Extracted

• • Target
    FishScanner.apk
  • Size 5.3MB
  • SHA256 93893eba96702f963b6e005e8b9ab046dae883046c9673e8ac0caa73194bfa74
  • MD5 f9063539c023665affea21770e0dff9a
  • SHA1 c06151b1b1c6e7d3496329af229024a31f78f402
  • SHA512 bd3ba1047d83816f7b44558daf7dc2b05b1d4a42c3b72c5cfd35faf970f6b1e2f1494ed410451be17ec2adff41fed449fbdc847ef2d0ba18aa8925eac4256635
  • SSDEEP 98304:6dXIGmeh2gEUnP+M+nD7KqXwHN/WqVcZccGQXQTp4iqns8+eRPmAWXTk3q8:6hjhF1knD7AcI4iG+KmA6u
  • TLSH
    T15446F156F748943EC8FB2732057656A11263CD668F8396832E2C733C68B76C85F29ED4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionexecutionclayratimpactinfostealerpersistencerattrojan

  • Detects ClayRat payload

  • Family: ClayRat

    ClayRat is an Android spyware first seen in October 2025.

    trojaninfostealerratclayrat

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery
  behavioral1