clayrat | 3dbbc10c26e82e97fe27458421b615ed4e46fc4f0515adf2b3416c3e005eaf91

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
186s
max time network
187s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
22/10/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Дпс Радар 11.10.2025 (3).apk
Size 3.8MB
Sample261022-e2gwnazy3m
SHA256 3dbbc10c26e82e97fe27458421b615ed4e46fc4f0515adf2b3416c3e005eaf91
MD5 497cf5ddfa1a820d129583903f35ae2d
SHA1 4da36515d15fbfb2b17ade56f0e4e06e49320e2a
SHA512 11b11c8d486a6d3d32b185bfe6b4d93f5e7694012fe8a7d436c35d5501e505a9b84504b5809f124031ce37710040a914033415605bce73d320187e567503fd9b
SSDEEP 98304:vwLEMjJhmj9OmWPrl4c0Y0Jk2xHn0pTDV3CiTDEtF73nz:vUXtkjoqfriDV+
TLSH
T1EA16E092F744A53EC8FE17330A3A1A611163DD668F8386872958733CA8B75CC5F29F85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion discovery evasion execution clayrat impact infostealer persistence rat trojan

Malware Config

Extracted

Family

clayrat

http://lite.trustnik.sbs/newclient

Signatures

Family: ClayRat
ClayRat is an Android spyware first seen in October 2025.
trojan infostealer rat clayrat

Detects ClayRat payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_clayrat

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/xgr.u1vbee.r8x8wht1455/code_cache/bStOX.rde	4785	xgr.u1vbee.r8x8wht1455
/data/user/0/xgr.u1vbee.r8x8wht1455/code_cache/bStOX.rde	4785	xgr.u1vbee.r8x8wht1455

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Unexpected DNS network traffic destination 21 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	1.0.0.1
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	208.67.222.222
Destination IP	1.0.0.1
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	208.67.222.222
Destination IP	208.67.220.220

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	xgr.u1vbee.r8x8wht1455

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	xgr.u1vbee.r8x8wht1455

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	xgr.u1vbee.r8x8wht1455

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	xgr.u1vbee.r8x8wht1455

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	xgr.u1vbee.r8x8wht1455

xgr.u1vbee.r8x8wht1455
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4785

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

bStOX.rde.tmp

Path /data/data/xgr.u1vbee.r8x8wht1455/code_cache/bStOX.rde.tmp
Size 2.0MB
SHA256 8fd8def3bd26faf5e0f017a90936c3df1de4a6b37443710282b3860d1e1fb435
MD5 a83b9fc378fc61fc09768ddd3f34beb2
SHA1 d3a794abb0727871d734f9614d6c4b66db3b4cda
SHA512 7f7bb2a8f0d3e23f06ba1ba48d7f1775acc230db346e491b6c78145ff16eae73138ba49f58733210665423afdacad682a995518c8947dc006baf1e487585c0e4
SSDEEP 24576:ytudIf0L8pQ4ddhQLbzK6f8SaFWhxlwc7DZCNBe0ufoWg08Fbz86:y++0L8pQ4CxlwcnZCVHWA
TLSH
T173A57EF1B7414A90D8D972397CFECE54F72D6CCDE6CE3A01110963B1AA1A2F53AA4187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bStOX.rde.tmp

Path /data/data/xgr.u1vbee.r8x8wht1455/code_cache/bStOX.rde.tmp
Size 2.0MB
SHA256 7577f6edd2e07a06f5c5ff79aad72aac6164d2ca0814bacf6f9dc88a2323d0c5
MD5 cc245714b471d035772f3d1f5316579a
SHA1 4cc2bae6f48864b2b8894625cdb1f132b9567956
SHA512 11a545e649bcb65f760c350dad8d4dfc009de80dc86c9c197a14d817bac5acf0c701817309d1d010eb8a29967b8d7df389ea7eac9daf4233fe063f5acddc9889
SSDEEP 24576:WtudIf0L8pQ4ddhQLbzK6f8SaFWhxlwc7DZCNBe0ufoWg08Fbz86:W++0L8pQ4CxlwcnZCVHWA
TLSH
T1DCA57EF1B7414A90D8D972397CFECE54F72D6CCDE6CE3A01110963B1AA1A2F53AA4187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bStOX.rde.cur.prof

Path /data/data/xgr.u1vbee.r8x8wht1455/code_cache/oat/bStOX.rde.cur.prof
Size 724B
SHA256 be3322f2674c768c8742f28e0d0bd33e7674aea5604e82031d4f5b41177e16ea
MD5 a453404464c34459cabe68725c848401
SHA1 e14410f9280f29332e0802420ca9e2a6a0143513
SHA512 c7ece0f95b1e5d09eb32390aa4c57a29895ffe69e19705dae5e13a30a940f6fc6c6e72c02900a36eb3bca642b89e1e3bd18c6aa874443bd3fddaa74cd2ab49f3
TLSH
T14D016570D13C85136E58E8248D420A209654D50FAD7D2907A7EDE003987D9B6327468B
MD5 SHA1 SHA512 TLSH

Submit Download

sms_storage.db

Path /data/data/xgr.u1vbee.r8x8wht1455/databases/sms_storage.db
Size 20KB
SHA256 106db26296740f99951c69f9e9cd83e75a05f53dec88f1806d989758ad95cf70
MD5 46b832a75e0f7ebeed59cc662b072250
SHA1 5dc9207c95acc7af252dfb56e02b189824b48756
SHA512 1e223f0f457d598e6fdc85b9e83f233dd881a51ae3dc0bf882773eb89b98dde06d73308f720c9ab9f027c98ec4515a37e23b854d069ff3ea398ed7b0675eff50
SSDEEP 12:TLewbqyNTSFbyeWQl1kMLQWBkfRmBEyPbAVOwG:TLewb/AWO1ZkWbGSEG
TLSH
T15892E9CA47111A0AC28A4632A9B5E3D11AF4A25FC7E5EB9362F84C215E4118976B2E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sms_storage.db-journal

Path /data/data/xgr.u1vbee.r8x8wht1455/databases/sms_storage.db-journal
Size 512B
SHA256 337afa37adc371e0c980c4cf19ce9bd3bfd13305acef177527690040072bea8f
MD5 d2f7a820011d0447505f797ba1587a06
SHA1 c36528b7191301091bfccc6b0f108293ede6f0ab
SHA512 69eec6525c29581af82bdc8fe251c47de18c3ca9bcedce60cc626b7f1eb9a330dc3c4344dc22dce37b973b459e4b9bc6b07c330903e3b751cdd900c3d3706570
MD5 SHA1 SHA512

Submit Download

sms_storage.db-journal

Path /data/data/xgr.u1vbee.r8x8wht1455/databases/sms_storage.db-journal
Size 8KB
SHA256 7dbeb0be12729c8e608590e78512f11cad40ee7f9575f37d9260bb34fd8255d9
MD5 de23448aee7d04525223f7220797269f
SHA1 c0166b5462182c580ba80d69561dfa6dcaa1a8a9
SHA512 39e84bf5731b08e2d1744d018a3b76e59d71db15b49404f7d1198f1c6d37881ee72658a09a66657b6cc755c42af750625b1be61beb2f1602d947b192a6c70573
SSDEEP 6:7+/l9mGn12Nvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKz:7+tMqLiuWdYRmBEyPbI
TLSH
T16602228A63800822C8291AB798D883400E08B7A88561CB175EA009A83C0B5CCE4E0D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sms_storage.db-journal

Path /data/data/xgr.u1vbee.r8x8wht1455/databases/sms_storage.db-journal
Size 8KB
SHA256 04eb2ab1e3a8b55c2346b0dff74a2a5c231c5810762371c11ad87d3781d99d3d
MD5 d770a3dca80a6754e31ce4495984121c
SHA1 6d8020e4d246bb82a49a563cdc0f82733bfabd68
SHA512 5efa8c0a21073f2c51eae33951d5e3459fe6860fcf843293328a97fe98081854d00ab836e383056014ef4d09ce7db2ba655027c605bd2b27a742315975e38d87
SSDEEP 6:7+/l9sz8FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKX8t/Uz:7+tuiqLJdeWRmBEyPbN1Uz
TLSH
T18F02228C73410823C0291777A0CA83801F15A73CB273CB2716910A542C46ACCA890D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/xgr.u1vbee.r8x8wht1455/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 9f27d15e2d15d51c82579b60cf79d0d33f5118e2a78f6d194a37a780f1d5ba23
MD5 b0aff9ab68e63031254a104e2a879f6b
SHA1 1af47d863758dadbb43c6fc7f1352e59a7d446f2
SHA512 033ddb452bbde6cb3622a54207704a8ed4c03ed141c86cceb8d1144210d9059bb6c40a971984500217fda0653deaa7252b3a7f2f67da44f8c8cf88cf4a8f68a1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb
Size 4KB
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb
TLSH
T1A8810240534000E1D06406B2549113080B0AD1A4A5410B13264200428C455840C60A85
MD5 SHA1 SHA512 TLSH

Submit Download

androidx.work.workdb-journal

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 424b1a2cde42071ce9e1f282810f41d0b695ffe9b43580b0ff7214f25ea1f26c
MD5 166473872440fbde4d8124606799fc7b
SHA1 09b846183933498e830b3439863109ac7a576dbe
SHA512 4584aaa2f7ab87253cb71596c1ab616c555e901fcf2797ee4be2392552e5ffe15e16b8bea1b48d41d9a5dc1abc48e0906534f2303c4f4cb793b320fc67857cf5
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-wal
Size 382KB
SHA256 5c95f65622255c9072363c002ceacd187e940b80a410eb57d92e930fb4b88842
MD5 0254b2e5706c48502d57f1913fca3a5e
SHA1 add302c8973fef31e7b49b8e57c7c76601032ece
SHA512 a786695cde27e34da7994c82ec9dd7cf30dddd5022542f19fc3318a579a91dcc2c92c4236ba184957d8698c9780d638e150c054a6bfccf53b361f851cd68a557
SSDEEP 6144:gX+zv9m8t8g8Kh8Az81z8Xz8fz8Sz8P28if8LM8d:h
TLSH
T1F08422EB3352A445FE6FA338A8AB0391AD33F4F94510F4D1D73327443D9960D9A9AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 407aee0da45ef9d55a29acaa752d10f3c39d25f6f9765ed5ef076385581dd766
MD5 a23516eabdb79a6fd419946804585247
SHA1 f27263adf53755c671e635fff7e80bfc96d7d450
SHA512 cf4a4ccd374abb25a5744dc7d9cac6d6c0c69825d2327a0ca4e1d277e806f991833f27caddcf2d43942a6cddb3b12b84cf5fe937a2ffdd62d6ab8ffd08036ee4
SSDEEP 6:KwFvfQMRg9FZde/kPlOERX4PBX4ogLugMBX4suuK+/S6/MHm4WOw2:KwdHqzdeWRmBEyPbP/SWVOw2
TLSH
T18672C2D493801A16C12CD23790D4C3801FA1761D3A12CF4F72A1A41D7C02F88A870D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

androidx.work.workdb-wal

Path /data/data/xgr.u1vbee.r8x8wht1455/no_backup/androidx.work.workdb-wal
Size 112KB
SHA256 35a37d63dfff8141d6c74ef853e8ea286adf38c52a6c2ef97c0151f05f3a6c70
MD5 8d68e4b562a52d2a923300c314caa2fb
SHA1 e1a74666cff1227f419a2423333769b3faa3e571
SHA512 fc1563d3aba5d03c4229f6572b2de727507a5e5b72e003817580c949df89b2bb667afbb94ed05667252b6b550603cde2595eb334b142fa62a1e4d170a46c3a4c
SSDEEP 96:erZXWHDP6+hdjnHtDRgL/f8dKeKcK+zSXKM+6D86T0ExV:e5+ndjnHt9S/f8JzSV+6D86T0ED
TLSH
T128B341CD0F592500C0ADE4B095D00FE17A7E512EA393E7D624919079BDC6D20ED39CF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/xgr.u1vbee.r8x8wht1455/primary.prof
Size 1KB
SHA256 8159a0b0b372a13abd74572e1f11072aa7b53a773f6766e14be2f0c329705ccb
MD5 4e64f50a30e318de779dd934e842077a
SHA1 2f13462f3fe5a3386e161e01716b7142794adeb5
SHA512 9f93d717e6140d4d8d910065363f1625cc38c9fa23a7bc308f066f79dd6a3c770e4b81641f77be55621fa83b0d6eee579ce20de23eccfe894e29a308b5702340
TLSH
T16631E904FA047641476E73943803AF665345601CFED7860B781EB3A815760D9327F366
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/xgr.u1vbee.r8x8wht1455/primary.prof
Size 445B
SHA256 28e8a4f8ccd68aa1bbe1d83c9bb57af8c36e5347121c9c0055db2c4ef86fb24b
MD5 92b5b403e2c2bc634c9fae4193347979
SHA1 dbecdb6dbb52a45cc77f3723c24acae3f24156e1
SHA512 8b958c7a84bd2b0cb14d0e0a867cd250087550b3db408de823f7de11f334b3188352eeac8349a234e54bb40977863eb2c5bb1b946b1b785d96175528b3c847d9
TLSH
T1D6F0DCF360AA7AE448C6C90F26C05E8230D7D59528C13FA0360129D2156B621B7C5464
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads