clayrat | acc118166c78b156a6d5b37e0a4333af71636baadf96348c49d8f32f98872132

Resubmissions

05/05/2026, 09:58

260505-lzpbaaf13k10

05/05/2026, 02:18

260505-crjw6aey5s10

05/05/2026, 02:15

260505-cpppmaay6m10

Analysis

max time kernel
299s
max time network
299s
platform
android-15_x64
resource
android-35-x64-arm64-20260325-en
resource tags

arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
submitted
05/05/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Архив фотографий (3).apk
Size 5.3MB
Sample260505-cpppmaay6m
SHA256 acc118166c78b156a6d5b37e0a4333af71636baadf96348c49d8f32f98872132
MD5 49417d9dfbf049a882cb8f853dc20068
SHA1 c76bd3dd2fad9641d56e14d8599988c12747ec68
SHA512 f521afeb461b90f5733f66bd1ba172413e5e722cae992cac2861c9a724f9364d6989856a6aedd17cd3e073f87c9c46eb01d27164f15b9b7b41407c1fbce5a91b
SSDEEP 98304:ULBPkocefTsU02tpMbDTKoNyjqC0acYHfE8dd2jyoWy8IIlUJv4puk3qg:U1PKlZTKduyfE8yjKyPIlum3
TLSH
T1C7460152F758A47EC4FB27360A36126111B3CE568F83DA836958733C68B76C85F24EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution clayrat impact infostealer persistence rat trojan

Malware Config

Extracted

Family

clayrat

http://suckmycock.trustnik.sbs/huy

Signatures

Family: ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat

Detects ClayRat payload 1 IoCs

resource	yara_rule
behavioral5/files/fstream-2.dat	family_clayrat

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	w8l9fuy.nndyh8m.t54xq24497
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	w8l9fuy.nndyh8m.t54xq24497

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	w8l9fuy.nndyh8m.t54xq24497

Performs UI accessibility actions on behalf of the user 1 TTPs 30 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	w8l9fuy.nndyh8m.t54xq24497

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	w8l9fuy.nndyh8m.t54xq24497

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	w8l9fuy.nndyh8m.t54xq24497

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	w8l9fuy.nndyh8m.t54xq24497

w8l9fuy.nndyh8m.t54xq24497
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:3222

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

base.3222.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/cache/oat_primary/x86_64/base.3222.tmp
Size 16KB
SHA256 3e27cc90ace94e67c4072e286f43cd01fbc1d83679aa0f62e81aa6c5da3b709a
MD5 9520f64e2f4fc5f454c326a9509bccf0
SHA1 508df0c19d826154cec1b6114090a03623c6577a
SHA512 4fec8ef51c729e3e561a7d997cc3a2ab1ddcc7f61d5525541c462b85514eca2ffdb3f7ceddba23964a1c484ea3c34ae7a28b2b791d375959827e73a95f682639
SSDEEP 192:Oxs5Le7QDze0fHVupL1NuDOn6V9JRl+PX/3kYHa9N:qste7QDu5Nuq6RRlgvkYHa
TLSH
T14572291FB7240052C688FDFD57C35CE68D221071739E5920ADA61B3AD8A3B14E792F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KLpf.tjl.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/code_cache/KLpf.tjl.tmp
Size 2.2MB
SHA256 d7ec1018d2ec8896ffc760816a5022e2d49bac00809f2cedacece2fef9a1af23
MD5 0b4816437e430c550b774061b1a2b977
SHA1 3a966e8764731ab0a62d8ee521c0888759df55ee
SHA512 6f3e8a3d0c2b9e4e13a62504194c5755c3a4be2354bcfdd8fee57e23db123b4b9234b0502d6763cad800c3981646595e34b54e5e4500dee1c6f4811c8e653a55
SSDEEP 24576:kmQWDSfp138pqlYJ1S6cel1jZJ44HDuEP6:fDM138pqlSecv6
TLSH
T161B58FF1B7104550D4C9723A7CFEDE40F73DA88DD2CE7A061149A7B1AA1A2F53AB4287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KLpf.tjl.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/code_cache/KLpf.tjl.tmp
Size 2.2MB
SHA256 75aa677e782abf0d59e787a367eaf8aaf55dc1a365b6431201eb6f527cef2406
MD5 c26e7a3971042a37fd4ba2ce888be5ec
SHA1 acc4a2d4cbe9a3d3411cd048b446342f94c31724
SHA512 536a839bf44ec0b1a85b078e15bff07e546fe75d2ad4f192e728368bfbc959d5ed6d775325edfb72b784edafd1b6939bc7de3c0d0c16cc80b5d55d58e2a9cbac
SSDEEP 24576:QmQWDSfp138pqlYJ1S6cel1jZJ44HDuEP6:rDM138pqlSecv6
TLSH
T1E2B58FF1B7104550D4C9723A7CFEDE40F73DA88DD2CE7A061149A7B1AA1A2F53AB4287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KLpf.tjl.cur.prof.4qxXO4.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/code_cache/oat/KLpf.tjl.cur.prof.4qxXO4.tmp
Size 1KB
SHA256 16666a33b49682abe6974ba3f9e030211a20644c787c2033ccb7b5521398c78a
MD5 6173a640703f1bbc1adaab03843522cf
SHA1 f74fe51adf0f3b318dac683cdc0de0cee0c376a1
SHA512 4b55234ad242b9ddca253d399ade058c498b74d0d8bfaa47a491a93ae47ce74981403a31fc44adef561aebc1e7fde4f7571a5b14913bc2d839888a237ecea7fd
TLSH
T1C2312B2D586D21D3C8113F7BFC54450ABDC67E8017214A16D381E1873C58056F7ABEBB
MD5 SHA1 SHA512 TLSH

Submit Download

KLpf.tjl.cur.prof.EUaicA.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/code_cache/oat/KLpf.tjl.cur.prof.EUaicA.tmp
Size 1KB
SHA256 384ad5ef59cd877f3d92cd3802d87b71bc24bcb243543af3f812231e44aaa9d2
MD5 30da674f9ea75533cc852f00ce64d0e4
SHA1 a377248e8bd6cffe9a240cd3dfd05d9cfb904f61
SHA512 bd32c9c07e53c6d8e476c9365bde84b2a03b8e2152c91e3ad12cb973dc0bd711de5656d0aaaac0c67a5f9d1832d60fd0c1be70426aa0bf4e78b59cfb3b55721e
TLSH
T15C312D1D84DC1366DCA4367375BE375359C83E488922E4D6B441F6CC84D4918FBED971
MD5 SHA1 SHA512 TLSH

Submit Download

KLpf.tjl.cur.prof.gfDyqi.tmp

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/code_cache/oat/KLpf.tjl.cur.prof.gfDyqi.tmp
Size 1KB
SHA256 1a4745ecab3faefd8bce0b8731d840b8dd4c69b832863e3977488a6a36098857
MD5 841aaeeb51951e2ba2762c3581b8ff5d
SHA1 c6907710f6b3fce4ba8c179ac752af7ac54993c2
SHA512 7b865d7d0cdfd8b7595080e23c2095947469800958e0f05bf4c6765d7be54df8a4f86d25dc9e80cbbbeebb0ddde4ed3d0b8e2d21bd5f00aac373d0646a5baff7
TLSH
T1EE41F94AC28047C8FE643FF78C2B2565C586588A07CE459B6790686508EC972FFF40F3
MD5 SHA1 SHA512 TLSH

Submit Download

profileInstalled

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/files/profileInstalled
Size 24B
SHA256 916c78dca882b8ad693cbed47ff83ed02ca3e0b6d5bab3de4d02aacfbb01ec0b
MD5 f65f5030c43e4877b935901b5c6b74a3
SHA1 fe3b88682f8bc3d5c77bd65af7044ac43ac45be8
SHA512 bcbfdb7a897821f244da985e3469aa13ea6434fb5329b834a0a2b1ecf8d79ed791c3de27646383157d270526392a3929522094270de8122acba301582cba7159
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb
Size 4KB
SHA256 bfaef8fac18709034d1b023086575733ab2f5ba0628478989b5e704180ca2513
MD5 f92de9b7aca81136a5f2712adbd9ae8d
SHA1 8612ffa8ecae146263660d878c1e74d3da282d00
SHA512 9c2b923253b6871e68b7c513a1cbd80d39e270749933dc8e08d5add372f5f432c183768854e699cbd68c105b4e81a5500caa1d3fb2b194743c2b76b6095a526e
TLSH
T195810440574000F1D05407F354D1171D0F17D1DCD5410F0315010041CC455440C70FCD
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 058684a7aaac70807092894090abaa0de57b32a301489907e3cdcf2b2d302923
MD5 0a0379c020fd46ffafbb09f5181904a1
SHA1 acdd25a4dbbdfeca16c10ff791599bc9c4050e0e
SHA512 8f1cdebee673911084316287be5ef7baf177d014db06dcc41d717b3bbbb146e2a5be00757457639ece12a3e7cbc0d85f9d4b5fc2ef112707171517521f3d2bbb
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-wal
Size 301KB
SHA256 55a057023b5a66c09f8604ed167b685b6a3b53d4c9bd2a734fb1811c6555e90c
MD5 b0a2656a5face352b810ed62150030ed
SHA1 80b20a3ad95327e35a5853117a6a71afc549106a
SHA512 1e83955f0101184aa4567eeaa3913333f0230a0cd9ecb306d0a864df22902432a763a83e9d88b43436a0a50063f55d2968b1265fdc474e2470078fda69d10bb8
SSDEEP 384:qh13Il13413h13P5z13bTdZyuz2DjZ5E136amy5E1335/1395r13apsz5/13M:k323W3D3hB3Ii3bi3Jd3Pp3nd3M
TLSH
T132640267334BCA0BF6BEAB78ACDB53D85DB2DCFC8913E0C26123161956857411622F9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 84aceb4bd091f04cf51cb243d004df860006023e742fa323163b75499db27cea
MD5 c29d0c7712b6de874cc889048e92067c
SHA1 245d1a8e52bccb495f9b2793f7848efdc6533db0
SHA512 8c9aa7e7336f5cc38346904a09117d484fc5265256abca8004460f7b5285b8df70e996610fb559929fd8a93f29705f31d82ede789b6751a66724447b5c342954
SSDEEP 6:KKE3l9FZdvlWlOERX4PBX4ogLugMBX4suuK+/bgS/g/VLDy/VWAEiOw2:KhjzdvloRmBEyPbP/bgS/g52IAVOw2
TLSH
T1F472C26893C61B7BC18A433654C5D3D61E61D62E4373C79B672008A06C4168C9750F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/w8l9fuy.nndyh8m.t54xq24497/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 098c0811bdf5d530a5213d640000465172b8047ab2303788cba601ea04c36b81
MD5 55f8679f55e5a9b66118d005b7a1c07e
SHA1 888e6d17782240e03c8a486b6b68f8c6179fd5ee
SHA512 39105bf5b8fc3e91f70ecba9574f37651e8ec9e8de7c83b58f93973648a65c9021fcc45bd23c02950f804fbfed44d28e28c6f774bef39cba86f455e34896fe9c
SSDEEP 96:WGOMDWMDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:HbVndjnHt9S/f8JzSV+6D86T0ED
TLSH
T14FB3128D0F9D2715C0EA64B095D00FE1793E812E93A3E3D266A10075ADC2920DE29DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof.quVYCl.tmp

Path /data/misc/profiles/cur/0/w8l9fuy.nndyh8m.t54xq24497/primary.prof.quVYCl.tmp
Size 308B
SHA256 b9e502984769005f9475b3f2a8f01ab1abf41fd836fb47a11f7b54a4f3a0e549
MD5 8a8262ffc8ba60af338d38e1bb2a3824
SHA1 4ca995e1e91bca9056521b1c6b5a6aa77ba11d25
SHA512 d72f1b06957d7c81a83c87ebd7b1bcc6fa02e4160402f15dde2edd1a3faa65e76419202fa283f95b70dc189ec4a3d57b6e83a081e416808eb4d7642a1ba49209
TLSH
T174E02BC7CAF0751FC0E816304D9723575235136374C923171E82857199132E0F8B2555
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads