CraxsRAT: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "apktool + Smali/Baksmali + apksigner orchestrated by EVLF Dev .NET Framework 4.8 Builder",
  "runtime": "Android Runtime (ART) / Dalvik VM (DEX bytecode)",
  "binary_footprint": "Single or Multi-DEX APK package, typ. 1.2 MB - 4.8 MB standalone stub; 15 MB - 80 MB when bound to legitimate host APK",
  "stub_size": "1,450,000 bytes (unpacked template APK before CJK class renaming and junk Smali injection)",
  "packer_obfuscation": "Custom Smali class/method renaming using Unicode CJK ideographs, junk NOP/goto sled insertion, encrypted DEX payload loading via DexClassLoader, and manifest attribute tampering",
  "subsystem": "Android Application Framework (Background Service + AccessibilityService + SYSTEM_ALERT_WINDOW)",
  "entry_point_flow": "MainActivity / Dropper Activity -> Request AccessibilityService prompt loop -> Auto-grant runtime permissions via performAction(ACTION_CLICK) -> Start SensorRestarterBroadcastReceiver & Foreground Service -> Initialize TCP Socket loop to C2 Host/Port",
  "technical_summary": "Developed by EVLF Dev as a commercial successor to SpyNote and CypherRAT, CraxsRAT is an Android remote control and banking overlay framework controlled via a C# .NET WinForms console. Its core execution model centers on abusing Android's AccessibilityService API to automatically grant runtime permissions, capture UI view hierarchies (including OTPs and cryptocurrency seed phrases), inject automated touch/scroll gestures via Hidden VNC (HVNC), and prevent uninstallation through active Settings window termination."
}

{
  "interface_type": "GUI Builder / Operator Console",
  "builder_tabs_options": [
    {
      "tab": "Connection",
      "options": [
        "Host / IP / DNS: Primary and fallback C2 domain or IPv4 addresses added to connection list",
        "Port: TCP listener port integer (e.g., 7771, 6666, 4444)",
        "Client Name: Identifier tag assigned to infected handsets in the operator grid",
        "Connection Key: Shared secret string authenticating client socket handshakes"
      ]
    },
    {
      "tab": "Options",
      "options": [
        "Hide Icon: Suppresses launcher activity alias after initial Accessibility grant",
        "Keep Screen On: Acquires PARTIAL_WAKE_LOCK andSCREEN_DIM_WAKE_LOCK to prevent Doze sleep",
        "Deactivate Doze Mode: Automates ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS dialog approval",
        "Start On Boot: Registers RECEIVE_BOOT_COMPLETED broadcast receiver for reboot persistence"
      ]
    },
    {
      "tab": "information",
      "options": [
        "App Name: Display label injected into AndroidManifest.xml and strings.xml",
        "Package Name: Custom Java package namespace (e.g., com.google.service.update)",
        "Version Name / Code: Spoofed semantic version metadata",
        "App Icon: PNG icon replacement across mipmap-mdpi through mipmap-xxxhdpi directories"
      ]
    },
    {
      "tab": "Tools",
      "options": [
        "Draw Over Apps: Requests SYSTEM_ALERT_WINDOW for black-screen masking and WebView phishing overlays",
        "Offline Keylogger: Hooks TYPE_VIEW_TEXT_CHANGED and SimpleIME.class input events to local storage",
        "Anti-Emulator: Terminates execution if Build.FINGERPRINT, QEMU props, or goldfish hardware strings are detected",
        "Super Mod: Enables aggressive anti-deletion loop that forces HOME navigation whenever Settings or App Info opens",
        "Bind With Another APK: Merges malicious DEX and manifest components into a clean third-party APK"
      ]
    },
    {
      "tab": "Login",
      "options": [
        "Title / Discription: Custom prompt text shown on initial AccessibilityService permission lure screen",
        "Custom WebView URL: Loads fake carrier, banking, or Google Play verification page during setup"
      ]
    },
    {
      "tab": "Permissions",
      "options": [
        "Auto-Grant Runtime Permissions: Selecting Camera, Microphone, SMS, Contacts, Location, and External Storage for Accessibility auto-clicker approval"
      ]
    },
    {
      "tab": "Build",
      "options": [
        "Obfuscate Classes: Renames Smali classes and fields to non-ASCII CJK characters",
        "Anti-Kill / Protect APK: Corrupts ZIP Central Directory extra fields to break jadx and apktool decompilation",
        "Build APK: Compiles, aligns, and signs final APK with auto-generated V1/V2 keystore"
      ]
    }
  ],
  "config_struct_layout": [
    {
      "offset": "ClientHost.HOST",
      "field": "Host",
      "type": "String (Base64)",
      "description": "Encoded C2 IP address or Dynamic DNS hostname"
    },
    {
      "offset": "ClientHost.PORT",
      "field": "Port",
      "type": "String (Base64)",
      "description": "Encoded C2 TCP destination port"
    },
    {
      "offset": "ClientHost.KEY",
      "field": "Key",
      "type": "String",
      "description": "Socket packet delimiter and authentication key"
    },
    {
      "offset": "ClientHost.NAM",
      "field": "ClientName",
      "type": "String",
      "description": "Campaign or victim group tag displayed in console"
    },
    {
      "offset": "Data.SUPER_MOD",
      "field": "SuperMod",
      "type": "Boolean / String",
      "description": "Flag enabling Settings crash loop and anti-uninstall protection"
    },
    {
      "offset": "Data.HIDE_ICON",
      "field": "HideIcon",
      "type": "Boolean / String",
      "description": "ComponentManager toggle disabling main launcher alias"
    }
  ],
  "payload_generation_flags": [
    "Smali Class Obfuscation: CJK Ideograph Dictionary",
    "Manifest Tampering: Bogus XML namespace attributes + ZIP Central Directory corruption",
    "APK Signature Scheme: v1 (JAR) + v2 (APK Signature Block)"
  ],
  "operator_commands": [
    "ScreenReader (HVNC): Streams live UI node tree or MediaProjection frames while dispatching remote gesture coordinates",
    "BlackScreen: Projects opaque SYSTEM_ALERT_WINDOW overlay with fake 'System Updating' spinner to hide operator actions",
    "Keylogger: Streams live Accessibility text input events and retrieves stored offline keystroke logs",
    "PermissionsManager: Triggers silent background permission elevation via Accessibility auto-clicker",
    "Injections: Displays HTML/WebView credential harvesting overlays atop targeted banking and crypto package names",
    "SMSManager: Reads inbox/outbox databases, intercepts incoming 2FA SMS, and dispatches outbound messages",
    "FileManager: Enumerates /sdcard/ directory trees, exfiltrates DCIM photos, and uploads secondary payloads",
    "CallForward: Executes USSD MMI codes (*21*number#) to redirect victim voice calls and voice OTPs"
  ],
  "interface_telemetry_analysis": "The CraxsRAT v7.x operator console is a dark-themed C# WinForms dashboard authored by EVLF Dev. Connected handsets populate a visual card or table grid displaying device wallpaper thumbnails, battery percentage, Wi-Fi/cellular signal state, Android version, device model, country flag, and active foreground application icon. A floating action menu exposes one-click triggers for Live Screen Control (HVNC), Hidden Camera, Microphone Listener, Keylogger, and APK Builder tabs."
}

struct CraxsRAT_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "APK Dropper / Host App -> DexClassLoader loads encrypted secondary payload from assets/ -> AccessibilityService registered by user via deceptive lure -> onAccessibilityEvent(TYPE_WINDOW_STATE_CHANGED) monitors com.android.packageinstaller ->AccessibilityNodeInfo.findAccessibilityNodeInfosByText('Allow') -> performAction(ACTION_CLICK) auto-grants permissions -> WindowManager.addView(TYPE_APPLICATION_OVERLAY) projects black screen over live HVNC gesture automation.",
  "ntapi_functions": [
    "android.accessibilityservice.AccessibilityService!onAccessibilityEvent",
    "android.accessibilityservice.AccessibilityService!dispatchGesture",
    "android.accessibilityservice.AccessibilityService!performGlobalAction",
    "android.view.WindowManager!addView",
    "android.media.projection.MediaProjectionManager!createScreenCaptureIntent",
    "dalvik.system.DexClassLoader!loadClass",
    "android.app.admin.DevicePolicyManager!lockNow"
  ],
  "process_hollowing_target": "Host APK main process (when bound) or persistent background services masquerading as com.google.android.gms / system update services",
  "persistence_mechanics": [
    "AccessibilityService Bind: System-managed lifecycle restarts the service automatically whenever enabled in Settings -> Accessibility",
    "SensorRestarterBroadcastReceiver: Custom BroadcastReceiver triggered by Service.onDestroy() to immediately re-invoke startForegroundService()",
    "BOOT_COMPLETED & USER_PRESENT Receivers: Re-initializes socket worker threads upon device boot or screen unlock",
    "WakeLock & Battery Optimization Whitelist: Acquires PARTIAL_WAKE_LOCK and auto-clicks 'Allow' on REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"
  ],
  "evasion_hooks": [
    "Super Mod Anti-Uninstall: Inspects getPackageName() and className in TYPE_WINDOW_STATE_CHANGED; if com.android.settings.SubSettings or InstalledAppDetails appears, immediately fires performGlobalAction(GLOBAL_ACTION_HOME) or GLOBAL_ACTION_BACK",
    "Black-Screen Curtain Overlay: Mounts a full-screen WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY view with FLAG_NOT_FOCUSABLE and FLAG_LAYOUT_IN_SCREEN at zero brightness while dispatching gestures underneath",
    "APK Zip Header Tampering: Modifies compression method flags and extra field lengths in the APK Central Directory to trigger parser exceptions in Apktool and JADX",
    "CJK Identifier Obfuscation: Replaces package hierarchies, class names, and method descriptors with repetitive Chinese/Japanese/Korean Unicode characters"
  ],
  "anti_analysis": [
    "Emulator Environment Checks: Inspects Build.FINGERPRINT, Build.MODEL, Build.HARDWARE ('goldfish', 'ranchu', 'vbox86'), and system properties (ro.kernel.qemu)",
    "Google Play Protect Evasion: Uses staged dropper APKs that load the core RAT DEX payload dynamically from encrypted asset blobs only after installation completes",
    "Dynamic Notification Suppression: Intercepts StatusBarNotification events via NotificationListenerService to cancel security warnings and banking transaction alerts"
  ]
}

Concrete technical breakdown of functional modules implemented in the CraxsRAT binary:

{
  "framing": "Custom delimiter-separated TCP stream using a configurable split token (e.g., '8888' or '<EOF>') combined with length headers and GZIP payload compression",
  "serialization": "String-delimited command tokens paired with Base64-encoded or raw byte arrays for binary media chunks (JPEG screen frames, PCM audio, file buffers)",
  "handshake": "Client opens raw TCP socket to C2 Host:Port -> Sends initial registration packet containing Connection Key, Device UUID, Model, Android API Version, Country, Battery Level, and Accessibility status -> Server acknowledges and begins heartbeat polling",
  "cryptography": "Application-layer payload obfuscation using GZIP compression wrapped in static-key AES-128-CBC or multi-byte XOR + Base64 encoding defined during APK compilation",
  "packet_types": [
    {
      "header": "info / pong",
      "payload": "Device Model, OS Version, Battery %, Active Foreground Package, Wi-Fi Status, Screen State",
      "direction": "Client -> Server"
    },
    {
      "header": "scr / hvnc",
      "payload": "GZIP-compressed JPEG frame buffer or serialized AccessibilityNodeInfo coordinate tree",
      "direction": "Client -> Server"
    },
    {
      "header": "clk / mov",
      "payload": "X/Y touch coordinates, swipe vector duration, or GlobalAction integer ID",
      "direction": "Server -> Client"
    },
    {
      "header": "key / log",
      "payload": "Base64-encoded keystroke buffer with package name and timestamp metadata",
      "direction": "Client -> Server"
    },
    {
      "header": "cam / mic",
      "payload": "Chunked H.264/JPEG camera frame or raw PCM audio stream buffer",
      "direction": "Client -> Server"
    }
  ],
  "traffic_signature": "Persistent non-TLS TCP flows over non-standard high ports (commonly 7771, 7772, 6666) exhibiting periodic keep-alive heartbeats and GZIP magic headers (0x1F 0x8B 0x08) separated by recurring ASCII delimiter strings."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: