Technical Analysis of Copybara

This document enumerates the command set and functionality of an Android remote-access malware that communicates with an MQTT command-and-control server. The table maps C2 commands to actions including remote camera and microphone streaming, screen capture and streaming, keylogging and keystroke injection, SMS/contacts/call exfiltration, silent app installation/uninstallation, locking/wiping the device, notification and app blocking, UI automation (clicks, swipes, gestures), and various overlay/lockscreen manipulations — indicating a highly capable RAT designed for persistent surveillance, remote control, and data theft.