General
- Target seeaba.apk
- Size 2.3MB
- Sample260723-tyflrafr2x
- SHA256 4f2978c112ae420f3d163b735b16eb1d20667ed81b86fd8669420a5cb0baf795
- MD5 393a5a4a6d11ce785e78a9236bc43597
- SHA1 707f7209d18d39ac2c2bd6e67813cd925c05bab4
- SHA512 6e06652ef34d6e0b629c46101191bcf869b1c63a1adcd9e756aeffac1bc74b9a622b0a13eed244284fd620587fa060cecb0d0b3281b9e0035496ac811e9f62a6
- SSDEEP 49152:+v/vevdi6eSx+GVd0XXR2AACgPEYas5jO+wghk35B:Rveo+nXBxAzas5jO+k35B
- TLSH T139B59B46FB48A87EC4F64336463656A25163CC268B83D7876908727C5CBB6CC4F5AFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
seeaba.apk
Resource
android-x64-arm64-20260325-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
clayrat
C2
-
http://icy.claybaster.top/newclient
Targets
-
- Target seeaba.apk
- Size 2.3MB
- SHA256 4f2978c112ae420f3d163b735b16eb1d20667ed81b86fd8669420a5cb0baf795
- MD5 393a5a4a6d11ce785e78a9236bc43597
- SHA1 707f7209d18d39ac2c2bd6e67813cd925c05bab4
- SHA512 6e06652ef34d6e0b629c46101191bcf869b1c63a1adcd9e756aeffac1bc74b9a622b0a13eed244284fd620587fa060cecb0d0b3281b9e0035496ac811e9f62a6
- SSDEEP 49152:+v/vevdi6eSx+GVd0XXR2AACgPEYas5jO+wghk35B:Rveo+nXBxAzas5jO+k35B
- TLSH T139B59B46FB48A87EC4F64336463656A25163CC268B83D7876908727C5CBB6CC4F5AFC8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries information about active data network
MITRE ATT&CK Mobile v16
Defense Evasion
Foreground Persistence
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Discovery
Software Discovery
1Security Software Discovery
1System Network Connections Discovery
1