clayrat | 02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2

Analysis

max time kernel
45s
max time network
152s
platform
android-9_x86
resource
android-x86-arm-20250917-en
resource tags

arch:armarch:x86image:android-x86-arm-20250917-enlocale:en-usos:android-9-x86system
submitted
18/12/2025, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2.apk
Size 4.1MB
Sample251218-td8rssbs9h
SHA256 02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2
MD5 20d234274302af6e35d60e1be0b43c15
SHA1 a0f658ac4560ed06497ccf46cd119dc496c96186
SHA512 98cf30ae4e4fb23478be2c04673925a075792e01c4029adfdb8c66c00d613e0fa6a967b8b66a9c882c32be6c36d682c7c1edf2dc615610a3a4e25920a777dc74
SSDEEP 98304:/96Hg0SFEGdsjKzJjjeBHLE+G4Q4l8o4RDyJ3n7:/UQFAsJjjeBQ+3zl8o+Dw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection evasion clayrat impact infostealer persistence rat trojan

Malware Config

Extracted

Family

clayrat

http://195.62.48.192:26000/error

Signatures

ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat
Clayrat family
clayrat

Detects ClayRat payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_clayrat
behavioral1/memory/4228-1.dex	family_clayrat

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft	4228	cxi.wtva9sszh.zimzcje950168
/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft	4261	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/oat/x86/iet.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft	4228	cxi.wtva9sszh.zimzcje950168

Requests changing the default SMS application. 2 TTPs 1 IoCs

collection impact

SMS Messages

T1636.004

SMS Control

T1582

description	ioc	Process
Intent action	android.provider.Telephony.ACTION_CHANGE_DEFAULT	cxi.wtva9sszh.zimzcje950168

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cxi.wtva9sszh.zimzcje950168

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cxi.wtva9sszh.zimzcje950168

cxi.wtva9sszh.zimzcje950168
1⤵
- Loads dropped Dex/Jar
- Requests changing the default SMS application.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4228
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/oat/x86/iet.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4261

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

SMS Control

T1582

Replay Monitor

Loading Replay Monitor...

Downloads

iet.ft.tmp

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft.tmp
Size 2.0MB
SHA256 650c380a82634577a169dd56cfb3aa438605e0dcf4d4c2ce7a4f3a6b9ef2bbcc
MD5 8df64c4938556feca6d38e8626f337f2
SHA1 2ec3e75b1e9d72988108174f16e76587d7e78e83
SHA512 b8870081fdde73eae124f5b280155a18b1bdf1c250c3cc1f9d442b78ea5536f4ec72a74402a8e8049fdf2e64bd6b6172f66967aacce530070acfe092f3d2a166
SSDEEP 24576:LJG8FM637S+v48pUCCiX37ROPvEx+mr/1N+O3CvVlb:U8yMv48pUQXYVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iet.ft.tmp

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft.tmp
Size 2.0MB
SHA256 51d5084f4531193d1ce48f7f6e17a78e836412e07b92edf00d1b5967a9e65a4e
MD5 e9ba071ac027609cf1af5fb5254a06b4
SHA1 c4e94e351ec392f0d0c76d1a619bd9d470936ddb
SHA512 e71a4aad449f501fcc7fdbacf51e65777a4c5b0ebdde3e0f9b9f9ed1a94c530d48b03dcd82ef37430b3a826f7aef9772553ad8f8ba9041c8c44ce52f138d5ad3
SSDEEP 24576:HJG8FM637S+v48pUCCiX37ROPvEx+mr/1N+O3CvVlb:w8yMv48pUQXYVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iet.ft.cur.prof

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/oat/iet.ft.cur.prof
Size 862B
SHA256 231b2566f63e5e45089bbd6ac1ea78f10e1389a339f18e60bb26090472579c01
MD5 24e8dd9c2d0e95fde8108546576c15b2
SHA1 afaaf493cc6eadc9814c068aba88f3c35909af0a
SHA512 99643da490840210d3ea69d07c36e328573be01dbd7a2c412ad416fc77b1f0a061be81e5c212af170db00a9cfaba7fbaeca24133a454024585fec9da3130b3ff
MD5 SHA1 SHA512

Submit Download

profileInstalled

Path /data/data/cxi.wtva9sszh.zimzcje950168/files/profileInstalled
Size 24B
SHA256 983d9080e62adb3ae23f9e6b4b0b895c36e9d078ba91fddf17f5d0205fa8b10f
MD5 252cae3917fc444f01912bf8717bfda5
SHA1 0315186b8e9baf5b16788c25410931f04e724e3b
SHA512 22fef26d730c5c76acf56100ccb34872065aca183fd8f89d91452ab0c57a702b148e6d93660fa1483fca2e8df0bccb3f7b8790f017d5c5b2a1643d5f3d3feea2
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/cxi.wtva9sszh.zimzcje950168/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 f7c59c917bbe683d24c139ba6f3c98d5bd26f273f8bb1b0152edd39d838c7cbe
MD5 0de8d498c878e0befaa9563e5d12cdd8
SHA1 47dca7d4cc9ad08355bc2096f07c0ab9e3f8ad3a
SHA512 0eb2e26a9ae4a9111f7d1af1a4c950e171435a4cd1a2d6b5785c230d464e269bea117b72870a81ffcb3055996a3fb0e6df9f6b6c80ed6a395887dee8cf256197
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 5dd3c4c1daf3771f4e3a021ffc48bdf3e502143c491217ba5310f5e5053796fb
MD5 2d6bc98111e8615768fdfd692c315b68
SHA1 c4afb46382e8c4e5eaa61fe413824418b2d8cc5d
SHA512 03aa5c7e4830668f7effa432956c129a10ce94dbf0035b91841bf5f25a7b58ceca91762ebe38dc7567ad5945dab6dd4d266a3d4eae84ca4520b4a6c12e0fabe2
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 0e376da20c29200fdb95b49211a67113da759901bbdc0284f0010bd86e957181
MD5 4659c9e25660c8e0031bb8b6d338c715
SHA1 0eaeb604bd376f8b35bfcef2e848783c7a189375
SHA512 51346303dc9faa38acb5ed57db0d786cc853e765a31e68e10e92caa2c0bef44f6edd8829f8368c628e9b7d2db75027588a76e77565501967a8e12105c2c65631
SSDEEP 6:KOGmSWWt2o9FZdrlOERX4PBX4ogLugMBX4suuK+/8xQttsJLiOw2:K1mst2yzdTRmBEyPbP/AktuiOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 e420eb623d074a2cb1c1f5010b9996708a0c40d2369a8fe3a93e581bc4c1898f
MD5 6a1bc466153b9c357a290b1c28ca21d3
SHA1 5cdf566e8842eb9ad73f9f398b15780f1db16ab3
SHA512 4394348ddc781075c357519e08ec7db24fcb745024a01f063b86c0fee140905ce48b01273156534a6d8bddce290c35dc623ad62720c5f1488c8471356c0c42af
SSDEEP 96:eC9WcDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:eC91ndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 13b94b6f863680ac317076aa75fd69ae6f75e6d13527667fc4248ce8f47c42a3
MD5 eb924f107b959429ff1e679c4ed0dcdc
SHA1 e7bec05691d269bf79c08d04bbfe4647762d15a5
SHA512 bf31a5e3bf12fec982eaade87925e690c33c4d9be5f09adeacbd35e472cc1192017edfd082e891e592b8198fffda0502e6fa1c1c7fb75ebf8f61e0bdbeb070f6
SSDEEP 3:R5SOSyEioWHwzXtRKVjWLqA/4l3Hh0XllgoqKXtRKVjWn:alnb72VE/sB0p2Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cxi.wtva9sszh.zimzcje950168/primary.prof
Size 1KB
SHA256 f725def5c2bd8d76148d0f0455dd58e5b2ab8954e478eed2bce80e86bd443c36
MD5 9b8c7bbdf7a12d745c03275ccc767ed7
SHA1 ea9add657236f84c1df5baa8a510edacbc18fe62
SHA512 7f02aea7408e51f5bbab3cfd0d73ebe933fe0e17b68bba503506c0620772863a5af0954fd073c37e101385b8be6d188a554747808f32f49568d7265c71f63db7
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cxi.wtva9sszh.zimzcje950168/primary.prof
Size 389B
SHA256 4c4639ea5fd749766f84df81febd277f84c82a7083e83d9affe3475f4c09b7d7
MD5 90013685263ae537ff9fe17aa163b0fb
SHA1 c795c33cc7d27249e3349385123e893c6527c867
SHA512 eb52866c4de87b89620f29ba65b751b6064c85bab99cb6b46cd7900027193c7fc864b7d7c04f794278db92bacea2d5552a5506ad5e054101ee579a18eb25a7cc
MD5 SHA1 SHA512

Submit Download

iet.ft

Path /data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft
Size 2.0MB
SHA256 985d96b63bc69a63cceb55a24e6c02d296715a1e38cc6b63318bbf741f73643f
MD5 053bbc20dfbeee838f822604c400d177
SHA1 b539b88c1847773ecedcf504ee1c3734bef8bff0
SHA512 2276c31b085f909aca3bb9cf60998edc231274e01615214da16049ef1d942e82a807da1ab7cee83fd403cfa2844df86b969a2ac55458a744a6c8c63361f130da
SSDEEP 24576:HJG8FM637S+v48pUbrxS+SyMV2hUNcVlb:w8yMv48pUpSWlVF
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads