clayrat | 02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2

Analysis

max time kernel
12s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20250917-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20250917-enlocale:en-usos:android-11-x64system
submitted
18/12/2025, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2.apk
Size 4.1MB
Sample251218-td8rssbs9h
SHA256 02e440bfef44e89e0a7763c1a543c1ded58009d6e41650a56cef6fbbef78fad2
MD5 20d234274302af6e35d60e1be0b43c15
SHA1 a0f658ac4560ed06497ccf46cd119dc496c96186
SHA512 98cf30ae4e4fb23478be2c04673925a075792e01c4029adfdb8c66c00d613e0fa6a967b8b66a9c882c32be6c36d682c7c1edf2dc615610a3a4e25920a777dc74
SSDEEP 98304:/96Hg0SFEGdsjKzJjjeBHLE+G4Q4l8o4RDyJ3n7:/UQFAsJjjeBQ+3zl8o+Dw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion clayrat impact infostealer rat trojan

Malware Config

Extracted

Family

clayrat

http://195.62.48.192:26000/error

Signatures

ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat
Clayrat family
clayrat

Detects ClayRat payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-2.dat	family_clayrat

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft	4693	cxi.wtva9sszh.zimzcje950168
/data/user/0/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft	4693	cxi.wtva9sszh.zimzcje950168

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cxi.wtva9sszh.zimzcje950168

cxi.wtva9sszh.zimzcje950168
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4693

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

iet.ft.tmp

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft.tmp
Size 2.0MB
SHA256 650c380a82634577a169dd56cfb3aa438605e0dcf4d4c2ce7a4f3a6b9ef2bbcc
MD5 8df64c4938556feca6d38e8626f337f2
SHA1 2ec3e75b1e9d72988108174f16e76587d7e78e83
SHA512 b8870081fdde73eae124f5b280155a18b1bdf1c250c3cc1f9d442b78ea5536f4ec72a74402a8e8049fdf2e64bd6b6172f66967aacce530070acfe092f3d2a166
SSDEEP 24576:LJG8FM637S+v48pUCCiX37ROPvEx+mr/1N+O3CvVlb:U8yMv48pUQXYVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iet.ft.tmp

Path /data/data/cxi.wtva9sszh.zimzcje950168/code_cache/iet.ft.tmp
Size 2.0MB
SHA256 51d5084f4531193d1ce48f7f6e17a78e836412e07b92edf00d1b5967a9e65a4e
MD5 e9ba071ac027609cf1af5fb5254a06b4
SHA1 c4e94e351ec392f0d0c76d1a619bd9d470936ddb
SHA512 e71a4aad449f501fcc7fdbacf51e65777a4c5b0ebdde3e0f9b9f9ed1a94c530d48b03dcd82ef37430b3a826f7aef9772553ad8f8ba9041c8c44ce52f138d5ad3
SSDEEP 24576:HJG8FM637S+v48pUCCiX37ROPvEx+mr/1N+O3CvVlb:w8yMv48pUQXYVF
MD5 SHA1 SHA512 SSDEEP

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/cxi.wtva9sszh.zimzcje950168/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 a20d6bfd4f7ad618c000f3cb62e2f780208aaba8d1fef2e565eb5cb25a846f80
MD5 895e93fe8e2a021386f3ec64a080ae5d
SHA1 31a0f4842c71acef8ce5d7db894df881bd720ac4
SHA512 c6309b6c99a2fad3a55984110f6b6244a9c5806ef6de2baf6801a4851287c56bbb73a1f454947d4379415a5fdf6be61233ac92082f40bf988066ff8f76b19e26
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 7bc19fb6848286e10f26a361411be2bf01d76330b0572abd7fb7a4b95f4aad3b
MD5 e8a9f49b2300b19e92e64329b98c8771
SHA1 15c05e577bc448996afb7abdda14c0fc2710e07d
SHA512 61645454237756170691921e3ac22cffc366415ce9b1c10a818e5253069bf667b4a481da5074f8e240e4429898e6a8aef3cd6fb348f0bf9cecac70a518cd40e1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 705f562d2f090cdac472fc46aa2904c05021478d9b95b4bea548f50fa2e94578
MD5 fbd48f571a369bcefff9ec55f8779a30
SHA1 274df1d6a691f6c66dbc2bdf684311d1992e8025
SHA512 e2efc3dd912b51915a6a8d95cc0cef7a17687e2e218bca8779469408f2f4d1bb506487395898cccb47fccb6d665534bd74ef08c0438c3019389e5838d2100f1d
SSDEEP 6:K8c9ObuTJ9FZde/kPlOERX4PBX4ogLugMBX4suuK+/NNAcl//82Jr4gOw2:K8ZKTXzdeWRmBEyPbP/vN//sgOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/cxi.wtva9sszh.zimzcje950168/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 6d89edc46a13b864d55ccf95d9a4915fd2dcfff9d4251e705b01a93ea6d68a59
MD5 4f024dcd1b5781eeb7ed202f588a5144
SHA1 006057ee361c714ff976b8d453a5770793ce897d
SHA512 482ba285563bb346412859f235584d2d093a576f4837529c0918c066ba9b5190af353d45f8db760967aaebae28c8044bad747ee2d882891d7ba60f03d47d150c
SSDEEP 96:Li3xcW0DP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:G3xcZndjnHt9S/f8JzSV+6D86T0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cxi.wtva9sszh.zimzcje950168/primary.prof
Size 1KB
SHA256 f725def5c2bd8d76148d0f0455dd58e5b2ab8954e478eed2bce80e86bd443c36
MD5 9b8c7bbdf7a12d745c03275ccc767ed7
SHA1 ea9add657236f84c1df5baa8a510edacbc18fe62
SHA512 7f02aea7408e51f5bbab3cfd0d73ebe933fe0e17b68bba503506c0620772863a5af0954fd073c37e101385b8be6d188a554747808f32f49568d7265c71f63db7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads