d616a8b63c4cdae54c201f5440b9f711ea65dd0cd5310745e317384b02f27abf5d16dbca162fcc3a03086c47e0070a181dbd13606
SSDEEP 1572864:50PNmvyyouOaDaMDprRI9UegXDiCzilXZEgvuWloJ7cMW9XO11bVdE6gqCWfPd:50Fmvyyou7aMDpl2sDtm3EvRJIFR6RdR
TLSH
T13028231AFB559F31D4BE623998B3039077326D46AB835B072289B678BC731D06FD92C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery execution impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	wtf.mazy.peel

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	wtf.mazy.peel

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	wtf.mazy.peel

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	wtf.mazy.peel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	wtf.mazy.peel

wtf.mazy.peel
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4160

wtf.mazy.peel:crashhelper_disable_art_image_
1⤵
PID:4208

wtf.mazy.peel:tab_disable_art_image_7
1⤵
PID:4255

wtf.mazy.peel:gpu_disable_art_image_
1⤵
PID:4301

wtf.mazy.peel:tab_disable_art_image_23
1⤵
PID:4415

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

peel.db-journal

Path /data/data/wtf.mazy.peel/databases/peel.db-journal
Size 512B
SHA256 eebd9df9fd62dcae20c3627a46b88e55e65b12a5ac6abd406a0ff5554a26068c
MD5 2c01e57ec192a2b40c174cd941cfaeda
SHA1 6e6d8a5808b9650547c2c3bb7dd4f95194665e77
SHA512 6e6e25a9d9318f9376c644c10c3ed15d4088b0e54a62c40d07d408acd0b0c3d446f7bc297392318d232862929bf4297cce3bb99257ebdb911c1e43835091da69
MD5 SHA1 SHA512

Submit Download

peel.db-wal

Path /data/data/wtf.mazy.peel/databases/peel.db-wal
Size 80KB
SHA256 2e345aaff96ce7e0a22d4ea8aa07582f8fea961562491bdf287f35bb0b297641
MD5 85f437c5ac022f76d03aa575df793be9
SHA1 03fdebcfbb1946eacaae690b17340c6530be3c67
SHA512 460ca9b1dd0818d15b96493f113fe86abf47410bc5564f86013c1c9389a1f27178e8426281931630ad331a6bc3b20e33a3e3ed2b53dfa5ba580d670effe8e660
SSDEEP 96:11PR35V6mtKT33gLPX4rIbd56meWX4rIbd56PXPfiG:DR3ITA74rIbd56a4rIbd56XqG
TLSH
T16283778D8E702761C8D94877FD656B95093FA97D12F332292CC0C0B7AEC6218C59A8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geckoview-config.yaml

Path /data/data/wtf.mazy.peel/files/geckoview-config.yaml
Size 236B
SHA256 0f3298dac631ff67e175c985f96c5166da66d5f899490f3230bc4a9334be0d28
MD5 dedbaab3270ec77abce9c5f1ba3140df
SHA1 cd2cd47235ebd0cbf2b80643744d85d5953bca8e
SHA512 67658c34c6821606b79880247c1cd9a735d96fc464dab06abd58a44829f9d98450a30fcc5b0a2f942d895fb90f96f8c8196ca7131602b5d76c400a730b1a4b10
TLSH
T12ED0A718BC40BC3B0BD3C198DD265E8C797348FD18F839121F5900629D3564830477CD
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/wtf.mazy.peel/files/profileInstalled
Size 24B
SHA256 8f8b54e9e39f6f460cb212e679224834e534ccf2c7b17425f668fa46cc9084d6
MD5 d94ffc9019c84635686c913d5bcb1ef6
SHA1 7968fdb37b0224bf622cb06f539e1e7442445546
SHA512 8d56c2d7411352b537f864492951e36590781a034bdb8c0f7c42afe1a6054e48cf629fc579a1e0fe443c908cd4e5078b97f597438f7e3f00eb3a6739cf9530ea
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/wtf.mazy.peel/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 74346abf9ac3a8fccce7f2b7e24e6eaaf0e1faabe50b9da36cb5180ae9751fd9
MD5 4391f01a43d11c501ab3358cd838cc61
SHA1 9d0949bc25a80578cd4cd9155d58ffe6eb7a7d01
SHA512 36695ef11490d502a101f041dd81c9eb573e717b585480f6ac9b05b0095734c9eb460e99313e51672486ab042e2644a99457945c8a194057af391f61e49e8b4a
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/wtf.mazy.peel/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
TLSH
T183810250534000E1D05446B354E113080F06D19496428B03550100428C415440C60E88
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/wtf.mazy.peel/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 5c7c471c36c15d75edc149a3ed34cc2fe4960c9a0fc4fed149177a1868f6a457
MD5 490443714a258180619fe07e3ea7b037
SHA1 47a3d99c6e48981e64f57a99f8cbfac1e92c6489
SHA512 385595bf6fe2bcace904382fb28d5482370d1545cfcdcd50620dfb9fda9de1af47ad6464d082e28b5fb822bfeb8b2727fd608587f979f913a9cabceb2248ccb9
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/wtf.mazy.peel/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/wtf.mazy.peel/no_backup/androidx.work.workdb-wal
Size 181KB
SHA256 e340c68f5f75001f38f95d9e3661af8cfe429ecdf0044a792a7be1fc70f1627b
MD5 5cebeeb981f431e6bb10191e296dfe91
SHA1 5f429083dd1955d667f76ac642ce7f605e48c8ff
SHA512 1a835463ea3b6e5761fd74a8a3d694561eddc2847591fff8a3dda714772d7aaab94541d08c4aec549e77520dd88ce42b96de72a4b594981522506aba92088cc5
SSDEEP 192:PIcjtidjnfWzzb83zSC+XD86u0E5u1LD1I:5tidjnfWzzb83zSdXD86u0EY1LD1I
TLSH
T1A704419D1F4C2B44C0FC54B2E8E00BA16F3E687E978BD392619001F9E9D2920996BCF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/wtf.mazy.peel/primary.prof
Size 2KB
SHA256 6547f9c871df8e5773f1286b15fdc9fb59fb8da3d1ceece22909873350e545a3
MD5 641dfa7e43aae9669ab5c62c37e0f3f1
SHA1 925c416c817743554ff61482c8654f267d00be88
SHA512 a2b96cbd049327e9c98d6c43d0690ceb1048b2cb11807173ec193574a9a3f5cd7510a7ec20c21a363ecb8b3306218c1326e9988f558e7282dfc77717b9b71ec0
TLSH
T10A514D514B616923CD6F86B875CA5518C9238BBB0AD84232A5022CCF07EE3FE84815C6
MD5 SHA1 SHA512 TLSH

Submit Download

goldfish_pipe

Path /dev/goldfish_pipe
Size 124B
SHA256 98de705e1bb5832954442717805e8126ae0557c71113ea9da4661c6652c369c0
MD5 333f38a54c260cdd1cd2bbcbf51b1489
SHA1 26c3dd7fde62cf6f8fff594a02fdc0dfe5df5f42
SHA512 f47748cf1272e29fb7a08dad644fbc553a0c046011a247c3ffc7a96d56fab72603af0824fbc7464a864d7808f9da8f8780f05be3f8ea65805a3b4f35db97269c
TLSH
T10AB00200A108365EE43913B1DA95755F5A2445CF97CB070CC84D8CC49554707241A9C6
MD5 SHA1 SHA512 TLSH

Submit Download

socket:[58734]

Path socket:[58734]
Size 90B
SHA256 d47fde97cd7d39eff0a13a52334db8018c64808ad1549cf64fb496af00ece641
MD5 11b79810a6b2367e1e0a566d34f77ed9
SHA1 1a614a8e4366513a077ab1b1682322a8c0fdd796
SHA512 dd6473b14c603d100fa747f1f66c7264c223944d11b5f618e2e53f3117d73b000c991eb2ce2f26c8e48c907a6d6ee89e03b9378b48f74ba640aa430af552df9a
TLSH
T1EAB01233AAB3F0DF4B200820C02001040E082393510D4615A40D655361C1104CABA532
MD5 SHA1 SHA512 TLSH

Submit Download

socket:[58737]

Path socket:[58737]
Size 65B
SHA256 4d43a71f2e87031f180c7f74c4bd23441c6d29e00d98f345f82a6983d0f261d5
MD5 2b1af6cad56e4ccf044cda4b1c3ecd61
SHA1 01c5bbcefb50f037d71392f554f32760ed478859
SHA512 28f7109bbf016f6b9d92f1d61cee9c13a7ee0acaf1d90b0b3bd2ca9d2afa0454b8c07a40fc2e47baf843a1aa841ee0356d2555af2a4b49d33230a988730a4561
TLSH
T1F3A0023746CE446E0894D534791B22442D8963A11276F5785DA942247196B8C8DA9290
MD5 SHA1 SHA512 TLSH

Submit Download

socket:[58740]

Path socket:[58740]
Size 98B
SHA256 90ad85a1ca9314b7e30f23197af04070d8b9bd09b7756723b5869f77bd12cdd8
MD5 8f62e6b52ef4749bedfd684fe26186a4
SHA1 fdf5a8d38d81eab36f624a2b02ae55127ba56aa8
SHA512 9b69b842275c7ba5753b13500f143a620495e1b837e2e286a2ee805b7f19d3503043a0b414c16a0fccbb398cb2c29df9a477f7e512e5fbcc0558b5338a429043
TLSH
T1A7B01273B23C8CC76E225425806120010D15465301A0113CEA0E704281C1F0BC92247F
MD5 SHA1 SHA512 TLSH

Submit Download

socket:[58742]

Path socket:[58742]
Size 72B
SHA256 99d30a4466a48905c7bf99c59af5d98ac1a8483b4a103c802b71899cfa8188c7
MD5 69bae1808160b484e1a69fbb9e6f0008
SHA1 3f4d56896a527abd7485d7f373e4fca242de8d71
SHA512 b9e79409f5f6d97f84ae87e7c1dc59330d4e42b9db613305633e2eaf59bff7843dd140698c05d3aae64531d889f39fae5afa5f33a06e6ad65735b0ce1fc71c8f
TLSH
T113A0023B365C484E0849D658675A2265118ADA641335917D6C6C4234A296BECDDDE281
MD5 SHA1 SHA512 TLSH

Submit Download

socket:[58913]

Path socket:[58913]
Size 55B
SHA256 b7ff0de4757a75ef43f6723e4bf85573b014f7544824031e6ffcd81137f3c32e
MD5 b3d2090a037caa79b7a1e1579cccf925
SHA1 7fd3dc224a049c636ea8311f3c7de29cfd21e255
SHA512 5f13d04a8aefc3065bd1701c41d112a148618a8f71da20a699edaf6ff07d7a71addb217c97e70349f1aae6c2817c73fdc465e6280dcce1a1ce97bbf980039e6f
TLSH
T1FB9002E5114C819F0898D090145E6501226571A01566D5F11C7E122592172088995044
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads