clayrat | acc118166c78b156a6d5b37e0a4333af71636baadf96348c49d8f32f98872132

Resubmissions

05/05/2026, 09:58

260505-lzpbaaf13k10

05/05/2026, 02:18

260505-crjw6aey5s10

05/05/2026, 02:15

260505-cpppmaay6m10

Analysis

user interaction
yes
max time kernel
73s
max time network
78s
platform
android-14_x64
resource
android-34-x64-arm64-20260325.1-en
resource tags

arch:arm64arch:x64image:android-34-x64-arm64-20260325.1-enlocale:en-usos:android-14-x64system
submitted
05/05/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Архив фотографий (3).apk
Size 5.3MB
Sample260505-cpppmaay6m
SHA256 acc118166c78b156a6d5b37e0a4333af71636baadf96348c49d8f32f98872132
MD5 49417d9dfbf049a882cb8f853dc20068
SHA1 c76bd3dd2fad9641d56e14d8599988c12747ec68
SHA512 f521afeb461b90f5733f66bd1ba172413e5e722cae992cac2861c9a724f9364d6989856a6aedd17cd3e073f87c9c46eb01d27164f15b9b7b41407c1fbce5a91b
SSDEEP 98304:ULBPkocefTsU02tpMbDTKoNyjqC0acYHfE8dd2jyoWy8IIlUJv4puk3qg:U1PKlZTKduyfE8yjKyPIlum3
TLSH
T1C7460152F758A47EC4FB27360A36126111B3CE568F83DA836958733C68B76C85F24EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution clayrat impact infostealer persistence rat trojan

Malware Config

Extracted

Family

clayrat

http://suckmycock.trustnik.sbs/huy

Signatures

Family: ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat

Detects ClayRat payload 1 IoCs

resource	yara_rule
behavioral4/files/fstream-2.dat	family_clayrat

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/w8l9fuy.nndyh8m.t54xq24497/code_cache/KLpf.tjl	4579	w8l9fuy.nndyh8m.t54xq24497
/data/user/0/w8l9fuy.nndyh8m.t54xq24497/code_cache/KLpf.tjl	4579	w8l9fuy.nndyh8m.t54xq24497

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	w8l9fuy.nndyh8m.t54xq24497
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	w8l9fuy.nndyh8m.t54xq24497

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	w8l9fuy.nndyh8m.t54xq24497

Performs UI accessibility actions on behalf of the user 1 TTPs 10 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	w8l9fuy.nndyh8m.t54xq24497

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	w8l9fuy.nndyh8m.t54xq24497

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	w8l9fuy.nndyh8m.t54xq24497

w8l9fuy.nndyh8m.t54xq24497
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4579

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

base.4579.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/cache/oat_primary/x86_64/base.4579.tmp
Size 16KB
SHA256 2ba89a26209f59ca384901a17ac059bbb85026420ffda73ef16ae21d27bf7adc
MD5 1d6dc27419e25e6ed4dc901657ee6049
SHA1 7b8425dae67221775a76be2dc6e5ebbf2848a748
SHA512 cc01eb64c990a3dacecf3ddf285e7ec05349317df37667bc20101e6ec397f1d2fd1146a57feafa58a185ae7845c4ba2697c82a8f5ce89a92655a482504fff18e
SSDEEP 192:bTClGBn5Orl4GP4o13K6efVEtHcmtu3fQ103C4vbjTAedeg2TnWJ:/ClGB5ylbpKZWztuPq6vHkedefW
TLSH
T19E721A22B77901E0D30B7EFC47C689D59F2614A135567E14C1638B3A9DA6340EB93FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KLpf.tjl.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/code_cache/KLpf.tjl.tmp
Size 2.2MB
SHA256 d7ec1018d2ec8896ffc760816a5022e2d49bac00809f2cedacece2fef9a1af23
MD5 0b4816437e430c550b774061b1a2b977
SHA1 3a966e8764731ab0a62d8ee521c0888759df55ee
SHA512 6f3e8a3d0c2b9e4e13a62504194c5755c3a4be2354bcfdd8fee57e23db123b4b9234b0502d6763cad800c3981646595e34b54e5e4500dee1c6f4811c8e653a55
SSDEEP 24576:kmQWDSfp138pqlYJ1S6cel1jZJ44HDuEP6:fDM138pqlSecv6
TLSH
T161B58FF1B7104550D4C9723A7CFEDE40F73DA88DD2CE7A061149A7B1AA1A2F53AB4287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KLpf.tjl.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/code_cache/KLpf.tjl.tmp
Size 2.2MB
SHA256 75aa677e782abf0d59e787a367eaf8aaf55dc1a365b6431201eb6f527cef2406
MD5 c26e7a3971042a37fd4ba2ce888be5ec
SHA1 acc4a2d4cbe9a3d3411cd048b446342f94c31724
SHA512 536a839bf44ec0b1a85b078e15bff07e546fe75d2ad4f192e728368bfbc959d5ed6d775325edfb72b784edafd1b6939bc7de3c0d0c16cc80b5d55d58e2a9cbac
SSDEEP 24576:QmQWDSfp138pqlYJ1S6cel1jZJ44HDuEP6:rDM138pqlSecv6
TLSH
T1E2B58FF1B7104550D4C9723A7CFEDE40F73DA88DD2CE7A061149A7B1AA1A2F53AB4287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KLpf.tjl.cur.prof.QchcoE.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/code_cache/oat/KLpf.tjl.cur.prof.QchcoE.tmp
Size 2KB
SHA256 a044beef75439bc03d94078c03385ad09cf2150a7d096c08a5f39ace544ae2c0
MD5 0f09832bfaee576eb5fb3c2cebdb5848
SHA1 016db3deb2c032fcc6fb3f593406496a7ed6b23d
SHA512 e0c0be3015db8f59fcd99e27e1900e814a5508396339d2bfcc81d200661694375780315579cc6a9b9e22b11302a6f9212492e56f84000a92e22cdd5d73c0406b
TLSH
T135516C3C58A1D156E46D0AB1F08E2AF50ED971D0C3E027EDA643A0853D6D398EF92A77
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/files/profileInstalled
Size 24B
SHA256 bfac97a6230bba5b746e0af3c041ec6c535a5d6678d241b6dc6b80ab97f4ea8c
MD5 c0fa13995723f1dbb75f00bd38ef3b7e
SHA1 f0106200336afe708459f6468c6def68ee96369f
SHA512 3255194714d06c6b671e0efdde58f1319f581f2f112e08058752981a75b4dc79758b7e87016b2cec9afb8a4289cf085dfc8f8a25775b7ad2a6fb4a8a940b8a27
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 4f15202eec8f209f4e46f90206a168a30009744b45f08b8f7e59704e67d90f14
MD5 f3f191dbd086de8e5416a447e22820e1
SHA1 fcd003d283aba38d57d05cbf1de0dc9599cc12e5
SHA512 07e5d9626da876edc83e13afed43b359aac8ccf3d55b069b9d1367d2a56f826f3bac177fb932f539f7e28fad69a4b2067d957be16ac880c1e2cd9c3e10fc43b9
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb
Size 4KB
SHA256 f8046fb6523b685349e4ceaa5b63d5653f3d4d9bc0291dd9546056bfabd76205
MD5 19e5c2bf2a99d61bc5ae4cc8952d1bb0
SHA1 34d540bf135454e98068819b42b84411fdd62dbf
SHA512 454bce38a46107d5a4c64d8757475da9ff6ee0025fa1a8212e613d787927cb209217c655ae4ec7adf884c723e5683f473e21df0a606cd40ada4245f8daf9c3ce
TLSH
T10C810454D34000F1D0D407F354D1130D0F07D1D4D5510F0315070041CC415470C74FC5
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 bdc2f329487e51407bdde01bda01fd9bbd501053441251ae6635862748df9662
MD5 13d54bce4e40c1f500974084a45b677d
SHA1 713bae5664c0ffd6866f41357838601fee462b99
SHA512 1df817808464e5eb6908ae4486460c1664c5c4554f2aec3d60fb035e0ca2479687fb4f7606a44947379293b234a42c6c68bc765a16b8efc16d8856cf3cfa7e0f
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-wal
Size 293KB
SHA256 6101f4fbe565965d3d039bc952b89de632fe9b70a497bb815eed7eeb01ce8766
MD5 eb42b6122b1f75c6fd628460a923ad9b
SHA1 45287ce078b8471b582d993fa231236aa51d3da0
SHA512 81eda0c198755a28cebb8cc74bf8f96df13ed536724ad26e323f2d1a89dc49079c71ecf1d8cc0e528cf8eac07026ff27a9445ad4bae3dee9c475beec62b26309
SSDEEP 384:b713+313K13913Ey13X413Zr413aD13Hp513IG5D13z:l3W3U3v3Es3XW3dW3aR3Jr3rR3z
TLSH
T1BD5420AEBBD56447F24EB63C5C8F22D74E72BCFD0445D0C89E2373856259A6501B8F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 180bf57bf1d15960ef7a7be3ab92e828af5eed780a5592aad5938d43e3a5ffd7
MD5 c55c2aa59bcdd2d47b316cc008933df7
SHA1 3a525ed19d2fae7439c88cc1b53f8f74b97db472
SHA512 bf6ad799c4d3fa83511fad8e12cd2f074a0f4aa5512da15745143e294686632626a92b704076a8270aed3a5441cc83f726dbc09fb919ac11877980842f897f78
SSDEEP 6:K2XGgUd9FZdvtAlOERX4PBX4ogLugMBX4suuK+/FRNJaOw2:K2XVULzdIRmBEyPbP/hJaOw2
TLSH
T1C172C2ACD3910963C14782B65CC4C3860FA266BEA362CB4B075205597C2ABECE490D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 d398decc17bd3a99275b5580fb860fc81e7d72a98c0925f9244fb7be99361ed9
MD5 2d14df88ebbe3c3ee9e5fa6e11433d79
SHA1 43bb7bc83a584fa2cd394e66bb509435a0ff1613
SHA512 9ec1052399ddd84a19ef8d95eee6b64581adb011d773e0298fa9d47a760d57a3324517a6719a952d9118794cd9a1c47df242776453a6ca22152abba3aea8471d
SSDEEP 96:DBWyDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:lXndjnHt9S/f8JzSV+6D86T0ED
TLSH
T153B3028D0F692500C4AA64B099D00FF27E3E417FA393E3D166910079EDEA931DD65CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/w8l9fuy.nndyh8m.t54xq24497/primary.prof
Size 1KB
SHA256 ac4cb7bba6faaeed52bdf98ab6e497b357ed50589d1f92e497df0b994140e9d7
MD5 7266ce152fd470f4f7c6ba14f5305a8f
SHA1 c31f87a811acba213281cf7206449cc9de76cfab
SHA512 2a0fa14870ec213228b2df24cbcd4f272c5302710d39bda42dfec0260b2cdbccd5559c8d0f5a708eb96f4c9e97c11a8cc8395dd927fae8af1ccfe326092b6f50
TLSH
T16D31E98517817270FFCA2FF821B4017097DBBA268692105969A4284DD3C1CEDF9F8892
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof.DBGmAJ.tmp

Path /data/misc/profiles/cur/0/w8l9fuy.nndyh8m.t54xq24497/primary.prof.DBGmAJ.tmp
Size 408B
SHA256 1ee81a000b0baf903d1b8c7c31a8bdb929f0205122387449cb2bca450387b41e
MD5 b80f95d02bbcbed9e6f8f813915e053a
SHA1 f3380a53594f62defdbe3d96bc27e9a5a005e19c
SHA512 405128f3a1074826472243d307f7e5abf82b4275142f5881521de9bc53c705016562142b3a7b457ef353fd2f98e81f5d1dfa8ab2891890ba731b8e9ac44f1625
TLSH
T1D4E0F10FCB93390BF944D8314B570300057042FFB6496B333F00236611869F2F069404
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads