Extracted

• • Target
    YouTubeRU.apk
  • Size 6.7MB
  • SHA256 c968f39c768ec76497a1c7a589be5118ad4bde1f941828b2bb8e1025bd5e264c
  • MD5 5d4cb157c2251752a8bdd461ac0187a1
  • SHA1 82c8d8169f64d1e7c95d6b7648493bf23d5f700e
  • SHA512 6ba51631df05dfc7d6aa3a8cfb2fc04fcaf153e75615a43e30ba005bf00e8319380fa8e0ca45914db2563133997d8b57bff77e9e19a50f61ee41c3d2fe3cad5d
  • SSDEEP 98304:ygvmZ5/O6ClHTAF+HB4c8iRJk3qIyH3xVwKwLG9hHk+KrUcsPZMkMyocd1eNeoyY:yog5/O6ClHksB4sNX/G3Ufk0qG4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionclayratimpactinfostealerpersistencerattrojan

  • ClayRat

    ClayRat is an Android spyware first seen in October 2025.

    trojaninfostealerratclayrat

  • Clayrat family

    clayrat

  • Detects ClayRat payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Requests changing the default SMS application.

    collectionimpact
  behavioral1behavioral2behavioral3