Extracted

• • Target
    Фото.apk
  • Size 5.3MB
  • SHA256 1e8c7934272a2a381ee947f8aefef602a55802181b0c9584029e354a42f49f2e
  • MD5 aa735a4fbe361026e4508f8c335cc5ff
  • SHA1 6907fd4a92614f1d317fc7a51e124b1ca8a4deb2
  • SHA512 1cd65344c1293faba2f8ca372d615b00f7d25629bce375bfbba9c8ae77195001f46379e1ab955fe06875f9bd7e445032943fdbc5800209480d24fc9fdcecf220
  • SSDEEP 98304:XkPJIsfyZNom8uCKFncfws1YvLnT+tnHlAQOZclA5b+XNik3qz:u7fy7brCKhaYvLnTQFAQWb+XNE
  • TLSH
    T160460156F319947EC8FB53320A76126111A3CD668B8396837868733C69BB9CC4F26FC5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionclayratimpactinfostealerpersistencerattrojan

  • Detects ClayRat payload

  • Family: ClayRat

    ClayRat is an Android spyware first seen in October 2025.

    trojaninfostealerratclayrat

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery
  behavioral1