Craxs rat mobile V1.apk
- SHA256 837b92efaa65bd18df1885dc06401f3edf2609eb51aa85b537f21eda1abc61c5
com.appd.instll.load
Resubmissions
26/05/2026, 11:06
260526-m7g3lsay4x26/05/2026, 10:57
260526-m195tagt8j26/05/2026, 10:53
260526-myzw3aax3v1003/05/2026, 01:50
260503-b89ngaav6t01/04/2026, 10:28
260401-mhz7wses8111/03/2025, 20:07
250311-yv6e8atjx519/01/2025, 19:41
250119-yd7a7atkcm11/02/2024, 02:09
240211-ck4yradd2310General
- Target Craxs rat mobile V1.apk
- Size 5.4MB
- Sample250119-yd7a7atkcm
- SHA256 837b92efaa65bd18df1885dc06401f3edf2609eb51aa85b537f21eda1abc61c5
- MD5 5957b575bb39d2ae9cf18325d754938f
- SHA1 2e7f4ce732c1f7f00b10c929bfcc70753693dfc9
- SHA512 cd332a7d1d9e1a44794f05e866c42c7d0f23d8b48ad56a59ccda877f6e10617073e55afee4289956dca530a2286ba5d3ab00812b43e6b6026873862a448ff849
- SSDEEP 98304:zuq6DHpO1xrQs/y64AJ+IDkaP5LUT2cUxtjnmUKMyhrFZIAFANHg1vTNqE/t:z6DpUFnjkaPxWUXmUKtrFfWNH2L4E1
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Spynote family
- Spynote payload 1 IoCs
resource yara_rule static1/unpack001/childapp.apk family_spynote - Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis
- Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Declares services with permission to bind to the system 3 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE Required by VPN services to bind with the system. Allows apps to provision VPN services. android.permission.BIND_VPN_SERVICE Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards). android.permission.BIND_INPUT_METHOD - Requests dangerous framework permissions 3 IoCs
description ioc Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES
File Explorer
-
Craxs rat mobile V1.apk.apk 5.4MB
-
childapp.apk.apk 61.1MB
childapp.apk
- SHA256 613dfad45a7696818e1fb73d6892bb52cad7231c305f70db1c9cbbbcfab2c76d
- MD5 0b164382ea5279ba6baaa2f0f6fc99af
- SHA1 58bf6ab3f5f854431d14f162e926759aed59e2e5
- SHA512 056e6c41a6bdb0f715a1f46d97da168d135c411dd978295fb73137f2d027f906f1d4601685fa5776f118ec662eee2d85886506237185f44931829ebcab94536c
- SSDEEP 98304:zrp2DuCvLN44WzpF1Cuqmsf5RjaECmzzzBCTW0t4n67Yn:+uCv1WHEugf5gEtzcdb8n
- MD5 SHA1 SHA512 SSDEEP
-
Spynote payload
bob.display.aug
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.MainActivity
android.permission.SEND_SMS
android.permission.SET_WALLPAPER
android.permission.READ_SMS
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.GET_ACCOUNTS
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.READ_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
oppo.permission.OPPO_COMPONENT_SAFE
oplus.permission.OPLUS_COMPONENT_SAFE
com.huawei.permission.external_app_settings.USE_COMPONENT
android.permission.INTERNET
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
com.android.alarm.permission.SET_ALARM
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.USE_FULL_SCREEN_INTENT
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.MainActivity
android.intent.action.CHOOSER
android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.SEND
android.intent.action.SEND_MULTIPLE
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED
com.ui.OnAlarmReceiver.ACTION_WIDGET_RECEIVER
com.android.vending.billing.InAppBillingService.COIN
com.android.vending.billing.InAppBillingService.COIO
com.android.vending.billing.InAppBillingService.LUCM
com.android.vending.billing.InAppBillingService.PROX
ir.cafebazaar.pardakht.InAppBillingService.BIND
ru.aaaaaaax.installer
com.nokia.payment.iapenabler.InAppBillingService.BIND
com.android.vending.billing.InAppBillingService.INST
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rrzojqskyfdfuhyxioaxdqaufjocfjtxjxjfufmbyqinxcizvt20
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.FloatingView
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mtoxzfrorlizymrlaefteqfqfcvqgtassrinrtxwgfkncnyzpr4.CraxsBrowser
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.CameraActvity
bob.display.aug.xyz
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestScreenCap
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.SecondActivity
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.WakeupActivity
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestUninstall
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestInstallPrim
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.installupdate
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.flyActivity
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.OpenActivity
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.OpenChrome
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.nrxeqyeruwwlkfwxlgzindnfwztclkusycrtyykwilyhdztvhd22Over
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestDataUsage
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestVPN
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.oiosatdrmfeyovlqrcrfmbvmiexinftgrejgxqfwzgclynjukj29
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestOPPOB
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestPermission2
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestKeyboard
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.qriffccrtqaivilahtkxvfzthdxctakiiouarrjfzromtjbpnw21
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.RequestAdmin
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.initializeService
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mtoxzfrorlizymrlaefteqfqfcvqgtassrinrtxwgfkncnyzpr4.CameraHandler
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.LocationService
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.AccessService
android.accessibilityservice.AccessibilityService
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.BackgroundWorker
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.vfvtjcghjkhamcygfzbeiomgttwryuaotahaqruvtgsiwutwoi38
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.FirewallServices
android.net.VpnService
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mjabrawfyegoskqejkyntgxbfambbbriscwiecwafkgcqnnyrz27ture
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.MyJobService
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.mumcmsnmtgxmypfnezxsgrriokdyxnsdjrbkrehxjskcdvjzrk3.KeyboardService
android.view.InputMethod
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.CustomReceiver
bob.display.aug.RestartSensor
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.BootReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.ACTION_BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON
android.intent.action.REBOOT
android.intent.action.LOCKED_BOOT_COMPLETED
miui.intent.action.BOOT_COMPLETEDT
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.PackagesReceiver
android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED
android.intent.action.MY_PACKAGE_REPLACED
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.ScreenReceiver
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.USER_PRESENT
bob.display.yzhecnphcqkkyynbmcrsdffmjjvsprhsytftqfobefzjgzysfh2.rgnkbmaiijlcfkknkxlhbbqdlmwuunucqszbtdjqythtsxqljy5.Datareciver
android.intent.action.DATE_CHANGED
bob.display.AdminReceiver
android.app.action.DEVICE_ADMIN_ENABLED
androidx.core.content.FileProvider
androidx.core.content.FileProvider
Android Permissions
Craxs rat mobile V1.apk
Permissions
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES