Full Report
Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack.
Analysis Summary
# Tool/Technique: CraxsRAT
## Overview
CraxsRAT is a sophisticated Android Remote Access Trojan (RAT) that has resurfaced with enhanced capabilities. It is designed to provide threat actors with extensive control over infected mobile devices. The malware is notable for its use of Android's Accessibility Services to automate malicious actions and maintain persistence, primarily targeting financial information and personal data through advanced surveillance and remote control features.
## Technical Details
- **Type:** Malware Family (Remote Access Trojan)
- **Platform:** Android
- **Capabilities:** Autonomous privilege abuse, expanded command-and-control (C2), robust persistence, real-time screen monitoring, and file manipulation.
- **First Seen:** Variant surfaced prominently in mid-2023 (evolution of previous Craxs versions).
## MITRE ATT&CK Mapping
- **[TA0027 - Initial Access]**
- T1475 - Drive-by ITW (In the Wild) / Malicious Links
- **[TA0028 - Persistence]**
- T1624.001 - Event Triggered Execution: Accessibility Service
- **[TA0029 - Privilege Escalation]**
- T1548 - Abuse Elevation Control Mechanism (Accessibility Services)
- **[TA0030 - Defense Evasion]**
- T1622 - Debugger Evasion (Anti-analysis)
- T1406 - Obfuscation
- **[TA0035 - Collection]**
- T1512 - Screen Capture
- T1430 - Location Tracking
- T1636.002 - Audio Capture
- **[TA0041 - Command and Control]**
- T1071.001 - Web Protocols (WebSocket/HTTPS)
## Functionality
### Core Capabilities
- **Remote File Management:** Ability to upload, download, and delete files on the device.
- **Surveillance:** Real-time monitoring of the device screen, camera access, and microphone recording.
- **Information Stealing:** Access to contacts, SMS messages, call logs, and precise GPS location.
- **Communication Interception:** Ability to read and send SMS messages, often used to intercept 2FA codes.
### Advanced Features
- **Autonomous Privilege Abuse:** Utilizes Accessibility Services to grant itself further permissions automatically without user intervention.
- **Robust Persistence Stack:** Implements multiple triggers to ensure the malware restarts if the process is killed or the device reboots.
- **C2 Communication:** Utilizes WebSockets (wss://) for real-time, low-latency communication with the attacker's server.
- **Anti-Deletion:** Prevents the user from uninstalling the app by closing the "Settings" or "App Info" page using Accessibility Services.
## Indicators of Compromise
- **File Hashes:**
- **SHA256:** 453333bffdd1850ea2e0647f7c805530b578919978a01b1e2be52d6eb2add946
- **Network Indicators:**
- hxxps://api.3n7wj[.]com
- wss://skt.3n7wj[.]com
- wss://sktv.3n7wj[.]com
- **Behavioral Indicators:**
- Repeated requests for Accessibility Service permissions.
- Unusual background battery drain.
- Device slowing down during active C2 sessions (screen streaming).
- Unsolicited closing of the System Settings app.
## Associated Threat Actors
- Distributed via various underground forums; often used by financially motivated cybercriminals and individual threat actors purchasing the RAT-as-a-Service.
## Detection Methods
- **Signature-based detection:** Scanning for the specific SHA256 hashes and package names associated with CraxsRAT builds.
- **Behavioral detection:** Monitoring for apps that request Accessibility Services and immediately attempt to toggle other system settings or hide their icon.
- **Network monitoring:** Detecting persistent WebSocket connections to known suspicious TLDs or domains linked to CraxsRAT infrastructure.
## Mitigation Strategies
- **User Education:** Train users to avoid clicking links in unsolicited SMS (smishing) or emails.
- **Official Sources Only:** Restrict installation to official stores (Google Play, Huawei AppGallery).
- **Least Privilege:** Do not grant "Accessibility Service" permissions to apps unless there is a verified, legitimate need.
- **MDM/UEM:** Use Mobile Device Management solutions to block the installation of apps from unknown sources and monitor for rooted devices.
## Related Tools/Techniques
- **SpyNote:** A similar Android RAT known for its surveillance capabilities.
- **CypherRAT:** An earlier predecessor/related project by the same developer (EVLF Dev).
- **Accessibility Service Abuse:** A common technique also used by banking trojans like SharkBot and TeaBot.