General
- Target data.apk
- Size 12.8MB
- Sample260702-2km3nscx2m
- SHA256 d472e114361dd2c6ebafb60daa72ba2db09752de5b243538f0fee18410ad6a25
Score
10/10
Malware Config
Targets
-
- Target data.apk
- Size 12.8MB
- SHA256 d472e114361dd2c6ebafb60daa72ba2db09752de5b243538f0fee18410ad6a25
Score10/10-
Family: GhostBat
GhostBat RAT is an Android malware that pretends to be regional transport office applications, first seen in October 2025.
-
GhostBat RAT payload
-
Checks if the Android device is rooted.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of the SMS messages.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries the mobile country code (MCC)
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Checks the presence of a debugger