Threat Profile

Malware Type: RAT / Backdoor / Spyware
Platform: Android
Origin: Based on leaked Spymax code
Threat Actor: EVLF (Believed Syria-based)

👉 Download here: 👇️

Executive Summary: The Resurgence of the Android RAT

The mobile landscape remains the primary battlefield for threat actors, and the sophistication of Android Remote Access Trojans (RATs) continues to escalate. These Trojans allow attackers to transform a standard smartphone into a fully compromised surveillance and control device.

CraxsRAT, also known by analysts as G700 RAT, exemplifies this evolution. It is a highly adaptable and aggressively deployed malware. CraxsRAT originated from the Spymax RAT (SpyNote) framework following the leak of its source code in 2020, allowing subsequent actors to refine and weaponize the code base.

Currently, the threat is being spearheaded by the group "EVLF," believed to be operating out of Syria. The latest identified iterations, such as version v7.5 released in April 2024, showcase advanced obfuscation and expanded functionality, making it a significant concern for users across the globe.

Geographic Focus & Infection Vectors: The Southeast Asian Campaign

While CraxsRAT possesses global capabilities, a particularly aggressive campaign targeting Southeast Asia was observed starting around April 2023. This campaign leveraged sophisticated social engineering techniques to achieve massive infection rates.

Impersonated Brands and Lures

The attackers meticulously impersonated popular local entities to maximize trust and lure victims into downloading the malicious APK. Examples of impersonated brands include:

• Fake shopping platforms (local e-commerce sites)
• Anti-scam centers and government alerts
• Food delivery apps (e.g., Grab & Go)
• Local retailers (e.g., 1st Mall, SG-Furniture)

Distribution Methods

Infection is primarily achieved through three highly effective vectors:

• Phishing Links: Malicious links disguised as official notifications or promotional offers.
• Malicious APKs: The primary delivery mechanism, often downloaded directly from deceptive websites.
• Social Media Ads: Fake advertisements, especially on platforms like Telegram, driving traffic directly to the compromised APK download.

Technical Deep Dive: CraxsRAT Capabilities

CraxsRAT is not merely a backdoor; it is a comprehensive surveillance suite. Its technical sophistication allows it to maintain persistent control and extract granular data from the compromised device.

Core Device Control Features

The RAT provides the threat actor with complete, real-time remote access, enabling the following actions:

• Full Remote Control: Navigating the device interface and executing commands.
• Data Exfiltration: Stealing contacts, photos, videos, and entire file systems.
• Communication Hijacking: Monitoring and intercepting SMS and call logs.
• Surveillance: Activating the Camera and Microphone at will.
• Location Tracking: Continuous GPS monitoring to map the victim's movements.
• Screen Capture: Recording the entire device screen for visual intelligence gathering.

Infrastructure & Evasion Techniques

Analysts have observed several advanced features that bolster CraxsRAT's resilience and stealth:

• Obfuscation: Extensive use of Base64 encoding to disguise Command & Control (C2) server endpoints, making detection by basic signature-based antivirus difficult.
• Multilingual Support: Support for English, Arabic, Turkish, and Simplified Chinese, confirming its global targeting strategy.
• C2 Environment: The C2 infrastructure typically runs on Windows Server 2019, often configured with Chinese language settings, providing a unique forensic indicator.

Recognizing the Threat: Symptoms of CraxsRAT Infection

If a device is compromised, it rarely does so silently. Users should monitor their smartphones for these tell-tale signs of CraxsRAT activity:

• Battery Drain: Unexplained, rapid depletion of the battery, as the RAT runs constantly in the background.
• Performance Degradation: Noticeable slowing of the operating system and sluggish app responsiveness.
• Unknown Apps/Pop-ups: New, unidentified applications appearing, or sudden, unsolicited pop-up advertisements.
• Hardware Activation: The camera or microphone activating randomly, even when the phone is locked or idle.
• High Data Usage: A spike in background internet usage, indicating continuous data exfiltration to the C2 server.

Actionable Defense: Protection & Removal Strategies

Vigilance is the first line of defense. Here is a tiered approach to mitigating the risk posed by CraxsRAT.

For Individual Users

• Source Verification: Only download apps from official repositories (Google Play Store). Avoid sideloading APKs unless absolutely necessary and verified.
• Permission Auditing: Scrutinize every app's requested permissions. Be highly suspicious of apps demanding excessive access, particularly the Accessibility Services.
• Security Layers: Enable Two-Factor Authentication (2FA) on all critical accounts and set up transaction alerts.
• Isolation: Where possible, use a secondary, "burner" device specifically for sensitive banking or high-risk activities.

For Organizations & Enterprises

• Endpoint Defense: Deploy Mobile Threat Defense (MTD) solutions capable of detecting behavioral anomalies and known RAT signatures.
• Policy Enforcement: Utilize Mobile Device Management (MDM) to enforce app whitelisting and restrict dangerous sideloading.
• User Education: Conduct regular training focusing specifically on local brand impersonation and phishing tactics prevalent in the target region.

Removal Instructions

If infection is confirmed, follow these steps:

1. Safe Mode Boot: Restart the device into Safe Mode to prevent the malicious app from running automatically.
2. Identification: Use the battery usage statistics or recent installations to pinpoint the suspicious app.
3. Uninstallation: Force stop and uninstall the identified application.
4. Cache Clearing: Clear the browser cache to remove any associated phishing or download remnants.
5. Last Resort: If the malware persists, perform a full factory data reset.

Conclusion: Staying Ahead of the Curve

CraxsRAT represents a persistent, multi-faceted threat. Its ability to seamlessly integrate surveillance, control, and data theft capabilities makes it exceptionally dangerous, leading to potential financial losses, reputational damage, and severe privacy breaches.

The threat actors behind CraxsRAT, particularly EVLF, are continually iterating. The recent release of v7.5 underscores the need for proactive defense. Do not assume a single scan is enough. Stay vigilant, keep your OS and applications updated, and treat every unexpected notification with suspicion.

Frequently Asked Questions (FAQ)

Can CraxsRAT steal banking credentials?

Yes. CraxsRAT is highly capable of stealing banking credentials. It achieves this through multiple methods, including sophisticated keylogging (recording every keystroke entered into a banking app) and overlay attacks (displaying a fake, transparent login screen over the legitimate banking app to capture input).

Does factory reset remove CraxsRAT?

Yes, a factory data reset effectively wipes the device and removes CraxsRAT entirely. However, it is crucial to back up all necessary data (photos, contacts, documents) first. If the backup itself contains the malicious APK or configuration files, the device may reinfect upon restoration.