mirax | a3ade4b9e03e459a5955d68c52f8dbf893ce0c2bfb56c1c8b7415ecfb7ec9246

General

Target
temp_1781774687144.apk
Size 10.1MB
Sample260702-2k6vsafy9w
SHA256 a3ade4b9e03e459a5955d68c52f8dbf893ce0c2bfb56c1c8b7415ecfb7ec9246
MD5 2be0da0c4135514667aa947eec3a04d8
SHA1 fc48f53b4ada8c3d31cc647562d7a54e28ea626e
SHA512 7a0cc89015357d0d5784e42bec9b0a0797fc85b9e96d8af54a50c115761bead560ceea865329beb2789fd5251ddda1fea6f24f9465157b2bcf911738799bad48
SSDEEP 196608:n3SIGw4+np11yqnmxzbrV1IGOpU+Htk5TLLJbZWO:nj7/11mxZ1I2J7WO
TLSH
T194B61206FB49E96BC0F767764D764122424B4C268B53D3936F58723C18BBAE04F4AED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  temp_1781774687144.apk
- Size 10.1MB
- SHA256 a3ade4b9e03e459a5955d68c52f8dbf893ce0c2bfb56c1c8b7415ecfb7ec9246
- MD5 2be0da0c4135514667aa947eec3a04d8
- SHA1 fc48f53b4ada8c3d31cc647562d7a54e28ea626e
- SHA512 7a0cc89015357d0d5784e42bec9b0a0797fc85b9e96d8af54a50c115761bead560ceea865329beb2789fd5251ddda1fea6f24f9465157b2bcf911738799bad48
- SSDEEP 196608:n3SIGw4+np11yqnmxzbrV1IGOpU+Htk5TLLJbZWO:nj7/11mxZ1I2J7WO
- TLSH
  T194B61206FB49E96BC0F767764D764122424B4C268B53D3936F58723C18BBAE04F4AED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery evasion execution mirax impact infostealer persistence rat stealth trojan
- Android Mirax payload
- Family: Mirax
  Mirax is an Android Android RAT first seen in 2026.
  rat trojan infostealer mirax
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Reads the content of SMS inbox messages.
  collection
- Reads the content of outgoing SMS messages.
  collection
- Reads the content of the SMS messages.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests changing the default SMS application.
  collection impact
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1 behavioral2 behavioral3