clayrat | 2625df6b52a737543cbf542325dfcfc6208d2be67c4aa0cd26b6a0e3aa5bdb33

Resubmissions

23/07/2026, 15:47

260723-s8j69afl6110

07/11/2025, 07:33

251107-jdl8paslhl10

Analysis

max time kernel
149s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20250917-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20250917-enlocale:en-usos:android-11-x64system
submitted
07/11/2025, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YouTubeGG.apk
Size 5.3MB
Sample251107-jdl8paslhl
SHA256 2625df6b52a737543cbf542325dfcfc6208d2be67c4aa0cd26b6a0e3aa5bdb33
MD5 91639eecdb4db1b4041e292b5587ef0d
SHA1 5e15d5c504676dfff05b6aaa3366563ebd8ecd11
SHA512 58dd3ec52ac70de8d7bd3b5bf8118a1dec264f41819d9d9903ca38b85d51f5a03e00ca6280b4719fc8bc318369457b9fef30d7af9de879362f6a7e9214ed155f
SSDEEP 98304:OJkzMPAaOZjMn2PMhNnXq1WXS1eJ0qtSpoFh3nP0ZEsjBQu2AuGgVx3NsfBk3qG:OqAP8jM2PMh9q1YC65SpoX3MWQautvg7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution clayrat impact infostealer persistence rat trojan

Malware Config

Extracted

Family

clayrat

http://lite.trustnik.sbs/huy

Signatures

ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat
Clayrat family
clayrat

Detects ClayRat payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-2.dat	family_clayrat

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/tind.banqrudbhte.p8mut9185/code_cache/fxLk.lepc	4861	tind.banqrudbhte.p8mut9185
/data/user/0/tind.banqrudbhte.p8mut9185/code_cache/fxLk.lepc	4861	tind.banqrudbhte.p8mut9185

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	tind.banqrudbhte.p8mut9185
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	tind.banqrudbhte.p8mut9185

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	tind.banqrudbhte.p8mut9185

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	tind.banqrudbhte.p8mut9185

Performs UI accessibility actions on behalf of the user 1 TTPs 10 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	tind.banqrudbhte.p8mut9185

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	tind.banqrudbhte.p8mut9185

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	tind.banqrudbhte.p8mut9185

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	tind.banqrudbhte.p8mut9185

tind.banqrudbhte.p8mut9185
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4861

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

fxLk.lepc.tmp

Path /data/data/tind.banqrudbhte.p8mut9185/code_cache/fxLk.lepc.tmp
Size 2.2MB
SHA256 c141b0ce52f02a1477a3fe01a7fbfd3953a4b5a1de6827df07e15281ec640aa1
MD5 35dbc5a9e1f0fd39dc3094eeca4f6971
SHA1 79787a4a2bba64b349ecc53e192a1213d23481bc
SHA512 be4a2219bb1eaabfb58f768757fc715a144d6863b9ca8b7f2d8164fa756be6d1e199f46902542490b0548ba1e9cdbc0122cd83011ef4fcd5e4f1d9fdd84e8049
SSDEEP 12288:aeblvyYly2XppFcxp5KP8pqqdfXk+w+bEgu90gyG+5u6XTWdeMPAoOPveZL86+8T:jlDYpYP8pqK1DGDjOCqEtVAu3HhPXop+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxLk.lepc.tmp

Path /data/data/tind.banqrudbhte.p8mut9185/code_cache/fxLk.lepc.tmp
Size 2.2MB
SHA256 549efff9e79faa75e55f9ff8c311adc0f3cf54a2b1ecfde4aa2dd0112e7acba3
MD5 2f94caddb76d0389c294effdcadd255d
SHA1 ceda84c5cd57bd99a902f97119be9ead5b2ff638
SHA512 58ef70ccd073de9fb19562eb04d80fae992fa6feac4d6e541a6a0570ec9eb4aa7aaf35fe8466b90a6431fbad8fa60647583ebf5710243c9e07e4f389cc511424
SSDEEP 12288:WeblvyYly2XppFcxp5KP8pqqdfXk+w+bEgu90gyG+5u6XTWdeMPAoOPveZL86+8T:vlDYpYP8pqK1DGDjOCqEtVAu3HhPXop+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxLk.lepc.cur.prof

Path /data/data/tind.banqrudbhte.p8mut9185/code_cache/oat/fxLk.lepc.cur.prof
Size 2KB
SHA256 d407aeb30010478cd3d0d1aa5d68fcc189f1f6143089438af15651f0646ab2b1
MD5 4fd8d404727cf3e698474ac5ad0f1f4b
SHA1 4f438e9ab3b9287f0cd7ba0d5ee7584f4ff30ce0
SHA512 3beb343af9291156ef1e448d69821853a43bd66005b176019a5f7341621fd6b42bdd49e8f5e00c00357ca08b96d87dff2296ae5f36d69b5ccb6ff01186866b68
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/tind.banqrudbhte.p8mut9185/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 a9417d4b958fac276aa140739157123150772c2fd386518a7ad3877a1f498cd8
MD5 eeb889593ac8920b72fe1cd9054948d5
SHA1 dc3c29d0eb454a6910f120ccc1903f1c93100c24
SHA512 5c25a6fb9f02456ad6287e05e9395ad3944c8e82dcb3f63c450ecc6578782093eccbaa152beec4382501d465e40e3156a914511c64c0ad66ab46939adda1138b
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/tind.banqrudbhte.p8mut9185/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/tind.banqrudbhte.p8mut9185/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 d7177c9a46753e20f279774594351e670eb81046f646fe12d24ad86d1f56bd4b
MD5 fdab3f855be675af1f16c885232d5673
SHA1 5b9fc60dd231070df7ff4bb0b755c3f04ec0d01a
SHA512 6977fb8344ddd378cc1f915562361493c598048976716feb5fe5d40950823c9ccd66302b7f8bf899f0966732871405a736e77da0ddbe2a2a8e95bd09f7187698
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/tind.banqrudbhte.p8mut9185/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/tind.banqrudbhte.p8mut9185/no_backup/androidx.work.workdb-wal
Size 285KB
SHA256 59d7bb6a77cb523027de79cdb736654a6301188042e2e1465c0c76a78cbfaca9
MD5 dcc849ea540fa1bf355e4d2185cac4ea
SHA1 bcb42b7785e7462c9c106c6a00f17dccaa0b3b1c
SHA512 49c47c354b10a5c8b9a3d8b77b48827ecc821447db7fdc132c7fba4e794e0722e8c8e26f300f0ec758cfbf1abd306ab8aae713e33b3ab6fec126cd867ed9ae39
SSDEEP 384:pf13MD13b13q13WD13WJ13O2J13Tc13Lh13xn:z3I3Z303WR3W73l73Tq3LD31
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/tind.banqrudbhte.p8mut9185/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 0609459c78fa0acb325c64e1115632d795daa4c7b903cc8793ffd9c8fc08e294
MD5 56246b695ef36ef8ee52a1f205275161
SHA1 5e598b1ffe3be9d663d9f7abe6b3a5a954ffa173
SHA512 b39d8fe3a69085ed72b1facf83db2f623590f7b7a1b92e626c5d24b598b32e22f89cc47139c7bacd4c61a9e728484a9357cb1a29b89481a8b4baf568b81eb0fc
SSDEEP 6:KKUELKS9FZde/kPlOERX4PBX4ogLugMBX4suuK+/qDADtOOw2:KKUELKczdeWRmBEyPbP/y3Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/tind.banqrudbhte.p8mut9185/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 cd6fb0dfefea5c57a3589c41a425f3c636577bd98ce602caeae5d0b61ceba319
MD5 f7af510147f51382594e391376ac0c14
SHA1 221db3ab997c2d3b7d490dcd38c173c4b48a9569
SHA512 9451490aa00e80319e21504610bcb8ad5b437e06a9cf3f31d7bfc527f992a58f5d11de3b402e9f558a27eae51ed663ffd7a7f7a2a884c9232e04971a8ea233c7
SSDEEP 96:eFX3z5WeDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:el3tbndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/tind.banqrudbhte.p8mut9185/primary.prof
Size 1KB
SHA256 ddc736880a7bd64d022ee485ac7340d1fb320f152b8dc5fd15ceaf1bd7622246
MD5 6988e17ce1e79a76c2e1ca1fad11aed0
SHA1 1f50924c9eded6e603e351884a795fe8b65ba9a9
SHA512 898b5c1f75943483aa20ed75a87f81800362e96fde7b959c6c2fc676eb44227bcd8d493b8c74487b263f54a63bb9377d69fc151c63583e3d9a03e554eecb6faa
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/tind.banqrudbhte.p8mut9185/primary.prof
Size 357B
SHA256 c5b1d8f56b609d2cad1b130411e62bf899ee0af3e0da7eeb62dab750e54bbaf7
MD5 79b568a76b720577e86b56168ee83317
SHA1 9f08639762197293dba1c611d868e95b7ea79a91
SHA512 40f9797a3957254e0d6652606a76c37f2a9ec33a1654542e974f3f8865bc1417172152d32f4f824fa46686b6a8a626e88833cd4f56715b053cd317569e5fd451
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads