Extracted

• • Target
    UrbanRoute.apk
  • Size 5.4MB
  • SHA256 ecf58acaf11bf3aa20dbec39d9f83297fce0d6ba1230189a61031116c7a9b4dd
  • MD5 0256e79adae34acd4e016cfec4aeba38
  • SHA1 a26cc85413d00b989565e8c666a5e0df29c1ef40
  • SHA512 c1e354139bb9486fe148dd2fd0f3bafe6178e744e0208abeb0b3edda522413f2f8d7b8f7bf0a332e4c3c982aefdccf5ba922cea0305773d5ecac30052b67361b
  • SSDEEP 98304:YPJEhVDPFED9pHW4zsvmPmmhKfiN5ikYgIpPo3wojEuhZ4jtXKkNw2tWvxSk3qP:YOAnzNfhKfickYg2Po3w5uhZQtakNwvg
  • TLSH
    T1EF460146F344952EC8FB13360A3A12601663CD2A8F83D797296CB37C6AB75C81F65ED4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionclayratimpactinfostealerpersistencerattrojan

  • ClayRat

    ClayRat is an Android spyware first seen in October 2025.

    trojaninfostealerratclayrat

  • Clayrat family

    clayrat

  • Detects ClayRat payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1