clayrat | 02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2

Analysis

max time kernel
46s
max time network
150s
platform
android-10_x64
resource
android-x64-20250917-en
resource tags

arch:x64arch:x86image:android-x64-20250917-enlocale:en-usos:android-10-x64system
submitted
18/12/2025, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2.apk
Size 4.1MB
Sample251218-td8rssbs9h
SHA256 02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2
MD5 20d234274302af6e35d60e1be0b43c15
SHA1 a0f658ac4560ed06497ccf46cd119dc496c96186
SHA512 98cf30ae4e4fb23478be2c04673925a075792e01c4029adfdb8c66c00d613e0fa6a967b8b66a9c882c32be6c36d682c7c1edf2dc615610a3a4e25920a777dc74
SSDEEP 98304:/96Hg0SFEGdsjKzJjjeBHLE+G4Q4l8o4RDyJ3n7:/UQFAsJjjeBQ+3zl8o+Dw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion clayrat impact infostealer persistence rat trojan

Malware Config

Extracted

Family

clayrat

http://195.62.48.192:26000/error

Signatures

ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat
Clayrat family
clayrat

Detects ClayRat payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-2.dat	family_clayrat

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft	5087	cxi.wtva9sszh.zimzcje950168
/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft	5087	cxi.wtva9sszh.zimzcje950168

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cxi.wtva9sszh.zimzcje950168

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cxi.wtva9sszh.zimzcje950168

cxi.wtva9sszh.zimzcje950168
1⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5087

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

iet.ft.tmp

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft.tmp
Size 2.0MB
SHA256 650c380a82634577a169dd56cfb3aa438605e0dcf4d4c2ce7a4f3a6b9ef2bbcc
MD5 8df64c4938556feca6d38e8626f337f2
SHA1 2ec3e75b1e9d72988108174f16e76587d7e78e83
SHA512 b8870081fdde73eae124f5b280155a18b1bdf1c250c3cc1f9d442b78ea5536f4ec72a74402a8e8049fdf2e64bd6b6172f66967aacce530070acfe092f3d2a166
SSDEEP 24576:LJG8FM637S+v48pUCCiX37ROPvEx+mr/1N+O3CvVlb:U8yMv48pUQXYVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iet.ft.tmp

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft.tmp
Size 2.0MB
SHA256 51d5084f4531193d1ce48f7f6e17a78e836412e07b92edf00d1b5967a9e65a4e
MD5 e9ba071ac027609cf1af5fb5254a06b4
SHA1 c4e94e351ec392f0d0c76d1a619bd9d470936ddb
SHA512 e71a4aad449f501fcc7fdbacf51e65777a4c5b0ebdde3e0f9b9f9ed1a94c530d48b03dcd82ef37430b3a826f7aef9772553ad8f8ba9041c8c44ce52f138d5ad3
SSDEEP 24576:HJG8FM637S+v48pUCCiX37ROPvEx+mr/1N+O3CvVlb:w8yMv48pUQXYVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iet.ft.cur.prof

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/oat/iet.ft.cur.prof
Size 636B
SHA256 e73bc6f6a3772a898e8de49fa1ab10beae2eaaa1df3df037eaf61e21cffcd423
MD5 0eb677ddedbc726aa9b14302e1ebce0a
SHA1 a96f0d9f80f78a6c095f01f5249f4017f3af71eb
SHA512 1de58d0c9a05010377e313a857b8fc622e36c98deff749585bf5f3b9b2e0dde5091edd148c6b08b749ba4c3a446023dee610d73059f0051169839b75a6004013
MD5 SHA1 SHA512

Submit Download

profileInstalled

Path /data/data/cxi.wtva9sszh.zimzcje950168/files/profileInstalled
Size 24B
SHA256 c64396e407ad699243e5b8accdb9b778221a6a5c89d64f217021066701896f18
MD5 59827b186df7a9a853a54cee6b2716e5
SHA1 6b8379de19251a13b31a7382357cb9b1e3189ea4
SHA512 6b6d87117b570f78360b95c56d9aa3ac81602c3b79a4ccd96bf7037395c0e12ae9f1f61297359d251a7a293a10267383fd0116799a3c85c4707f948293dbb102
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/cxi.wtva9sszh.zimzcje950168/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 d9ca61e723dad6c299d60ff88ff63132c9c56f58ce255aed1dd32b0c4e88637a
MD5 ce7ebed23882c2756acd11b3e4eaa6f1
SHA1 de8c52a1f5db90c5938f7fb454071acfe3703158
SHA512 1c82facb994a1e1812da1937e1f5c5bb450284e0959ec616aa0badb49cb6ccf17faad97d644fa37204ef4469611d9dacb1036d055112030039d11b7101a728cc
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b4bda89ad7007147e423e1278e8b273f98b3567220c253362683eaa94fde6986
MD5 b7e2872fec6fe2836be83fdf89eb09f9
SHA1 3ba651895f8045718d3b18053086b780917a1d99
SHA512 8b079f2398e907a2ed62b65e8289fc5cfb4c81186acdcae47c60474311d00ebedc0004f84a96bbcb7ae73d97272a4b7fc31f722dbc4209ee1a5f5bb078032234
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 120KB
SHA256 760ec41a9da3f3c41feac08cddd9eb386f60af634daf5d65b376ffdb10536c75
MD5 3e996112697e71055c74bf767ea8c011
SHA1 ff49ea6ed573343b2ae4f928ac607b05f6abfd02
SHA512 f0623c21424a6e26b46068c545278c521d06142afaa6372f2b14a790dee22351afc5a6c8f7069211d5f29ccad9ebd7e55f0da0a14d6179f24737adf4bb90dcc9
SSDEEP 3:Rgqwq44llOwzXtRKVjWL2lXOsc0XllgoqKXtRKVjWn:Gq14olB72VVeh0p2Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 accded6b1b28f8442e6ca427e7912254d0f8ccefe763795132cf6b25b33c401e
MD5 7f2da4ee7a0065fc2bdb6797ef52ac84
SHA1 61321eb696bef8787529c2740ff388b349863a7c
SHA512 423722f48b48e9cc30c0eb5abdb176a0c0e922ae70fbdaece5bb8981d5a594628356adcac858187bd0ff4969f7d7ccb62bfa29789c47632c0ffea1efd80d208b
SSDEEP 6:KyJklWk19FZdrlOERX4PBX4ogLugMBX4suuK+/8kFm/tuTqTxiOw2:Kak1jzdTRmBEyPbP/8kA/oIxiOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 4cfe0e8db3a000a01609b83395ef5b408b09c0acbe6c72625f30904f35774faf
MD5 90b5ee415f0d3c527c8218f4c82713f6
SHA1 d02a014814aefd86eff6d725fbd533a5a1cf2303
SHA512 f7aead04e64521d10ca3e9b32fe002e6825e9dae20e21d1707340db65bb9411428750f16aca0746ca0b1a8dbce732b80c89cf7e9021d814c04f56f2b49394384
SSDEEP 96:v7sNogUUW/DP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:v7s6rUqndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cxi.wtva9sszh.zimzcje950168/primary.prof
Size 1KB
SHA256 f725def5c2bd8d76148d0f0455dd58e5b2ab8954e478eed2bce80e86bd443c36
MD5 9b8c7bbdf7a12d745c03275ccc767ed7
SHA1 ea9add657236f84c1df5baa8a510edacbc18fe62
SHA512 7f02aea7408e51f5bbab3cfd0d73ebe933fe0e17b68bba503506c0620772863a5af0954fd073c37e101385b8be6d188a554747808f32f49568d7265c71f63db7
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cxi.wtva9sszh.zimzcje950168/primary.prof
Size 392B
SHA256 d981840155c057d3417dd297e13428d658c62eaf89f62ec3b2fab18107a5d591
MD5 d2c324b5038a459f5f5aa9363eb5b88d
SHA1 b72936f0c6ffce86edcc9ba87954f98a5bbd5c3f
SHA512 e960fe517dd0aabf87502fc8918f726bea122308ebf90166010195de62d4d4903b715c1eafcb2a8b12bbdbf41b29ae3c2dc156700e7909b3beecc5f4fd5a9327
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads