clayrat | 02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2

Analysis

max time kernel
46s
max time network
150s
platform
android-10_x64
resource
android-x64-20250917-en
resource tags

arch:x64arch:x86image:android-x64-20250917-enlocale:en-usos:android-10-x64system
submitted
18/12/2025, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2.apk
Size 4.1MB
Sample251218-n3acmsf14d
SHA256 02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2
MD5 20d234274302af6e35d60e1be0b43c15
SHA1 a0f658ac4560ed06497ccf46cd119dc496c96186
SHA512 98cf30ae4e4fb23478be2c04673925a075792e01c4029adfdb8c66c00d613e0fa6a967b8b66a9c882c32be6c36d682c7c1edf2dc615610a3a4e25920a777dc74
SSDEEP 98304:/96Hg0SFEGdsjKzJjjeBHLE+G4Q4l8o4RDyJ3n7:/UQFAsJjjeBQ+3zl8o+Dw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion clayrat impact infostealer persistence rat trojan

Malware Config

Extracted

Family

clayrat

http://195.62.48.192:26000/error

Signatures

ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat
Clayrat family
clayrat

Detects ClayRat payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-2.dat	family_clayrat

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft	5158	cxi.wtva9sszh.zimzcje950168
/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft	5158	cxi.wtva9sszh.zimzcje950168

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cxi.wtva9sszh.zimzcje950168

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cxi.wtva9sszh.zimzcje950168

cxi.wtva9sszh.zimzcje950168
1⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5158

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

iet.ft.tmp

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft.tmp
Size 2.0MB
SHA256 650c380a82634577a169dd56cfb3aa438605e0dcf4d4c2ce7a4f3a6b9ef2bbcc
MD5 8df64c4938556feca6d38e8626f337f2
SHA1 2ec3e75b1e9d72988108174f16e76587d7e78e83
SHA512 b8870081fdde73eae124f5b280155a18b1bdf1c250c3cc1f9d442b78ea5536f4ec72a74402a8e8049fdf2e64bd6b6172f66967aacce530070acfe092f3d2a166
SSDEEP 24576:LJG8FM637S+v48pUCCiX37ROPvEx+mr/1N+O3CvVlb:U8yMv48pUQXYVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iet.ft.tmp

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft.tmp
Size 2.0MB
SHA256 51d5084f4531193d1ce48f7f6e17a78e836412e07b92edf00d1b5967a9e65a4e
MD5 e9ba071ac027609cf1af5fb5254a06b4
SHA1 c4e94e351ec392f0d0c76d1a619bd9d470936ddb
SHA512 e71a4aad449f501fcc7fdbacf51e65777a4c5b0ebdde3e0f9b9f9ed1a94c530d48b03dcd82ef37430b3a826f7aef9772553ad8f8ba9041c8c44ce52f138d5ad3
SSDEEP 24576:HJG8FM637S+v48pUCCiX37ROPvEx+mr/1N+O3CvVlb:w8yMv48pUQXYVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iet.ft.cur.prof

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/oat/iet.ft.cur.prof
Size 636B
SHA256 e73bc6f6a3772a898e8de49fa1ab10beae2eaaa1df3df037eaf61e21cffcd423
MD5 0eb677ddedbc726aa9b14302e1ebce0a
SHA1 a96f0d9f80f78a6c095f01f5249f4017f3af71eb
SHA512 1de58d0c9a05010377e313a857b8fc622e36c98deff749585bf5f3b9b2e0dde5091edd148c6b08b749ba4c3a446023dee610d73059f0051169839b75a6004013
MD5 SHA1 SHA512

Submit Download

profileInstalled

Path /data/data/cxi.wtva9sszh.zimzcje950168/files/profileInstalled
Size 24B
SHA256 eca86c623c65a71b529e345e74fd52dcf19938f6ddc9c372842f6a341a4fcd58
MD5 eb2ee4abd7508ad66d7ab9c971aa87bf
SHA1 ad6d905265dbe044464f3f6cdc476bcebac4b886
SHA512 305d0f4851b238f60c4d253b9a093ade0f6432c9d123584d2f799e583ab45194ee6e56e0de7a4d27612046f236027e9365676114a642083ad8a07beb186ddc69
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/cxi.wtva9sszh.zimzcje950168/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 2b31a885dcaf284048e6a591637f7575ca81a90ebf42e4ecc2d14d3353256fe1
MD5 21be829f577da2e48eacc7d28a696121
SHA1 ada5fc9245bb0726ff48bf3b0d6d8a6ed6753fe7
SHA512 65cbe54034a41ef16da5e1db2cb000180bb0307e14e072ed7a34ec1e9bcabb01bb712208f82f77d20d7a272cf88636b37a5a6ec031a856f734290003b0f912aa
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 1bb9d8c5cf79f0c3b9006ae33637b050d2df9472cae4da51730b535b60bb019c
MD5 c5e5199f3a6fce67d55d85e37657eed5
SHA1 57bfb7736cdee27e65a7e67adfa912fd364b373d
SHA512 4c5836a9ad91177ad1cf3884be272adcf90a1712ab0dbcc2e94360befa0380bd708b3f959825fdcb34c48bae31b05fb86343f53baf76c3208bc7dc90dfaff08f
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 cce4ec97144d02256f757363d3b055b0480c427d3b1e734f4fbd57c2ca936dcd
MD5 cdf310eeae57cc1354ccaa3acb81a4e6
SHA1 4637585d3a1de0d5d8f64f8d69ec403c2cc310ac
SHA512 2e7cd1a1caf3240ed5adc9122807c91c1a870188b33f53056697908993944a33d171a2e6399831f70e7487aca3a537eff9ae1460ff716562462ad77197e52f30
SSDEEP 3:Rpdfs7irp4sHwzXtRKVjW8lAplDt/0XllgoqKXtRKVjWn:CirppQ72V5lAV0p2Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 03989997b661cb07d5212b0cefb830fb65e4288da593f792b0206079b21e7b8b
MD5 a0dfdd942889356c9a1594a6bc308eda
SHA1 d5a3b98475f3bf3eb2d7865676dce771b42a4ec8
SHA512 078139d329bd547d77a4457a018396a69ac9a27d17aaefeddd6fa9110143a8215c7bafd396d4212338be61d2e8fa381477bdde92d34e3eb347e3c5115d45e7a8
SSDEEP 6:KWb7bSwh9FZdrlOERX4PBX4ogLugMBX4suuK+/M8t8urtX60ulQ04Ow2:KWj9PzdTRmBEyPbP/M8WuQ0uOOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 798892befc6c47855e8e6c6d7690c3c6ff8f828c91a5afa1af0ff6536d6d2317
MD5 f8aaad2126bc9e42be5dfb9d0d1b6583
SHA1 fc8735a068054aa4431e466412ef00ef7d553810
SHA512 f3c5c0bd15fa955227e2f09b654cb131cb4726f205d1d28d81f3ace17e32ae7295cffd2892f80e24b4cc9c1d516da57186887579ee3b0e0dd494ac653a5e9129
SSDEEP 96:BrpPTWI7WhDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:BrpLWI74ndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cxi.wtva9sszh.zimzcje950168/primary.prof
Size 1KB
SHA256 f725def5c2bd8d76148d0f0455dd58e5b2ab8954e478eed2bce80e86bd443c36
MD5 9b8c7bbdf7a12d745c03275ccc767ed7
SHA1 ea9add657236f84c1df5baa8a510edacbc18fe62
SHA512 7f02aea7408e51f5bbab3cfd0d73ebe933fe0e17b68bba503506c0620772863a5af0954fd073c37e101385b8be6d188a554747808f32f49568d7265c71f63db7
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cxi.wtva9sszh.zimzcje950168/primary.prof
Size 392B
SHA256 d981840155c057d3417dd297e13428d658c62eaf89f62ec3b2fab18107a5d591
MD5 d2c324b5038a459f5f5aa9363eb5b88d
SHA1 b72936f0c6ffce86edcc9ba87954f98a5bbd5c3f
SHA512 e960fe517dd0aabf87502fc8918f726bea122308ebf90166010195de62d4d4903b715c1eafcb2a8b12bbdbf41b29ae3c2dc156700e7909b3beecc5f4fd5a9327
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads