Full Report
CraxsRAT is a notorious Android malware family known for its Remote Administration Tools (RAT), which include remote device control and advanced spyware functions like keylogging, gesture manipulation, and recording of cameras, screens, and calls.
Analysis Summary
# Tool/Technique: CraxsRAT
## Overview
CraxsRAT is a sophisticated and commercialized Android Remote Administration Tool (RAT) used by cybercriminals to gain total control over infected mobile devices. Its primary purpose is to facilitate financial fraud and data exfiltration through advanced spyware functionalities, often bypassing standard Android security measures via the abuse of Accessibility Services.
## Technical Details
- **Type:** Malware family (RAT / Spyware)
- **Platform:** Android
- **Capabilities:** Remote control, keylogging, screen recording, gesture manipulation, and bypassing battery optimization.
- **First Seen:** Roughly 2022-2023 (Active development continues with frequent version updates).
## MITRE ATT&CK Mapping
- **[TA0030 - Execution]**
- [T1204.001 - User Execution: Malicious Link]
- **[TA0032 - Persistence]**
- [T1624.001 - Event-Triggered Execution: Broadcast Receivers]
- **[TA0033 - Privilege Escalation]**
- [T1548 - Abuse Accessibility Services]
- **[TA0035 - Initial Access]**
- [T1474 - Supply Chain Compromise: App Stores/Third-party sites]
- **[TA0037 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
- **[TA0040 - Impact]**
- [T1491 - Defacement (Customizing app appearance)]
## Functionality
### Core Capabilities
- **Remote File Management:** Download, upload, and delete files on the target device.
- **Surveillance:** Real-time access to cameras (front and back), microphone recording, and call monitoring.
- **Location Tracking:** Real-time GPS tracking of the victim.
- **Communication Theft:** Access to SMS messages, call logs, and contact lists.
### Advanced Features
- **Accessibility Service Abuse:** Automates clicks and gestures to grant permissions without user consent.
- **Anti-Deletion:** Prevents the user from uninstalling the application by closing the settings menu when the app's entry is selected.
- **Keylogging:** Captures every keystroke, including passwords and banking credentials.
- **Live Screen Control:** High-speed screen streaming that allows the attacker to interact with the UI remotely.
- **Overlay Attacks:** Displaying fake login windows over legitimate banking apps.
## Indicators of Compromise
### File Hashes (SHA256)
- `c14990b0975037a4b62b0cd3593997cc20496dfffdbc9b72794298f64546fe1efe2`
- `4bf42f990bfb145e680eecb8ce6be30bfd60ae88fd7b169212044639e11380f8`
- `52b33b6e7b547c850c73dd5f133124dfa48f881113da3d98952fc99f5f9f7bba`
- `d4507a94fafce38b459fd3fe804eab8b2cc6aa558057b7d4c1c4b0847f9b3bc2`
- `9ebb60ada8b19e06a92fc8c868959626deee355aef796c16f9e233f6d52c0306`
### File Names (Package Names)
- `com.apcop.hhiveliveryd900`
- `com.app.dzdzdz1m`
- `com.ccmso.cm5000k`
- `com.tcmso.poms9000k`
- `com.go.pomnou1000k`
- `com.app.hilldeliveryd900`
- `com.limn.lkosd8000k`
### Behavioral Indicators
- Repeated requests to enable **Accessibility Services**.
- Unexpected "Battery Optimization" exclusion requests.
- App icons disappearing immediately after installation (hiding behavior).
- Constant background network traffic to unknown external IPs.
## Associated Threat Actors
- Distributed and used by various cybercriminal groups; often sold as a service (MaaS) on underground forums and Telegram channels.
## Detection Methods
- **Signature-based:** Antivirus detection for known CraxsRAT APK signatures and package names.
- **Behavioral detection:** Monitoring for apps that abuse Accessibility Services or perform rapid UI interactions (automated clicking).
- **Network Analysis:** Detecting C2 communication patterns, typically over non-standard ports or encrypted traffic to suspicious domains.
## Mitigation Strategies
- **Prevention:** Disable "Install from Unknown Sources" in Android settings.
- **Hardening:** Regularly review "Accessibility" permissions and revoke access for any suspicious or unnecessary applications.
- **Policy:** Use Mobile Device Management (MDM) to enforce strict app installation policies and detect rooted devices.
## Related Tools/Techniques
- **SpyMax / CypherRAT:** Previous iterations or related frameworks by the same developer family.
- **TeaBot / Anatsa:** Similar Android banking trojans that leverage Accessibility Services for financial theft.