clayrat | YTSafety[.]apk

General

Target
YTSafety.apk
Size 1.9MB
Sample260322-w8yleshs6k
SHA256 406778dfa3405247ee3f080793c694fe1c47b6d4e8af6be0425a98cd9051a339
MD5 02d7ad36141319ab9232f9dee3e1bea8
SHA1 ff2338b0eb7d56714cdcc48e1a2e53d41a53fd6f
SHA512 ca468d7299f1b98bdf0f75c7abf5e3f8d9321ef80810971287ca015e154502f928668ab7bf59cddb555e658ebc6a9af995af78233dda6772574d774f5e0491d1
SSDEEP 49152:cbOYM3rrIMTUgsL629LiD3SKULwgfk356i9V4:cyYkIMTUgsL62NiDaBk35Y
TLSH
T19A957B86FB44983EC4F74236463642626167CD668B83D783A91C727C58BB6CC4F5AFC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clayrat

Malware Config

Extracted

Family

clayrat

C2

http://bambam.clayrat.top/api/v2

Signatures

Clayrat family
clayrat

Detects ClayRat payload 1 IoCs

resource	yara_rule
sample	family_clayrat

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 14 IoCs

description	ioc
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to turn on the screen on, e.g. with PowerManager.ACQUIRE_CAUSES_WAKEUP.	android.permission.TURN_SCREEN_ON
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Required to be able to access the camera device.	android.permission.CAMERA

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
YTSafety.apk

File Explorer

YTSafety.apk

.apk 1.9MB

YTSafety.apk

SHA256 406778dfa3405247ee3f080793c694fe1c47b6d4e8af6be0425a98cd9051a339
MD5 02d7ad36141319ab9232f9dee3e1bea8
SHA1 ff2338b0eb7d56714cdcc48e1a2e53d41a53fd6f
SHA512 ca468d7299f1b98bdf0f75c7abf5e3f8d9321ef80810971287ca015e154502f928668ab7bf59cddb555e658ebc6a9af995af78233dda6772574d774f5e0491d1
SSDEEP 49152:cbOYM3rrIMTUgsL629LiD3SKULwgfk356i9V4:cyYkIMTUgsL62NiDaBk35Y
TLSH
T19A957B86FB44983EC4F74236463642626167CD668B83D783A91C727C58BB6CC4F5AFC8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Detects ClayRat payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

44bfdf9c76ca2eda8f7a142d6e99192b84aaa7375d567f6ac3fb2b1cc960549a

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=5ITN3S2V,OU=8A4PTJkW,O=GgjSXoIH,L=VGdttxdT,ST=6NAenGjD,C=98

ikpx.cpd57xru5pt.ggz30

Android Permissions

YTSafety.apk

Permissions

android.permission.INTERNET

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_WAP_PUSH

android.permission.READ_CELL_BROADCASTS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.CALL_PHONE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.DISABLE_KEYGUARD

android.permission.FOREGROUND_SERVICE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.USE_EXACT_ALARM

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.POST_NOTIFICATIONS

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.USE_FULL_SCREEN_INTENT

android.permission.TURN_SCREEN_ON

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_CONTACTS

android.permission.READ_CALL_LOG

android.permission.CAMERA

android.permission.QUERY_ALL_PACKAGES

ikpx.cpd57xru5pt.ggz30.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

YTSafety.apk

File Signature issue

ikpx.cpd57xru5pt.ggz30.MainActivity

ikpx.cpd57xru5pt.ggz30.TurboProjectionActivity

ikpx.cpd57xru5pt.ggz30.websocket.WebViewActivity

ikpx.cpd57xru5pt.ggz30.FakeLockActivity

ikpx.cpd57xru5pt.ggz30.IntentLauncherService

ikpx.cpd57xru5pt.ggz30.HeadlessSmsSendService

ikpx.cpd57xru5pt.ggz30.websocket.WebSocketForegroundService

ikpx.cpd57xru5pt.ggz30.MediaProjectionForegroundService

ikpx.cpd57xru5pt.ggz30.PushNotificationListenerService

ikpx.cpd57xru5pt.ggz30.AppHighlightAccessibilityService

ikpx.cpd57xru5pt.ggz30.SmsReceiver

ikpx.cpd57xru5pt.ggz30.MmsReceiver

ikpx.cpd57xru5pt.ggz30.BootReceiver

ikpx.cpd57xru5pt.ggz30.websocket.ConnectionAlarmReceiver

ikpx.cpd57xru5pt.ggz30.PushReplyReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

YTSafety.apk

File Signature issue

ikpx.cpd57xru5pt.ggz30.MainActivity

ikpx.cpd57xru5pt.ggz30.TurboProjectionActivity

ikpx.cpd57xru5pt.ggz30.websocket.WebViewActivity

ikpx.cpd57xru5pt.ggz30.FakeLockActivity

ikpx.cpd57xru5pt.ggz30.IntentLauncherService

ikpx.cpd57xru5pt.ggz30.HeadlessSmsSendService

ikpx.cpd57xru5pt.ggz30.websocket.WebSocketForegroundService

ikpx.cpd57xru5pt.ggz30.MediaProjectionForegroundService

ikpx.cpd57xru5pt.ggz30.PushNotificationListenerService

ikpx.cpd57xru5pt.ggz30.AppHighlightAccessibilityService

ikpx.cpd57xru5pt.ggz30.SmsReceiver

ikpx.cpd57xru5pt.ggz30.MmsReceiver

ikpx.cpd57xru5pt.ggz30.BootReceiver

ikpx.cpd57xru5pt.ggz30.websocket.ConnectionAlarmReceiver

ikpx.cpd57xru5pt.ggz30.PushReplyReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Android Permissions

YTSafety.apk