6041e90299b643ba2ea952bb10bf03187184b9e92102ca18bf7d50146a6056ad

Analysis

max time kernel
46s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
07/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kryoto-Mobile_0.2.30_x86.apk
Size 10.3MB
Sample261107-2rbm8ast8l
SHA256 6041e90299b643ba2ea952bb10bf03187184b9e92102ca18bf7d50146a6056ad
MD5 56b7605600ac88a994248b32b32e5560
SHA1 f56ceadd69e9e82e29eaf78234e3b7879464315b
SHA512 fa955bd4019c0d28506878b461f884648dfaec54a1ea8ec18bf3105581746692df5c1c443b690e2c510611543f01b33e8af10a8f769ae00f55ddf237f1e2c845
SSDEEP 98304:brLo80WMUIPowlJe3/1MtEK6L3QBu7jZN2+38GMcEYF8/ojptYDJOXKWqfmjKy/q:HLoVWAwwcfKqhZNdMGvEY1YejKEznm
TLSH
T19CB68D84F76E42E8F13614F8E24EB132FE350C6984BA91D7EB4ABB819477110EF554CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	to.kryo.mobile

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	to.kryo.mobile

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	to.kryo.mobile

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	to.kryo.mobile

to.kryo.mobile
1⤵
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4388

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/to.kryo.mobile/files/profileInstalled
Size 24B
SHA256 a0ab16decd8187f6e83130f2fc9c2ed11418ae4aa840482feb885fd546fc0a8f
MD5 2dca015aed64a1122c79857528fa7585
SHA1 1ed6b2d2b32e31a99177c7b120d35adfa5ec3440
SHA512 3783488f5818afedd44269bc27d0146019d6ee7ac9a4e71f9f1836ee189779448a230d3b176aea7cef40039955d1941cf5d16e5450b2e316b5508b89cdb07151
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/to.kryo.mobile/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 766249fc1cd92cb945aa0ae1cc192821507b9c4a4252012c51aab8d7400fb31f
MD5 0e7de30394f68daa6573ffd4a7f06f3f
SHA1 09d8fe716de47c88a050c4f1a2375f56ecbd691c
SHA512 11a50dcea08c18ae95a3bcdbdd876838011e226a40454552582f32672b4c8ca58752f72c27ce76b6c02ac42b0aec31c0d1ab9ca8d11d765878d9d68db1c64573
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 5d921fd3851bca5c52b0c686c6ab84e4e360eddc59bf4d75367a013f84bdea19
MD5 c392eb1b00647ae8a51f1ea905d4f840
SHA1 b5e9679bec80b6176b7f7c0a1fdb5c1e34c105ad
SHA512 546294a7afcb357d560e49b841ae0c8ede43acdb113905346e67931476c57b27ec94b86b63246856c1c799bde6b0c6a3a924195a200dda45eba9eeb124971635
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 052f1be88580bbf1a0e53eb46a70db4341329b42f0c6b0d120063b8aec74f604
MD5 0619e8afec38d15962adf42112afb1ec
SHA1 c10a2b6115a9ca11790dd548d7a4dfdb40026f47
SHA512 a5987e55bd2bed586229378400b6545a273d731a9dac23201dfbcc353da3c3122328eb47476719a7e4b3fb3b228495cae24945c3a5d87980823b1f7be3b8d0b5
SSDEEP 12:Kvn5vqPnPzdTRmBEyPbP/BnIXalvJ/Ow2:K/5SfPzyGSP/RsalRH2
TLSH
T15672C2A053824B93C64547F2D187E31B3EAC5B189753D78B5611289C7CC2EC8E160E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 f97435d797e5cc8f3d39d00e9d6817cd3d124a10524b56e91ee3448db9ab3d3e
MD5 2f47c703c251f762a046aa3aa738c1c2
SHA1 ffb7900c13f3b5c299a2fda8f29e2d82e1755b18
SHA512 c67bf49bc83894f35734765d6d6a0c3e4841625a00217cacf1b0b944764c6089c1bce081dbc27728646068dc9e615eaa6786bd065fac15b1468d04e9aa7bdf26
SSDEEP 96:SQGdu5mse5t3iywtvsGLUz/5KAw46+etidjnZRWzzb8/KeKcK+zSActKz+eD86ud:3YktidjnfWzzb83zSY+eD86u0ED
TLSH
T1CEC3429E0F5A2740C0A954F0E4D11BA27D3E452ED393F3D2259110F9BDD2D21DA29CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-wal
Size 124KB
SHA256 fc004c618bd492671f928627b54f5874b3cf132749467827752ffa84b292a139
MD5 74efbd2caf59543485f66b274fd2b40f
SHA1 852f597d9d8f3c906fd05bb58f180380cae8c575
SHA512 7fb13e8a6689c0a001fb4f90fa7070da6058adfe8a97bca8fbf583d616d684ee21e76e9b2dc89d046233691e48e251d302ef8b7015ed216f1e4b6c0d3ad9fca3
SSDEEP 3:xgQnabxXX9wzXtRKVjWP3xOllD8EnaWGEc9h0XllgoqKXtRKVjWn:mQnabR+72V8U/ZnaNv0p2Vq
TLSH
T14CC392F316269657D05007BCE82F76D9B14FCD00C2CABDFE6C092DA9B888E886521051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/to.kryo.mobile/primary.prof
Size 5KB
SHA256 8d5c9712db9bf47bf103fe5abcc44930baf2602ad9340d1ad4f9365529480a87
MD5 2ffd337bf143f91a50fe27417b41aa87
SHA1 00846b9864f59e1991fa95c106ebeb5cf745294e
SHA512 7fd24967a2b985e04b1ad103302f0c21f4a1e09f48d5a2abebd9fb68d16aee864aa4f7e94320cd3849837ea7a0097efe9a25445810677e688650fc547abfecfa
SSDEEP 96:OGigpol1I1Ug1kHfr76zBTakqduIj2EfgdLnuRf2wQWWqngy0/Qmykcs124OPYg1:O/g41g1M76zckqdumgtuGWWqg/HhLRDI
TLSH
T1ADC18F6A9C51D7D373E028D82B45C34D6E8C7D94A8E16271DDD903829D322C8F09FEAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/to.kryo.mobile/primary.prof
Size 1KB
SHA256 b58151ba36c5f6e1c4f93565d934aeb3cc4058d57afa3ab77fe92e25b738970a
MD5 17601393794ef0abbbf130c1754eb806
SHA1 5c2d24fc68d990ec2344276201775249a92c6562
SHA512 fd3e99fd41c525907bbcb55f7258f5f1fc2c7ec2421f69340efe15b5322b72705b709e77d35049574c314e75d534fb7beedff1404b82992f684a75c422e5bfd8
TLSH
T1954128408C1D138B8F6AC522515393F72FDAC62E44B74B36981E03AB95680A6968CCFD
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads