Extracted

• • Target
    YouTubeGG.apk
  • Size 5.3MB
  • SHA256 2625df6b52a737543cbf542325dfcfc6208d2be67c4aa0cd26b6a0e3aa5bdb33
  • MD5 91639eecdb4db1b4041e292b5587ef0d
  • SHA1 5e15d5c504676dfff05b6aaa3366563ebd8ecd11
  • SHA512 58dd3ec52ac70de8d7bd3b5bf8118a1dec264f41819d9d9903ca38b85d51f5a03e00ca6280b4719fc8bc318369457b9fef30d7af9de879362f6a7e9214ed155f
  • SSDEEP 98304:OJkzMPAaOZjMn2PMhNnXq1WXS1eJ0qtSpoFh3nP0ZEsjBQu2AuGgVx3NsfBk3qG:OqAP8jM2PMh9q1YC65SpoX3MWQautvg7
  • TLSH
    T1CB460192F709947EC4FB5332493A12661263CD668F839683296C737C68B7ACC4F24ED5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionclayratimpactinfostealerpersistencerattrojan

  • Detects ClayRat payload

  • Family: ClayRat

    ClayRat is an Android spyware first seen in October 2025.

    trojaninfostealerratclayrat

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery
  behavioral1