529c8b3b53980d2ffb8de5bc68384e86e6983f543b0e841b6149239b7ddafffd

Analysis

max time kernel
145s
max time network
154s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
05/09/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GubukTogel.apk
Size 7.2MB
Sample260905-gyg4csvxcs
SHA256 529c8b3b53980d2ffb8de5bc68384e86e6983f543b0e841b6149239b7ddafffd
MD5 954e4c08030d323f56468a1ca88bb3a8
SHA1 3968ed98aea52f209e0c336d01e4e80e41017e5d
SHA512 b072d962851c4d997332025d3e0e9e5b5d2be1fadc349916a697945740e9ed828a3332575afb27f9647958ffe38f6cd5da61f159b13a4e09cf0e7fdd0d4cd7cf
SSDEEP 196608:ZVH7837chFa3FExCCZVASoSnepBEnMFpNZF:ZVQ37cmFiCCZVA6UBIMFHZF
TLSH
T10C76124EFB6CBD2FC87F40320A9AD23136568D158A9297476A44375CF8776E40F89BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 8 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/data/local/xbin/su	com.gubuktogel
/data/local/bin/su	com.gubuktogel
/system/sd/xbin/su	com.gubuktogel
/system/bin/failsafe/su	com.gubuktogel
/data/local/su	com.gubuktogel
/sbin/su	com.gubuktogel
/system/bin/su	com.gubuktogel
/system/xbin/su	com.gubuktogel

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.gubuktogel

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gubuktogel

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gubuktogel

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.gubuktogel

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gubuktogel

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.gubuktogel

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gubuktogel

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gubuktogel

com.gubuktogel
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5093

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/com.gubuktogel/databases/OneSignal.db
Size 52KB
SHA256 f8ebc23104952761ccaf8dcf7ea9e5341bb0f3da744550a518f8dbc8b3404904
MD5 5715efdd2d828d4d57c1376120ba2806
SHA1 06f279c976087695aaaf885df323d996a2560cc1
SHA512 dbc9dcea4f947dc61663054585dcc175b79ce7d69aaa8335754d1fe6d02881dadd75d3846190178e677e80efd63a1e364a31d51620d51e8e6254b8864651bb30
SSDEEP 24:TLLSrCrUWEaKdStdxyqOkPU/+XiByrBNDd2+32ISpvFqrEqjUi7+xGTrOPjwV+HR:T6CrQcrA0oJtqracrObMoOS
TLSH
T1D8337ACF4B862191EFC765B3155392E48E37610E8C9317A62BF760245E83B16D72386C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.gubuktogel/databases/OneSignal.db-journal
Size 512B
SHA256 c94ff7b3979e34a02bfebd07d96604c5750ddbea9398d97520ccba73b0c86582
MD5 c1bbcf2fa78978bcaf5b0edfc6f7af2c
SHA1 84188ce64ad342ab4411f2bf303a6db6e5aa7ea0
SHA512 6505ff347209be502eedc4b5bc6838bc54378fd5dadea2e332177ab5fb8451caa1f51796c569f2a4d0fa5df840dd75286a5e0c6840548982d5b73c187af45c9a
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.gubuktogel/databases/OneSignal.db-journal
Size 8KB
SHA256 b34d0616577ccaec5ad969a78d416520ed42583d32e8988c903504df0c2ba966
MD5 34a23ca2a9625251b4d494263d3e8a29
SHA1 9a65119481bdbc2c5129b5a84635134458a746e0
SHA512 b7cc6a488da27be759f9398a4e7dbedc16129db5bc0b33870d26fe5f9482f33d7f7a939645a012f93490ed5ea3a077e0ede6890a580c0931a1d17b3b74979d5e
SSDEEP 6:7+/l9ogn1g/ng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKN:7+t+BnqLiuWdwRmBEyPbC
TLSH
T11102228D63820822CC1E16B798D883400D10F7198261CB0B25600C9C3C034CCA4A0E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSignal.db-journal

Path /data/data/com.gubuktogel/databases/OneSignal.db-journal
Size 8KB
SHA256 44291fc365e1cc25f6ee732e82e38da347b00149f0421aafed3a7698c80af0e0
MD5 347614f95ab6abb3b999e280e5324a1d
SHA1 d8f1c9e628e461161ef982c0ac10a37f435f2103
SHA512 af28818f2c9feaa467cc77883b1196170ed574168fc65d41ead47dcf1c7f165897f7acd0469b12ac87c8a0fcd050f3b86c54990c27abe8067524636f836ba9ae
SSDEEP 6:7+/l9qPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK8O/z:7+t4qLJdTRmBEyPbkz
TLSH
T1F302228A63400823C01DABB7D0D883A02E10E7148223CB0715600C987C02ACCA890D05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/data/com.gubuktogel/databases/com.google.android.datatransport.events
Size 56KB
SHA256 49cb67743b3cd36b030aab24c0ff48b2bb74a7b6c72b085753517984baecba4b
MD5 2841c9f1e3bddd1ac41132a87955954b
SHA1 bdfd8e42a00554679cfba31a008d8a8c054fc865
SHA512 67300d3061e3eb31322b93166c06c5eca8f14e2cf3a731fcca1d1dc7c0ed9ade57870fbf8bd13e4ae4c42d8497d20e5811df06009e3507c2443536f5d08ee84f
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSw:8MEX0wIyNjaw
TLSH
T13843639D5E2C2221C57E283ED7E143635B7C93DF5723926239908CF98DC2469B4358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gubuktogel/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 2c6ccaa0e95f5566453d57726c60fb486b61946ea385921e18b49bbc2ea5f6fe
MD5 d2148b5c47a69a565df3689963d5633b
SHA1 08c22fbeb37ce7dff7c8666438c6c77a896410c3
SHA512 837a67f6d8dc2b7514991f42711e8c4871ef107164f5160c28852fa200f448ac11b803636ad3a5e852bd3e62564e44cdef73233703d557e45ea7e8e140ddb651
SSDEEP 6:7+/l9Kl4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuK2//yn:7+tAwqLJdTRmBEyPb9y
TLSH
T10C0212896B420D23C9199BB794D983552E50A7199273CB5719B10C987C476CCE8A1E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gubuktogel/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 bee0d9c0edc967d0d39231c28e3050a6f57419cfafc039129f4ae7eab3b96ff5
MD5 6b9b4e0c528d69317a92474f11cf00c8
SHA1 513255faf6e62d554c54ec08f6a89541a90cf0af
SHA512 3e40e5d09c58f162384d2c03384f0aa4c16a85ba5b1153594e5d0bcfe8bba241ac22caabe5ac2d3c1e1127fee678a8994a79865d33d23b86f1523fe3376c3c4d
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.gubuktogel/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 9cfc62398c07e9a49d315c8bf46033153bdc8d6610f40c638f17850b813cfdc5
MD5 bbe056a7779119bed1eeb37158339f09
SHA1 0fe702c2aa0019ff13750ed7f317b31704a6d4f6
SHA512 e7a54b96cf72511a4891b4ad6676e005298b88e8fd54353c658142a1d3ee5db5a6e67801dddd5d413b7bb6ea5e158f73ac474f410c2967bafc2912dc1e67f94a
SSDEEP 6:7+/l9KGGn1yifg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKq5:7+tYGsqLiuWdwRmBEyPbz
TLSH
T11B02C08D63850823C81D5EB790E883440F05E71DC172CB473DE008D83C074CCE4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
TLSH
T11F727DCEDF002202C1360733F4C9D3901D60921D8336DA0767940460AD02108A451F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 ba2c694531143713f27590fdd96d044403fd674a81381c0d16891f36ef063e1e
MD5 cbd26fb0175f250a9afbdff9201a041b
SHA1 b68944037eba498ba580e6e50c810100167aea09
SHA512 a152cb02c90039d668b569686617c9a9a269a7899829579ec50f8b21a2f6c34206e0527aa0f5127fff6eb3b3bb34b0e8731c34cea83e8254a13f0fb9e60e20bd
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6gYf:TLiEy9zmzrfRmBEyPbP/P+/0Fl6/T7
TLSH
T169726FCDBA106703D2734B76B0CFA3E26C34A2188333DA0B7B540978AC42289A282F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 8736aa4fe4b5257c213a775e840f1bc73810243fad605f5337038f5f81043c15
MD5 05707fa9a2dc7b903bbb0bb5bfe4ca4a
SHA1 19edc69d7662bd310cc4aa33a5f3f2f3524e1cd5
SHA512 b2e2541030395ac659579bc1d29586d98346bed010c8b10b2989338a59340da60128b561321259fb5642a2324ae430306d99259e44cc60aa228db350f6503e85
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFl4NK+/0Fl6/T7:TLQpmzr0GSP/h1499FblFa
TLSH
T1387259C97A149703E3370B35B0CBE3D17C3872155733D60779011B2C6D4278A5112F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 159fe8d5902f20a0171d5fa376a8968523517a18dfdd7608238e4412cc185c88
MD5 5f322853415cf3ee2e3faf636a75b442
SHA1 11ce5ebb62c5a92befb3e1aa64b16356adc71dcc
SHA512 2bd6d99712e45b0e57c34f853725722bf4483d4f7aa257b296e1fe9881df30577a0e7732a010806282c62b38ce5f90aaf75781e96534d99c1f7ec282891e5bbd
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/wolhOLauAUZw2qc7UyWlq0jk49blqYFl4NK+/0Fl6/f:TLEvpmzr0GSP/wovKaufEs4k499FblFa
TLSH
T1DB7276C8BA68C602F2B74B39A0DBE7D17C3871625733D70779061B2C6D823868261F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 caeabb89e768ac8a3deef369a1845052911a45e8932cb12c669c0ad3da5aa659
MD5 a91ff659eca2a0ac7863d49d832d8e48
SHA1 4a3774abcc9a0fc84e3f1a06efec17e5eb9784e1
SHA512 62ccd8bd8543499df99499102697cd500f6a558a50eca31e0984fd750f661ee7d4da82d7628b8bb37599df7a7ce8397fd7c4b36b1811a06dfca59a7f8aefe3e5
SSDEEP 24:TL6Xpmzr0GSP/o6ovKaufEs4k499FblFO:T2XArSP/onyaufEp95zO
TLSH
T1B8727BC8BA68D602F2734B38A0DBE7C17C3831224733D71779051F2C2D423868121F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/data/com.gubuktogel/databases/google_app_measurement_local.db
Size 16KB
SHA256 c76dee1bb46a7dbb123274cdd118a5fe1209b8443ef578cfe9073b0f8bfb62da
MD5 5238f29e3049fed162fa439113c71069
SHA1 31f4c91949db1e77fe03e422e22fef350c43eb68
SHA512 2848bec5e8a3a215933ffea967b0d1be4e328518eade3ee3a3885a2227faf18a072be6747a6c541115a3ff58ae4acd94c60e6783c895ec296a98e31270051651
SSDEEP 6:l9bNFlkls1KlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WMWj:TL6EK9zmzrfRmBEyPbP/WMq
TLSH
T15E72C28E9F102602CA670672B4CEA3926D24A2198737AE572AA44864AE42649A091F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download