Mirax

Mirax is an Android RAT that turns the infected device into a SOCKS5 proxy node while also providing remote-control and stealer functionality. It is delivered both directly and as the payload of other droppers (for example the Black Hawk twin-asset dropper). Proxy/C2 coordination is at ilovepng.info. The family packs its real payload inside heavily obfuscated, sometimes deliberately malformed APK containers to resist static analysis.