Overview

overview

10

Static

static

6

2f0b56e0ac...1d.apk

android-9-x86

10

2f0b56e0ac...1d.apk

android-10-x64

10

2f0b56e0ac...1d.apk

android-11-x64

10

Analysis

  • max time kernel
    123s
  • max time network
    168s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20250917-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20250917-enlocale:en-usos:android-11-x64system
  • submitted
    04/11/2025, 15:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2f0b56e0ac3547e2ee3458a16e027bc83ccbdc82dabd85a2b729a7691e73691d.apk
  • Size 2.8MB
  • Sample251104-src2lstrfz
  • SHA256 2f0b56e0ac3547e2ee3458a16e027bc83ccbdc82dabd85a2b729a7691e73691d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
bankerdiscoveryevasionclayratimpactinfostealerrattrojan

Malware Config

Extracted

Family

  • clayrat

C2

  • http://error.clayhusas.sbs:5654/error

  • http://gelya.claybaster.top/newclient

  • http://gelya.claybaster.top/proxy

Signatures

  • ClayRat

    ClayRat is an Android spyware first seen in October 2025.

    trojaninfostealerratclayrat
  • Clayrat family
    clayrat
  • Detects ClayRat payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.network.project826
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4883

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SsmKhADv.ppr.tmp
        • Path /data/data/com.network.project826/code_cache/SsmKhADv.ppr.tmp
        • Size 1.7MB
        • SHA256 de634b5c0979b4a0038ca7fe99d41188095f8220fb7c59e2a56e1bf3d22791a3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SsmKhADv.ppr.tmp
        • Path /data/data/com.network.project826/code_cache/SsmKhADv.ppr.tmp
        • Size 1.7MB
        • SHA256 7be8254b09aa3ced19a1a452e6a933ca6aae2d80be809169daa1db69f6a9b7f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Path /data/data/com.network.project826/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
        • Size 8B
        • SHA256 0f5aa83779312ca9c63813a0c9fa2f466b297c89dba8617f02363126f55abd36
        • MD5 SHA1 SHA512
        Submit Download

        primary.prof
        • Path /data/misc/profiles/cur/0/com.network.project826/primary.prof
        • Size 1KB
        • SHA256 0d97b53648e4b6326f27540944348d528a3744baaf97c101278d328702282e86
        • MD5 SHA1 SHA512
        Submit Download