Technical Analysis: How CraxsRat V7.4 Evades Google Play Protect

Executive Summary

CraxsRat V7.4 has emerged as a formidable threat in the Android malware landscape. Unlike its predecessors, V7.4 employs a multi-stage loader and advanced reflection techniques specifically designed to neutralize Google Play Protect's static analysis engine. This report dissects the evasion mechanisms observed in recent wild samples.

Phase 1: The Dropper & Initial Execution

The infection typically begins with a "Dropper" app—often disguised as a legitimate utility like a PDF reader or a System Cleaner. This dropper contains no malicious code itself, allowing it to pass initial Play Protect scans.

• Dynamic Loading (DEX): Upon launch, the app connects to a C2 (Command & Control) server to download the actual malicious payload (a .dex file) into memory.
• AES Encryption: The payload is transferred over an encrypted channel, preventing network-level detection (IDS/IPS).

Phase 2: Bypassing Static Analysis

Obfuscation & Packing

V7.4 uses heavily custom obfuscation. Class names and methods are randomized (e.g., a.b.c() becomes x.z.q()) on every build. Strings are XOR-encoded and only decoded at runtime in memory.

Anti-Emulation Tricks

Before executing malicious logic, the malware checks its environment to ensure it's running on a real victim's phone, not a security researcher's computer:

1. Sensor Check: It monitors the accelerometer. If the device is perfectly still (like a server rack emulator), it stays dormant.
2. Uptime Check: It checks System.uptimeMillis(). Emulators often have weird uptime values.
3. files Check: It looks for files associated with Genymotion, Bluestacks, or Android Studio.

Phase 3: Persistence & Control

Once active, CraxsRat grants itself "Autostart" permissions (on devices like Xiaomi/Samsung) and hides its icon from the launcher. It establishes a WebSocket connection to the attacker's panel, enabling real-time control.

Conclusion & IOCs

The evolution of V7.4 shows a clear shift towards targeted, stealthy attacks. Users must rely on behavioral blockers rather than signature-based antivirus.