A Newly discovered Android Remote Access Trojan called AndroRAT targeting unpatched Android Devices that exploit the publicly disclosed critical privilege escalation vulnerability and gain some high-level access from targeted Andriod devices.
This Android based RAT have an ability to gain some advance level privileges on any android devices that unpatched Remote code execution vulnerability CVE-2015-1805 and inject root exploits.
Root Exploits leads to perform a various malicious task such as silent installation, shell command execution, WiFi password collection, and screen capture.
Basically, RAT’s are abusing many platforms including Android, windows, and macOS by exploiting the critical vulnerabilities that performing on the targeting platform.
Also Read: Android Rat – TheFatRat to Hack and Gain access to Targeted Android Phone
How Does this AndroRAT RAT Works
AndroRAT Initially developed as a university project in order to gain the remote access from Android devices but later it abused by cybercriminals and used it for various malicious activities.
Newly discovered AndriodRAT variant posed as a malicious utility app called TrashCleaner which contains an Android exploit.
Initially in distributed via malicious URL that distributing via various sources such as spam and phishing email or social media shares.
Once TrashCleaner runs on the targeting Android devices, its force victim to install the Chinese-labeled calculator app that forced victims to replace the default Android calculator app.
Once this Malicious calculator app will be installed on the victim’s device, Trashcleaner app will disappear from the infected android devices and RAT will be activated from background.
Later RAT will communicate with the command & control server which is controlled by the attacker and performing a various command to steal the user’s sensitive information.
According to TrendMicro, The variant activates the embedded root exploit when executing privileged actions. It performs the following malicious actions found in the original AndroRAT:
- Record audio
- Take photos using the device camera
- Theft of system information such as phone model, number, IMEI, etc.
- Theft of WiFi names connected to the device
- Theft of call logs including incoming and outgoing calls
- Theft of mobile network cell location
- Theft of GPS location
- Theft of contacts list
- Theft of files on the device
- Theft of list of running apps
- Theft of SMS from device inbox
- Monitor incoming and outgoing SMS
- Theft of mobile network information, storage capacity, rooted or not
- Theft of list of installed applications
- Theft of web browsing history from pre-installed browsers
- Theft of calendar events
- Record calls
- Upload files to victim device
- Use front camera to capture high-resolution photos
- Delete and send forged SMS
- Screen capture
- Shell command execution
- Theft of WiFi passwords
- Enabling accessibility services for a keylogger silently
IOC – SHA256
- 2733377c14eba0ed6c3313d5aaa51171f6aef5f1d559fc255db9a03a046f0e8f
- fde9f84def8925eb2796a7870e9c66aa29ffd1d5bda908b2dd1ddb176302eced
- 2441b5948a316ac76baeb12240ba954e200415cef808b8b0760d11bf70dd3bf7
- 909f5ab547432382f34feaa5cd7d5113dc02cda1ef9162e914219c3de4f98b6e
