mirax | 5c568c144cdc5afcb2e2fabbe82a297de4a7ecdcf0d0305c0c989fb79b394a8c

General

Target
google-play-virus.apk
Size 11.2MB
Sample260824-k79rhsvflc
SHA256 5c568c144cdc5afcb2e2fabbe82a297de4a7ecdcf0d0305c0c989fb79b394a8c
MD5 414333e02392be58e693f6a1576735fb
SHA1 12df1be72809a38c5f3e7e71921e29ad8cddadbc
SHA512 fe694800b4ec852af0b4492e21ff190f83eda7c32306fd53e80e1b15fa56c104f7a2e1b84b7022aabbbd49c04a1ad6365db0da6a36a56604acfd2b040b10f85c
SSDEEP 196608:giSslpsBb9iwTmnbQktOHml0IqEI7zCT5wGXb5TCoeuxXjpf4OAXGWH/vX4bYdLM:RHsbSnSHy0T7s5wGxJTGOAXGWH/vX4b3
TLSH
T107C612C8B755DE2CD23310F68416A671132B9C12A3FAC56B5D587A3C29E7CE81F61BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  google-play-virus.apk
- Size 11.2MB
- SHA256 5c568c144cdc5afcb2e2fabbe82a297de4a7ecdcf0d0305c0c989fb79b394a8c
- MD5 414333e02392be58e693f6a1576735fb
- SHA1 12df1be72809a38c5f3e7e71921e29ad8cddadbc
- SHA512 fe694800b4ec852af0b4492e21ff190f83eda7c32306fd53e80e1b15fa56c104f7a2e1b84b7022aabbbd49c04a1ad6365db0da6a36a56604acfd2b040b10f85c
- SSDEEP 196608:giSslpsBb9iwTmnbQktOHml0IqEI7zCT5wGXb5TCoeuxXjpf4OAXGWH/vX4bYdLM:RHsbSnSHy0T7s5wGxJTGOAXGWH/vX4b3
- TLSH
  T107C612C8B755DE2CD23310F68416A671132B9C12A3FAC56B5D587A3C29E7CE81F61BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker collection credential_access defense_evasion discovery evasion execution mirax impact infostealer persistence rat trojan
- Android Mirax payload
- Family: Mirax
  Mirax is an Android Android RAT first seen in 2026.
  rat trojan infostealer mirax
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Reads the content of SMS inbox messages.
  collection
- Reads the content of outgoing SMS messages.
  collection
- Reads the content of the SMS messages.
  collection
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  defense_evasion persistence
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
behavioral1 behavioral2 behavioral3