ghostbat | d06b9583fddb2b930de2496d049aa5e42de82bb31fe0decb830d82e6dcd29e2d

Analysis

max time kernel
6s
max time network
164s
platform
android-13_x64
resource
android-33-x64-arm64-20260708-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20260708-enlocale:en-usos:android-13-x64system
submitted
25/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NextGen_mParivahan.apk
Size 4.2MB
Sample260825-pmjrtasbqa
SHA256 d06b9583fddb2b930de2496d049aa5e42de82bb31fe0decb830d82e6dcd29e2d
MD5 59b41be4c2013e4c0f60530e483c9ac3
SHA1 f028a41bdfd7c19ba29fc3e0d0d34220609a9ea9
SHA512 b9b962a7c49297a056dc572550fe7bd73ffba1009366aabd11028f346da49d55c908e99802be6d1ffc396d6bb810d597be4a4b923b41f1d1a6865a0e6fbe10d3
SSDEEP 98304:o9Otqve4HkyXyTKvDVjkmr3nY+kiPL97DkwIXL3oxl/4:oQwveIkyCTABjXYtijd4L3oT4
TLSH
T1CD163383B91BE920F7F064390081991DE1C9067C30CD76E369DB9E9F8B2F5C99B625E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ghostbat impact infostealer rat trojan

Malware Config

Signatures

Family: GhostBat
GhostBat RAT is an Android malware that pretends to be regional transport office applications, first seen in October 2025.
trojan infostealer rat ghostbat

GhostBat RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_ghostbat

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.woki.hamo.bobe

com.woki.hamo.bobe
1⤵
- Uses Crypto APIs (Might try to encrypt user data)
PID:4082

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

base_temp.apk

Path /data/data/com.woki.hamo.bobe/cache/base_temp.apk
Size 3.9MB
SHA256 23e482dac8e49bc9c62a398ebb9d1cf6bf06d3f54389f9903c8f32ab19dc10ea
MD5 91818fdee7dcece42073da473d4328fb
SHA1 0099baf566da10ac03516349715d56ea3acd6cac
SHA512 c3d2b2121821003072005d4dd0153401b6fa67588dfba056cfac8814f169a5858fbfcb1c29c92d4740e248c3a5fc84a22c7181000e9a257839081d6f21b4a83b
SSDEEP 98304:Nd0Y45HUjHpfKmy++dYrA1A9gvFMbECQN:Nd0tHUjHp5+cA1A9nbECS
TLSH
T136162323E433C465FDFE0A3450977642F7736A144C8A56CF05EEF2AA2973A662B11F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download