clayrat | 3dbbc10c26e82e97fe27458421b615ed4e46fc4f0515adf2b3416c3e005eaf91

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
176s
max time network
181s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
05/09/2026, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Дпс Радар 11.10.2025.apk
Size 3.8MB
Sample260905-kme2eahm6v
SHA256 3dbbc10c26e82e97fe27458421b615ed4e46fc4f0515adf2b3416c3e005eaf91
MD5 497cf5ddfa1a820d129583903f35ae2d
SHA1 4da36515d15fbfb2b17ade56f0e4e06e49320e2a
SHA512 11b11c8d486a6d3d32b185bfe6b4d93f5e7694012fe8a7d436c35d5501e505a9b84504b5809f124031ce37710040a914033415605bce73d320187e567503fd9b
SSDEEP 98304:vwLEMjJhmj9OmWPrl4c0Y0Jk2xHn0pTDV3CiTDEtF73nz:vUXtkjoqfriDV+
TLSH
T1EA16E092F744A53EC8FE17330A3A1A611163DD668F8386872958733CA8B75CC5F29F85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion discovery evasion execution clayrat impact infostealer persistence rat trojan

Malware Config

Extracted

Family

clayrat

http://lite.trustnik.sbs/newclient

Signatures

Family: ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat

Detects ClayRat payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_clayrat

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/xgr.u1vbee.r8x8wht1455/code_cache/bStOX.rde	4829	xgr.u1vbee.r8x8wht1455
/data/user/0/xgr.u1vbee.r8x8wht1455/code_cache/bStOX.rde	4829	xgr.u1vbee.r8x8wht1455

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Unexpected DNS network traffic destination 21 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	1.0.0.1
Destination IP	208.67.220.220
Destination IP	1.0.0.1
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	xgr.u1vbee.r8x8wht1455

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	xgr.u1vbee.r8x8wht1455

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	xgr.u1vbee.r8x8wht1455

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	xgr.u1vbee.r8x8wht1455

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	xgr.u1vbee.r8x8wht1455

xgr.u1vbee.r8x8wht1455
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4829

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

bStOX.rde.tmp

Path /data/data/xgr.u1vbee.r8x8wht1455/code_cache/bStOX.rde.tmp
Size 2.0MB
SHA256 8fd8def3bd26faf5e0f017a90936c3df1de4a6b37443710282b3860d1e1fb435
MD5 a83b9fc378fc61fc09768ddd3f34beb2
SHA1 d3a794abb0727871d734f9614d6c4b66db3b4cda
SHA512 7f7bb2a8f0d3e23f06ba1ba48d7f1775acc230db346e491b6c78145ff16eae73138ba49f58733210665423afdacad682a995518c8947dc006baf1e487585c0e4
SSDEEP 24576:ytudIf0L8pQ4ddhQLbzK6f8SaFWhxlwc7DZCNBe0ufoWg08Fbz86:y++0L8pQ4CxlwcnZCVHWA
TLSH
T173A57EF1B7414A90D8D972397CFECE54F72D6CCDE6CE3A01110963B1AA1A2F53AA4187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bStOX.rde.tmp

Path /data/data/xgr.u1vbee.r8x8wht1455/code_cache/bStOX.rde.tmp
Size 2.0MB
SHA256 7577f6edd2e07a06f5c5ff79aad72aac6164d2ca0814bacf6f9dc88a2323d0c5
MD5 cc245714b471d035772f3d1f5316579a
SHA1 4cc2bae6f48864b2b8894625cdb1f132b9567956
SHA512 11a545e649bcb65f760c350dad8d4dfc009de80dc86c9c197a14d817bac5acf0c701817309d1d010eb8a29967b8d7df389ea7eac9daf4233fe063f5acddc9889
SSDEEP 24576:WtudIf0L8pQ4ddhQLbzK6f8SaFWhxlwc7DZCNBe0ufoWg08Fbz86:W++0L8pQ4CxlwcnZCVHWA
TLSH
T1DCA57EF1B7414A90D8D972397CFECE54F72D6CCDE6CE3A01110963B1AA1A2F53AA4187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bStOX.rde.cur.prof

Path /data/data/xgr.u1vbee.r8x8wht1455/code_cache/oat/bStOX.rde.cur.prof
Size 725B
SHA256 9314a7f790a9c26d818cf94ebf768211febfffb2dfa017e6f5b1ff0c40fae0f2
MD5 c2e0dce4f99d874b3dd96e2373cc09c1
SHA1 cd18e74ba59c95fcd60e24098b6c1a1a6dafbb0a
SHA512 19b001ce74e5dd3c4a1b3ceb73c5161034fa485e9016df87f2645181c19526bc286bfa570c5dc071af258d0179243223e9e8e02ce9c733365c4795d5c0889de8
TLSH
T1720199421C6F4599D68755709495335355C4F4541BB69A31414E0EF7320D3CE7C754EA
MD5 SHA1 SHA512 TLSH

Submit Download

sms_storage.db

Path /data/data/xgr.u1vbee.r8x8wht1455/databases/sms_storage.db
Size 20KB
SHA256 106db26296740f99951c69f9e9cd83e75a05f53dec88f1806d989758ad95cf70
MD5 46b832a75e0f7ebeed59cc662b072250
SHA1 5dc9207c95acc7af252dfb56e02b189824b48756
SHA512 1e223f0f457d598e6fdc85b9e83f233dd881a51ae3dc0bf882773eb89b98dde06d73308f720c9ab9f027c98ec4515a37e23b854d069ff3ea398ed7b0675eff50
SSDEEP 12:TLewbqyNTSFbyeWQl1kMLQWBkfRmBEyPbAVOwG:TLewb/AWO1ZkWbGSEG
TLSH
T15892E9CA47111A0AC28A4632A9B5E3D11AF4A25FC7E5EB9362F84C215E4118976B2E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sms_storage.db-journal

Path /data/data/xgr.u1vbee.r8x8wht1455/databases/sms_storage.db-journal
Size 512B
SHA256 48b91c99dccb2b673aec6425ba3ecde8d284ef03744a19871c513c295f97d2d3
MD5 97412db3fc6c71edd6b45e6df249aff4
SHA1 a85dcf636a9efced30f70cc022b740d01f1fff45
SHA512 5461269a587841eeb9e86d17c71691e3bb189fc7118bd1ce8751b9d987db02b93a7fc55b27a6d969e533aa605b709cdb6f7e889cca5e2e458f771c77978cd5bb
MD5 SHA1 SHA512

Submit Download

sms_storage.db-journal

Path /data/data/xgr.u1vbee.r8x8wht1455/databases/sms_storage.db-journal
Size 8KB
SHA256 7e8615cd93e3da67fd50f2addb854eed52da446c9cfd9d7e0a938ccc8e8e52ba
MD5 49c03f667a12b75d313cc8ddfca9d19c
SHA1 13d42082bfbf0c860c6532954a650ae8b7734987
SHA512 72f9d3562c89dafae7d0cd4e08a339e299edbc82a11b93db7c7f238d75d52bcccfccaf75d5763c7a7563132acc2b7aff9973752a3fe048f941915fb156c4980e
SSDEEP 6:7+/l9x7/lgn1p7l/ng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK8n:7+tLWdqLiuWdYRmBEyPbL
TLSH
T18802229CA3800813CC2F977790D883490E40A738A562CB371690089C2C07CCCE4A0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sms_storage.db-journal

Path /data/data/xgr.u1vbee.r8x8wht1455/databases/sms_storage.db-journal
Size 8KB
SHA256 9e4c88ce1eb2fb76281a8c9bce9b70c77e12d7935f0cefc696e29f57aa736219
MD5 e4cbb618333d8d13ee4ad5a342a1e329
SHA1 60c1e4439352d5c4c911add6434e18014be073bf
SHA512 300fab913f4c214fe63ab78927f50e0c002b65e90742cd4f56e1a15dd528003cb9ca94c4fbd2816d4c724fd650434dfd9495a001b9cd521d45faf5fb3813a0d0
SSDEEP 6:7+/l95KSOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKiS//sR0:7+triqLJdeWRmBEyPbTysS
TLSH
T1C502228D6B400803C129977FB4C883411E10A7399323CB4B1AE108D62D0ABCCE8A0D50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/xgr.u1vbee.r8x8wht1455/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 5c91ad4a9de2ff95cdd13c6a5d819da037e72664fb7c3f9ec2d7b954c666b74e
MD5 12318dd2bc605b567ae5311784cac6bb
SHA1 6242350b581257fedf90a906344e22155ab00f06
SHA512 641ad8c9c1d12c360bd45179bb1c44b573baeca8babeddf4ed7a504a40b9502f2a8a2c5a4b75cc1c398df2e8ab6e639dca838a68a637c402d2b00f71dc25a9b6
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb
Size 100KB
SHA256 718d090c78c6201ceea156d60d7f290de5acfebb9af016d291bd8a012daf6a27
MD5 07c315e44c531aea6ff9844a4572fd3f
SHA1 0e84bb4cadc127a2cdea6ff53c910e76f34331f9
SHA512 bdfd51950e8af841116f371a0e42bfedb806c76a3af18ff3600f8a520e07f7efd362497efd7f06002f046901202e15c8f3ed63ca6127525f6c9655e537962565
SSDEEP 384:G13p13+v13X13O7ndjnHt9S/f8JzSk6D86T0ED:w3b3+N3l3GxHSsJzSk6D86ZD
TLSH
T1C8A382CD3F695104C8EF78F1D8C50BB0677E643D4A82F3E065230225FDE6A12D8698A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b2121eb7bd76d05fcc8831b7bb8e4bfb7f7cf93b87480bd92671ba8b4e08eb75
MD5 c69e112d2cab671306f50089dcceef6a
SHA1 3237c46482c107fdc6fc37448876aea50d9e1aa6
SHA512 8cb8803fde74e388508bbfb5d9e30aa9520ddcb418fa1d9a429657107ad1c342d99e371aef3fb3995d07b25c0ce533895d17e9d88fec5a9116d2a463ac3db43a
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-wal
Size 418KB
SHA256 061787a314b3313c2b6ad215d7bdddceefe3a914f3682d3354bca89928a970aa
MD5 6cf7a51c58f149f33a1f14a5f57607d5
SHA1 87fb40dc3a974ba5f84329439d423a17ba4c073f
SHA512 58a587162d26b9f19ea5fea8ded5231877b53e961deae2ee4bf27db4870cacae3f3e3b649de9bc0ba3f6d41a55588ba5e5c8216fe9a0bcfa41f3c3908cae97a2
SSDEEP 6144:YvWV6OvWVZAvWVqAFWVCAFWVUBAbVopebVCk1sBOjV/V5VphVZ+V/+VQ+Vo+V4+m:/
TLSH
T14C9411EB3361C147F99FB7F8ACCF03754772B8F50846E0E057271794BEA6A0A949844A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 b3699c46abecca243ae30fe3d7ea5f388513e852210ca5152bfad2d277d768f0
MD5 772b0ecefaee7a4b8b26cf43f44b1659
SHA1 d82ae08201af602d605485dd0e243de2d01fb769
SHA512 e8a4d230d8cd74d8fff6f93af7293ab045b90088ac457b857e96d6b8fc4ab1846e1c505fce0f6bf2c97d8ed0fc8e2a08974bd3af5ccc76ccf1a109e7ef4ac048
SSDEEP 6:KGPw6wdkZyPRauX9FZde/kPlOERX4PBX4ogLugMBX4suuK+/wPoXryv6UVOw2:Kqw6ZWR/zdeWRmBEyPbP/koO66Ow2
TLSH
T14E72C2E4B7A40913C14DD37254D4C7421E64E22B6752C78B16A118A0EC23ECCB052D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 8cc39a9fc8e50a1840f76339c1265914aa1cb88f9a2ca63e9e046111438e1f0e
MD5 192d7953830e738425dea2e2f41918c2
SHA1 5fef4f6f991b2676b9aa657b824ca0ad638e8676
SHA512 52aec1fcb2422ac8cff3145d3095f2ee6d65e95ae667132676adf4eeb42d3b01ddb0317f0fc0e759f091091fa915bff50871909ca3b17ec2c37a69fe2c2a91c2
SSDEEP 96:xASwbGWsDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:XwbGBndjnHt9S/f8JzSV+6D86T0ED
TLSH
T143B3D1CD0F6D2601C0ADA4B0A5D00FA1793E812E9793E3E565A140B5EDD7D21EE26CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/xgr.u1vbee.r8x8wht1455/primary.prof
Size 1KB
SHA256 8159a0b0b372a13abd74572e1f11072aa7b53a773f6766e14be2f0c329705ccb
MD5 4e64f50a30e318de779dd934e842077a
SHA1 2f13462f3fe5a3386e161e01716b7142794adeb5
SHA512 9f93d717e6140d4d8d910065363f1625cc38c9fa23a7bc308f066f79dd6a3c770e4b81641f77be55621fa83b0d6eee579ce20de23eccfe894e29a308b5702340
TLSH
T16631E904FA047641476E73943803AF665345601CFED7860B781EB3A815760D9327F366
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/xgr.u1vbee.r8x8wht1455/primary.prof
Size 441B
SHA256 b73646c87ff00fef53c8bb055e0c57570802908bbe3a8e08bafbadfd55cf5d7b
MD5 ecd72d1d90178eeba55e55314521a83b
SHA1 5b6767aa6c77c484e3669df9bfbf86c4bf807b14
SHA512 8291af4d9608281821e1719e3551d16d560d62dffab426992d84cf4a1588b5ec23f7c5dae98f589f225cf2e8d84e475d532a01dcff50fbf780bcdc645e70f199
TLSH
T1A9F0235F10A576049B6FD54C2B600F5AE6A37CF529E8D7180764E40439942009A36833
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads