clayrat | 2f0b56e0ac3547e2ee3458a16e027bc83ccbdc82dabd85a2b729a7691e73691d

General

Target
2f0b56e0ac3547e2ee3458a16e027bc83ccbdc82dabd85a2b729a7691e73691d.apk
Size 2.8MB
Sample251104-src2lstrfz
SHA256 2f0b56e0ac3547e2ee3458a16e027bc83ccbdc82dabd85a2b729a7691e73691d
MD5 9132c07966b98ab11d7e023e37731b63
SHA1 ab591aeefc22a67a3c319c436ef5e6b549824719
SHA512 f70826325897b132afa9c03947107d3d719bf5135bb396a5471a26e161c796211507efe39230e46db177dcdd7ee5c80133c489d31b488fec3ee6a7efba7b5a54
SSDEEP 49152:YXkS3+hMZI5CKXUvMAbiRBibEP958VufSsnh2CBPY7yiI9I5IhpBgD73cw:QkQ+hkIakjRAbA2VufHpBSyiW6CA73cw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection discovery evasion clayrat impact infostealer persistence rat trojan

Malware Config

Extracted

Family

clayrat

C2

http://error.clayhusas.sbs:5654/error
http://gelya.claybaster.top/newclient
http://gelya.claybaster.top/proxy

Signatures

ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat
Clayrat family
clayrat

Detects ClayRat payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_clayrat
behavioral1/memory/4192-1.dex	family_clayrat

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.network.project826/code_cache/SsmKhADv.ppr	4192	com.network.project826
/data/user/0/com.network.project826/code_cache/SsmKhADv.ppr	4251	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.network.project826/code_cache/SsmKhADv.ppr --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.network.project826/code_cache/oat/x86/SsmKhADv.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.network.project826/code_cache/SsmKhADv.ppr	4192	com.network.project826

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	com.network.project826

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.network.project826

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.network.project826

com.network.project826
1⤵
- Loads dropped Dex/Jar
- Requests changing the default SMS application.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4192
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.network.project826/code_cache/SsmKhADv.ppr --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.network.project826/code_cache/oat/x86/SsmKhADv.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4251

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

Lateral Movement

Collection

Protected User Data

1

T1636

SMS Messages

1

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

SMS Control

Replay Monitor

Loading Replay Monitor...

Downloads

SsmKhADv.ppr.tmp

Path /data/data/com.network.project826/code_cache/SsmKhADv.ppr.tmp
Size 1.7MB
SHA256 de634b5c0979b4a0038ca7fe99d41188095f8220fb7c59e2a56e1bf3d22791a3
MD5 b34111abeb0542314d30d90829801154
SHA1 70c78294bf5f13c734e4ee4975c8c036fb2aeb36
SHA512 aa9d9c464b25bd8fa7d947d4187318cffa8c0b22e6fa3d34ee07638ac5ad7b8f1ca1b0218db1c1a989b4bfee2da11ad98493b22e59fecdf0cd14603555f7e57b
SSDEEP 24576:RDl2X1AlZgAqGHa6e4B008po/pmwZRSnQLMaE6L:eWT008pogcMQr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SsmKhADv.ppr.tmp

Path /data/data/com.network.project826/code_cache/SsmKhADv.ppr.tmp
Size 1.7MB
SHA256 7be8254b09aa3ced19a1a452e6a933ca6aae2d80be809169daa1db69f6a9b7f8
MD5 eeaaca2046621267a39e009dbb3afc21
SHA1 20e942d7e07f60a935291e1aac88bb85c00eaf62
SHA512 061f03d2a21dad33c3435c1a39dab9054ed2484fc60d8b0f854c69e6c684706fa580cbfe4ee2583e82feed641f461c56c3b51dc79ed5d6d8659cc8e7bddcb051
SSDEEP 24576:NDl2X1AlZgAqGHa6e4B008po/pmwZRSnQLMaE6L:CWT008pogcMQr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SsmKhADv.ppr.cur.prof

Path /data/data/com.network.project826/code_cache/oat/SsmKhADv.ppr.cur.prof
Size 1KB
SHA256 dcc2e2e0d2d3c1d08b63aedd02bca64180e8c077b23bb5988f79af47ccdc6e87
MD5 3df99c8357e9443a606f62023dd40857
SHA1 ca79d97fba249a685eaa5237ced8e6dcdf84b498
SHA512 fb0f77baeb43a1ed791925ac6621ffe622c97e12ab3df3ae349347ae6b7cc6a51c9e88e76d158ec6c444b12b282012e63eb65d61712227c8060a84ad6bb4364f
MD5 SHA1 SHA512

Submit Download

profileInstalled

Path /data/data/com.network.project826/files/profileInstalled
Size 24B
SHA256 a0d06375bf4d9c7bc381d46fd0f00b3647f4cb61b94b3e9f89d7c1fe562e00c2
MD5 cd1f48e545ccb6a98e0dc11d48442417
SHA1 bf30e8376819ab452398f42818a87e24d2ae4fc3
SHA512 80b2ac6aa81ab567bd73d6108e217d6dd8823526fa6a016900b298a4679a699b2d7ba3bd8575c9dcc97e7f24b8f9d74165eb12fb759fafc7b1a4f32dbf95ad55
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.network.project826/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 0b0609ba681968fabeb96bed6ea8c8fb3e71ee40a11b7a2e4ec8d70eb2d49ecd
MD5 76a14a7ee7b3d73f1fe9bdc31c37166a
SHA1 8d145c6c1d577f03284db3bf5a5e91e5d3f051d1
SHA512 1927336abff461e5a9872ef112fb1cc56b832e63c04ddcf0d2e7e46942d5f40b6ce37ae054bb2f154dc9f111a4655ea0479abd4ae6a862ef3e617af5f84888e6
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.network.project826/primary.prof
Size 195B
SHA256 3a5534f7873f53d0337999c301cc9e3bd46afd5b442a135215548acb30949f99
MD5 95b57b81cafbccfaa3b2ddf4dd1cfc69
SHA1 5eeb337686b770e69f06c78ef53158652abc1a12
SHA512 17e93f3dac105a67f28214cbfd18491d4d4ce2fdd0c0f70d4bf19b528e05d887c3bc8c6f9ffc1afccd8f3c0dc9121f421fdd8b881714626a1c5906ff288fc0c9
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.network.project826/primary.prof
Size 1KB
SHA256 0d97b53648e4b6326f27540944348d528a3744baaf97c101278d328702282e86
MD5 0f91a1716703a033bfa11b5bd387f7aa
SHA1 9be70b84f7bb070fd0af44c0e6b3dab8d00cc4a0
SHA512 df0873af73eac9223a232ae6863f1fe01561c102af3ee02795e3c9f832145e398b8cd832c730821903cc216b06c71952674fdfd72617ddcb957775f9bbd8fdb6
MD5 SHA1 SHA512

Submit Download

SsmKhADv.ppr

Path /data/user/0/com.network.project826/code_cache/SsmKhADv.ppr
Size 1.7MB
SHA256 e01400e95331822f8ea439d78b3ec28d88ed13270ffab460265edcc4143d679d
MD5 3ea6dded4a2498b045a5a2806f5a7083
SHA1 5ce85e86cf525e5da90cf55830cce65c4aa7cc4f
SHA512 460528982cb50f057e1b656687de6fe5f2dee76cb42aa1f8f0f904082526856019a74945285d5ac72e59c3b0f131e3adb0118e92ef910ed7de354194b7f4e4f0
SSDEEP 24576:NDl2X1AlZgAqGHa6e4B008po4+9g6KXd5E6L:CWT008po42Kt7
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads