4bc4475404dbc39a6bd6cc21e690c314b963523172012871eb61b83de6a22338

Analysis

max time kernel
59s
max time network
155s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
04/08/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kubera-v1.1.0.apk
Size 2.6MB
Sample260804-dtzk3acb72
SHA256 4bc4475404dbc39a6bd6cc21e690c314b963523172012871eb61b83de6a22338
MD5 28f575732ac98cb7168533b320540d3c
SHA1 c0aef64ce07374d3beadf1004138d158ef46491d
SHA512 5a84467e20316fcd6af5fddfecf0950bf1eb05661914c8e6397c4ee16c9b3340f62990566bee2c820990f7e2fba07897e0e0bea6d1f163cca7c3cab59db1cd53
SSDEEP 49152:9n0ja1FI9+uJ+2bzlZ9yaFkJPDn/4ZTY5pP6BvRExhnBkQ6eWL:NLC9+C+2bzrEaFKOU5YvRE2F
TLSH
T125C52317F2B68CAFC831D2712549513961675E28D742A78B394837BE39BBAEC0F807D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.k108.kubera

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.k108.kubera

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.k108.kubera

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.k108.kubera

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.k108.kubera

com.k108.kubera
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Checks CPU information
- Checks memory information
PID:4992

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

PersistedInstallation1866619174220455232tmp

Path /data/data/com.k108.kubera/files/PersistedInstallation1866619174220455232tmp
Size 569B
SHA256 3b9a1376c016f570247ada3993f4e837b32e7ec053219a239fc8497e32f0ba73
MD5 713afb6e9f2505bb1438b7e256f41e1c
SHA1 8d0375aab80177502f29921eab06550d8a6fb733
SHA512 466eefd8680443f6a5971ec304fbee5aab463c3f50500b481eacc2624a0f17887d9fa2eafbb7df97c653d6dc747f49afee0da96bea96a8bee108a41d32a20f94
TLSH
T1AEF0E1A82A408936EC96620734ADAC011D560461285B46B59EFD556071A197EB307500
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation2309467523704770989tmp

Path /data/data/com.k108.kubera/files/PersistedInstallation2309467523704770989tmp
Size 90B
SHA256 0e1beeb73146592ada43dbd1e4677fc3073b73f05d439e26375f2161b2b6837b
MD5 b1a24d055048d4905f3f71ca1fa0ab5b
SHA1 07e051234f35c778f19077133b82e4da32ef4a6a
SHA512 c96efd946d290cf747c260ee0ff91f30987463bf1624843f06bdfec45b6effee0df6254f1f419a906e2002f738a3de7699a6fa474f9fa0cdcf072ee922fd3aba
TLSH
T1F7B01251563181A285D5F2062C8C92002D981540184E8B1D4B0890C150C12F482079A8
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo0MjMwNDMzNzU5NDA6YW5kcm9pZDo3NTQ0ZmNjYjA1MDAyM2U3MDhlZDEx.preferences_pb.tmp

Path /data/data/com.k108.kubera/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo0MjMwNDMzNzU5NDA6YW5kcm9pZDo3NTQ0ZmNjYjA1MDAyM2U3MDhlZDEx.preferences_pb.tmp
Size 321B
SHA256 7025773676b27640d9fbe4a843e934740b66593929c192dbb60b88fd0c930bee
MD5 a0bc814266bf96f3cfc30aa67612148a
SHA1 8173114966a2b82ee3af4765d954be6ee9305aa5
SHA512 2cc5629bb5c59766e82bac435c85c90202541cc165d9030317e5ebbe098e7999258eb71de6931be8143c6a109cf03da46d944c2a447c352d54500c3562ae5adc
TLSH
T1F5E02600DAE159A01C3F110D7F6401280F6FB39161B6045961F80184BA0E640D1C2F0A
MD5 SHA1 SHA512 TLSH

Submit Download

FirebaseHeartBeatW0RFRkFVTFRd+MTo0MjMwNDMzNzU5NDA6YW5kcm9pZDo3NTQ0ZmNjYjA1MDAyM2U3MDhlZDEx.preferences_pb.tmp

Path /data/data/com.k108.kubera/files/datastore/FirebaseHeartBeatW0RFRkFVTFRd+MTo0MjMwNDMzNzU5NDA6YW5kcm9pZDo3NTQ0ZmNjYjA1MDAyM2U3MDhlZDEx.preferences_pb.tmp
Size 345B
SHA256 0b4807569a3b0feca3226e732a8830b99527362a2c26280181879d982364b06c
MD5 437e37cb9403d62b87af3f7dacfc697d
SHA1 8d12a1891cbd12ed3f6220cc23664eb44ad2c6f2
SHA512 58a7ba9ca4123849f570976a785bfa2b27e7b303bc29f26965508f7d12a0585b954e6b13a1a5bdfbef68f9f94dcef2bae73d81ebe4641cb31b46861d906d6a65
TLSH
T14DE02600DBE16AA05C7F520DBFA402280F7FB3D265BA446A65FC01C4BA0E644D5C2F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads