mirax | 0cf04d3a3a5a148f6f707cd2bc24b38179e0dc4252b4706f77a4d5498cf2c3e9

General

Target
0cf04d3a3a5a148f6f707cd2bc24b38179e0dc4252b4706f77a4d5498cf2c3e9.apk
Size 10.8MB
Sample260507-v4wetsgs71
SHA256 0cf04d3a3a5a148f6f707cd2bc24b38179e0dc4252b4706f77a4d5498cf2c3e9
MD5 e0146d93ece4577e16cef91674b5f56b
SHA1 ec10996d64f5d02137ce540c221db5720949334d
SHA512 8bff1ab0360cea723b53fd3609475b6f88fea4bed13ddf30a9365bf01fc4b586aabe91b05a76d1186e62f04f474398feb781bf6899c29020f9114df0b2567728
SSDEEP 196608:V4VmkGkQ+h14XiH9XjuGhm4YVGTE6vG4eSiRa0yRsvz8tMl:jkFQy1RXyzlUTE6v/nua7RUeMl
TLSH
T1B9B60295FF89D99AC0F75B32C97552B240475D128B83CA875E48767C18BBAF04F0EAC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  0cf04d3a3a5a148f6f707cd2bc24b38179e0dc4252b4706f77a4d5498cf2c3e9.apk
- Size 10.8MB
- SHA256 0cf04d3a3a5a148f6f707cd2bc24b38179e0dc4252b4706f77a4d5498cf2c3e9
- MD5 e0146d93ece4577e16cef91674b5f56b
- SHA1 ec10996d64f5d02137ce540c221db5720949334d
- SHA512 8bff1ab0360cea723b53fd3609475b6f88fea4bed13ddf30a9365bf01fc4b586aabe91b05a76d1186e62f04f474398feb781bf6899c29020f9114df0b2567728
- SSDEEP 196608:V4VmkGkQ+h14XiH9XjuGhm4YVGTE6vG4eSiRa0yRsvz8tMl:jkFQy1RXyzlUTE6v/nua7RUeMl
- TLSH
  T1B9B60295FF89D99AC0F75B32C97552B240475D128B83CA875E48767C18BBAF04F0EAC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery evasion execution mirax infostealer persistence rat stealth trojan impact
- Android Mirax payload
- Family: Mirax
  Mirax is an Android Android RAT first seen in 2026.
  rat trojan infostealer mirax
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Reads the content of SMS inbox messages.
  collection
- Reads the content of outgoing SMS messages.
  collection
- Reads the content of the SMS messages.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1 behavioral2 behavioral3