ghostbat | f64e4261fcf4e632af5be9df0e3d9c4ed014826e760840d58a67ec67558b5f2c

Analysis

max time kernel
6s
max time network
152s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
20/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nextgen_mParivahan.apk
Size 4.0MB
Sample260820-pellfawfnb
SHA256 f64e4261fcf4e632af5be9df0e3d9c4ed014826e760840d58a67ec67558b5f2c
MD5 8a91e33f62d3d932e3904182fc9296d9
SHA1 f8a11e3c88779cea10f364658e60bfaf1a3cd4eb
SHA512 57ff60e5a5062542683ccf3810ee5b05c879975aa2ebf3125a6317b07095298e8094d0c58f89abb1b7feccd0f3661c61bb96cf52b94424adbfc42c0286d14242
SSDEEP 98304:HwObS9aWZ4H4zHgY05J5mGhf7IBjNNVfs38bwGI24B9ur:QXxZY4zI9mMQny38bwGhKC
TLSH
T1FB1633FC1C6E482AF18D9BBD45CAE3C68B289547DAC70C1BB91D16F927C97528CBC844
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ghostbat impact infostealer rat trojan

Malware Config

Signatures

Family: GhostBat
GhostBat RAT is an Android malware that pretends to be regional transport office applications, first seen in October 2025.
trojan infostealer rat ghostbat

GhostBat RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_ghostbat

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.nagu.nasu.kamo

com.nagu.nasu.kamo
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4182

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

base_temp.apk

Path /data/data/com.nagu.nasu.kamo/cache/base_temp.apk
Size 3.7MB
SHA256 909b7f17b4b0c862759ca1508050a61d3711c5592bcdccb19aa3b073ced8b38e
MD5 7696db5d6e2935395b4489f97e7dbc6b
SHA1 0de7ffb9e6a9fd8f0f089615dda500f57a50b876
SHA512 b9c606100dd451876975fd5835904d43b08d864e69f0331029812d937d7ff41e0b96d0a91a5a97c488b96e9912dad3ad7b6b3059804f9829168a894def37cc2a
SSDEEP 98304:KLXByO01274WOde8FKe4Bz23va51F0cLyfIel2B2:mRc2EWmFT13G0SyfIel2B2
TLSH
T1600623B3F173CE69E9FF07344093B54173327A059889610F0AEEF2DA29739662B15E85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download