General
- Target data.apk
- Size 12.8MB
- Sample260702-2km3nscx2m
- SHA256 d472e114361dd2c6ebafb60daa72ba2db09752de5b243538f0fee18410ad6a25
Score
10/10
Malware Config
Targets
-
- Target data.apk
- Size 12.8MB
- SHA256 d472e114361dd2c6ebafb60daa72ba2db09752de5b243538f0fee18410ad6a25
Score10/10Family: GhostBat
GhostBat RAT is an Android malware that pretends to be regional transport office applications, first seen in October 2025.
GhostBat RAT payload
Checks if the Android device is rooted.
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Queries the phone number (MSISDN for GSM devices)
Reads the content of the SMS messages.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
Queries the mobile country code (MCC)
Requests disabling of battery optimizations (often used to enable hiding in the background).
Checks the presence of a debugger