Extracted

• • Target
    Архив фотографий (3).apk
  • Size 5.3MB
  • SHA256 acc118166c78b156a6d5b37e0a4333af71636baadf96348c49d8f32f98872132
  • MD5 49417d9dfbf049a882cb8f853dc20068
  • SHA1 c76bd3dd2fad9641d56e14d8599988c12747ec68
  • SHA512 f521afeb461b90f5733f66bd1ba172413e5e722cae992cac2861c9a724f9364d6989856a6aedd17cd3e073f87c9c46eb01d27164f15b9b7b41407c1fbce5a91b
  • SSDEEP 98304:ULBPkocefTsU02tpMbDTKoNyjqC0acYHfE8dd2jyoWy8IIlUJv4puk3qg:U1PKlZTKduyfE8yjKyPIlum3
  • TLSH
    T1C7460152F758A47EC4FB27360A36126111B3CE568F83DA836958733C68B76C85F24EC6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionclayratimpactinfostealerpersistencerattrojan

  • Detects ClayRat payload

  • Family: ClayRat

    ClayRat is an Android spyware first seen in October 2025.

    trojaninfostealerratclayrat

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Requests changing the default SMS application.

    collectionimpact
  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6