5e74bb4d2abf135c04247363d431a291fe16ba99dd183130414a83746e38e610

Analysis

max time kernel
100s
max time network
151s
platform
android-10_x64
resource
android-x64-20260325-en
resource tags

arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system
submitted
07/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kryoto-Mobile_0.2.29_x86.apk
Size 10.3MB
Sample261107-2rf8psgt8k
SHA256 5e74bb4d2abf135c04247363d431a291fe16ba99dd183130414a83746e38e610
MD5 1d592b1fb99df082107171cbb6bf3c30
SHA1 c2ad96d7ea8ef46c207a8cccb96df62f5dfe6b2b
SHA512 d43437eeb457407dc0a78476b470cfdc7a568299c9237c8217beccb43049ac2ed6e5c039c78d594516f47701e879693938c9b87f29dc0d6e6639bb4b9da9fe7f
SSDEEP 196608:A8Eo1jcuy54w7BQOJZNTquQaYHYmYqEyDnC:A8Eo1kTZNTDQ/HYmYEC
TLSH
T1EBB68D84F76D42E4F13614F8E20EB132FE350C6A84BA92D7EB4ABB819477150EF554CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	to.kryo.mobile

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	to.kryo.mobile

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	to.kryo.mobile

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	to.kryo.mobile

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	to.kryo.mobile

to.kryo.mobile
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5026

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

profileInstalled

Path /data/data/to.kryo.mobile/files/profileInstalled
Size 24B
SHA256 38b7b0c4e5cb98fd67b01a52aaf2b7f012da557ddce7c8b617510d007a2fadd1
MD5 d58502f14aa976498d27fdca7045f784
SHA1 b80fd66c7065d5bd806c07bf8113c1918ec953b8
SHA512 4a2065175436187143ef23a2dbce9addae832d266ccb66461a7bcc4be0a9f7835dfc53f4cb084e8cc8b4ecb2f8964b273a591aedf5ba532a0905ec6f7df3bf6d
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/to.kryo.mobile/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 c9cc665853f62aae50f9ce6dbd103edd79cd89e7c9c4b50007837b1bdd0b2f55
MD5 cb46f720992930ef3c572f4fa67c0810
SHA1 8c0af6d7b91950f788a09ef3a1a3512445670875
SHA512 869723f777b26773265398ae02b637ffc2f2229da712f6dc459c2be56fd5dd15659fe3c8568ae80a39f4899bfcecd1bc852c77a7b132963aa38ba90528fac686
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 45755c929f59dca36b3467598d99ee3837cd5505fa47c8d2e681897bc71008e5
MD5 d913f97d0e260c2b8579363806d0fdac
SHA1 f2b978951c28a54bfc20056416ceeba6a64d4cb6
SHA512 0dd261edb86295afdbaaef7440a86e03a6793fc5705283798cc69258a6a7889415023c4dc2e18abd9688d3c5f4798371bf2f059d01f4cfabd332bd61ebdf414f
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 4811f7926b1ff0e4aae1d6d9f9384a9a64a5875ec1776d7c871909c4f8cd7519
MD5 3878035caad5ef6d392922f3d0e79d2d
SHA1 4684e78c25ef13f44d0ea84dfbc56d87544e37f8
SHA512 9c715b40b93dfbf43b0fb427b213f37dc66259262ab2d3dbb8b622b81cfdf615e309f511e7d1c21aba45c8335d403a9238043ce2446e4e0afb2c5ff133ec62eb
SSDEEP 12:KMGfDDfDpzdTRmBEyPbP/HfDlLDX5wSbdiOw2:K3zyGSP/BKS+2
TLSH
T1C872C28763812972EA6963FF94C6D3419FF1D608936AE70B1A1098146C02788A454D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 7bfe0ea5b811df786c64561157410dd382a0f8e9efab2acdede0b9cc541f1810
MD5 0a9e9d7269091920e2a9537d911077f6
SHA1 19f2dcd579033132f3ed78c5bf6aeaed5ea5c250
SHA512 e9de7585c38591aecb140af5d72fc9444e10c12680c0ce339f1eaa5ae6079f3db1233434ded5f494d6fd7df64f4806cebb1c29aa40f3233b69a1ad2c5ce8b101
SSDEEP 96:pgGoj03ATb6+etidjnZRWzzb8/KeKcK+zSMtKz+eD86u0ExV:Wzj6BtidjnfWzzb83zSV+eD86u0ED
TLSH
T143C3338F0F592620C8B954F0E4D04BA1BEBEC11E97A7F3D1669140B5ADD2821DE29CF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/to.kryo.mobile/no_backup/androidx.work.workdb-wal
Size 124KB
SHA256 9a70214aed98f2602835e578f0430e8a12527b824008758746b56c0df1e7759d
MD5 2ed6085da4984fad71305943c86b6996
SHA1 98dfa93857eeac57fbf4f84d0378f3751be60249
SHA512 8bace8963c57110d39a49db8f2c18e0ead43940102fd47b1271f92c26047797c33deb69166b16163cb35547e709b154083b8b91f994227887b031a7c67d962f1
SSDEEP 3:xeGqkDLwje4/kHwzXtRKVjWPOll4WaN7EjnNd0XllgoqKXtRKVjWn:YGfDL8e4sQ72V8Oll4P7an0p2Vq
TLSH
T1A3C392E32714D837CC6117FDED2FE69483A6CE0446ACBE719A096E602D003A80164021
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/to.kryo.mobile/primary.prof
Size 5KB
SHA256 e44cc5f0c31ebdb60f3df1d6b107007907241d3463c5654d00b5b83d0fc08868
MD5 3918326cb814798ba05f22e67a5ed6ee
SHA1 c3f5cdfdc4d2421ba52ae84cc5f2a2f97d6ca44d
SHA512 d185dae3e3f90843e467d6150ddbac335dd0757a753eb692e64ed312834f59046cc88c96d547ad30bcc4da88fd336a299a7e80872e12c2223c8e8b89a9c2b1cd
SSDEEP 96:3yX4zYYnKFxyIWo7Q6Z1PB/qTpep5hX88gPiuqXSbA5sMN5b9ol5d8zukJmTWdZq:w4sFWJ6Z1sgp5VBYiuN0SMN59UcQlH
TLSH
T1E7B18DB9C04BB02FDF2D211EADA26E7D6D73513378BA1D4C4CC8C115910D39EA45DE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/to.kryo.mobile/primary.prof
Size 1KB
SHA256 691dff257b9fb7e2ed9ead3d9eca5a0170dd19d7e8c446096e7cec89300d8a69
MD5 7e1f7bf7a13bd4b5049b585571d8fc14
SHA1 3c6cf462ce6d8ed5362ba10eac2c0b57f40446f3
SHA512 64bf51f4e74afe6252ad3ea072e6ff255abd751f38b12793196e2e5e05f23ff8d02a3728683c5dd7f89138ad8a8a510121f4da0b764d8f59629608f6261449e7
TLSH
T141412C8D974138A14076DB0383672A5E83992C700257C774979E7913CB43CFA01DE693
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads