Technical Analysis: How CraxsRat V7.4 Evades Google Play Protect
In-depth technical analysis of the obfuscation, anti-emulator, and dynamic loading techniques used by the latest CraxsRat variant.
CraxsRat Intelligence Research
Security Research Team
⚡ Quick Takeaways (TL;DR)
- CraxsRat V7.4 uses 'Dynamic Loading' to download its malicious payload only AFTER installation.
- It employs 'XOR Encoding' to hide strings and variables from antivirus scanners.
- Built-in 'Anti-Emulation' checks sensor data (accelerometer) to detect if it's running on a researcher's PC.
- Target devices include Xiaomi, Samsung, and Pixel via Autostart abuse.
- Traditional signature-based antivirus often fails against V7.4 due to polymorphism.
Executive Summary
CraxsRat V7.4 has emerged as a formidable threat in the Android malware landscape. Unlike its predecessors, V7.4 employs a multi-stage loader and advanced reflection techniques specifically designed to neutralize Google Play Protect's static analysis engine. This report dissects the evasion mechanisms observed in recent wild samples.
Phase 1: The Dropper & Initial Execution
The infection typically begins with a "Dropper" app—often disguised as a legitimate utility like a PDF reader or a System Cleaner. This dropper contains no malicious code itself, allowing it to pass initial Play Protect scans.
- Dynamic Loading (DEX): Upon launch, the app connects to a C2 (Command & Control) server to download the actual malicious payload (a .dex file) into memory.
- AES Encryption: The payload is transferred over an encrypted channel, preventing network-level detection (IDS/IPS).
Phase 2: Bypassing Static Analysis
Obfuscation & Packing
V7.4 uses heavily custom obfuscation. Class names and methods are randomized (e.g., a.b.c() becomes x.z.q()) on every build. Strings are XOR-encoded and only decoded at runtime in memory.
Anti-Emulation Tricks
Before executing malicious logic, the malware checks its environment to ensure it's running on a real victim's phone, not a security researcher's computer:
- Sensor Check: It monitors the accelerometer. If the device is perfectly still (like a server rack emulator), it stays dormant.
- Uptime Check: It checks
System.uptimeMillis(). Emulators often have weird uptime values. - files Check: It looks for files associated with Genymotion, Bluestacks, or Android Studio.
Phase 3: Persistence & Control
Once active, CraxsRat grants itself "Autostart" permissions (on devices like Xiaomi/Samsung) and hides its icon from the launcher. It establishes a WebSocket connection to the attacker's panel, enabling real-time control.
Conclusion & IOCs
The evolution of V7.4 shows a clear shift towards targeted, stealthy attacks. Users must rely on behavioral blockers rather than signature-based antivirus.