Extracted

• • Target
    %D0%92%D0%B8%D0%B4%D0%B5%D0%BE_%D1%81_%D0%94%D0%A2%D0%9F.apk
  • Size 6.7MB
  • SHA256 78878d33b2b48747694ce2fdb24e896cd9ba027b1d66c66c107cf415ed46b89b
  • MD5 b71b04fa665e545cffa06e10a32052d5
  • SHA1 1d0e1a3fb55c21fefa13bfe3040dde43d4b763ac
  • SHA512 b077cdfe67329f20230d86f973c96ccd5f37e4a7c62e11ecc4a922122e149180b0af0bd4c16bcf786c2e9bb82efebae8174755297b30f91be6b6236793f8c6ee
  • SSDEEP 196608:oNr8L/UuQxEYXZ4T4zB6E+C7ziRIZ0/OU3Yfz:i8/WZ4UziC74IZpU3I
  • TLSH
    T19A660256F749947EC8FB173A463612702263CC628F4396832958733C69BB9C85F29FD8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionclayratimpactinfostealerpersistencerattrojan

  • ClayRat

    ClayRat is an Android spyware first seen in October 2025.

    trojaninfostealerratclayrat

  • Clayrat family

    clayrat

  • Detects ClayRat payload

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Requests changing the default SMS application.

    collectionimpact
  behavioral1behavioral2behavioral3