Full Report
The scam schemes enabled by Craxs Rat malware provide complete remote control of the victims’ devices. Defend yourself from being next.
Analysis Summary
# Tool/Technique: Craxs RAT
## Overview
Craxs RAT is a sophisticated Android Remote Access Trojan (RAT) designed to provide threat actors with comprehensive remote control over a victim's device. It is typically distributed through social engineering and masquerades as legitimate applications to trick users into granting extensive permissions, particularly Accessibility Services.
## Technical Details
- **Type:** Malware Family (Remote Access Trojan)
- **Platform:** Android
- **Capabilities:** Full remote control, data exfiltration, surveillance, and anti-deletion mechanisms.
- **First Seen:** Approximately 2022/2023 (Active variants discussed in 2024).
## MITRE ATT&CK Mapping
- **[TA0037 - Persistence]**
- [T1624.001 - Event Triggered Execution: Accessibility Service]
- **[TA0035 - Collection]**
- [T1430 - Access Contact List]
- [T1636.002 - File and Directory Discovery]
- [T1512 - Screen Capture]
- **[TA0041 - Impact]**
- [T1471 - External Device Remote Manipulation]
- **[TA0030 - Credential Access]**
- [T1417.001 - Input Capture: Keylogging]
## Functionality
### Core Capabilities
- **Remote Control:** Full manipulation of the smartphone interface.
- **File Management:** Ability to upload, download, and delete files on the device.
- **Information Stealing:** Access to contacts, call logs, SMS messages, and precise GPS location.
- **Surveillance:** Remote activation of the camera and microphone to monitor the victim's environment.
### Advanced Features
- **Accessibility Service Abuse:** Exploits Android’s accessibility features to bypass security prompts, interact with other apps, and log keystrokes.
- **Anti-Deletion/Persistence:** Includes features that make it difficult for the user to uninstall the application once administrative or accessibility permissions are granted.
- **Screen Streaming:** Real-time viewing of the victim's screen to capture sensitive information like banking credentials or private messages.
## Indicators of Compromise
- **File Names:** Often masquerades as "Update," "Security Tool," or clones of popular banking/social apps.
- **Network Indicators:** Communicates with C2 servers (Note: Specific IPs/Domains should be defanged, e.g., `example-c2[.]com`).
- **Behavioral Indicators:**
- Requests for "Accessibility Services" immediately upon installation.
- Unexpected background battery drain.
- Increased data usage due to screen streaming or file exfiltration.
- Hidden app icons after initial execution.
## Associated Threat Actors
- Distributed widely via "Blackhat" forums; used by various financially motivated cybercriminals and individual scammers rather than a single specific APT group.
## Detection Methods
- **Signature-based detection:** Utilization of updated Antivirus/EDR definitions that recognize known Craxs RAT code structures.
- **Behavioral detection:** Monitoring for apps that request Accessibility Services and immediately attempt to hide their icon or establish persistent C2 connections.
- **Group-IB Fraud Protection:** Analyzes cross-channel behavior to identify RAT patterns and unauthorized remote access sessions.
## Mitigation Strategies
- **Prevention measures:** Never download APK files from unofficial sources or third-party websites.
- **Hardening recommendations:**
- Disable "Install from Unknown Sources" in Android settings.
- Strictly scrutinize any app requesting "Accessibility Services."
- Regularly review device administrator apps and permissions.
- **User Education:** Train users to recognize social engineering tactics used to lure them into installing malicious "updates."
## Related Tools/Techniques
- **SpyNote:** Another prevalent Android RAT with similar surveillance features.
- **CypherRat:** A precursor/related variant that shares code similarities with Craxs.
- **Accessibility Logging:** The general technique of abusing Android's UI automation for malicious purposes.