Extracted

• • Target
    Дпс Радар 11.10.2025.apk
  • Size 3.8MB
  • SHA256 3dbbc10c26e82e97fe27458421b615ed4e46fc4f0515adf2b3416c3e005eaf91
  • MD5 497cf5ddfa1a820d129583903f35ae2d
  • SHA1 4da36515d15fbfb2b17ade56f0e4e06e49320e2a
  • SHA512 11b11c8d486a6d3d32b185bfe6b4d93f5e7694012fe8a7d436c35d5501e505a9b84504b5809f124031ce37710040a914033415605bce73d320187e567503fd9b
  • SSDEEP 98304:vwLEMjJhmj9OmWPrl4c0Y0Jk2xHn0pTDV3CiTDEtF73nz:vUXtkjoqfriDV+
  • TLSH
    T1EA16E092F744A53EC8FE17330A3A1A611163DD668F8386872958733CA8B75CC5F29F85
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdefense_evasiondiscoveryevasionexecutionclayratimpactinfostealerpersistencerattrojan

  • Detects ClayRat payload

  • Family: ClayRat

    ClayRat is an Android spyware first seen in October 2025.

    trojaninfostealerratclayrat

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery
  behavioral1