> For the complete documentation index, see [llms.txt](https://0xsec.gitbook.io/0xsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xsec.gitbook.io/0xsec/malware-analysis/2026-02-01-androrat.md). # AndroRAT Android Malware Analysis ### Overview Androrat is a remote administration tool developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT (Remote Access Tool). It has been developed in a team of 4 for a university project. The goal of the application is to give the control of the android system remotely and retrieve informations from it. SAMPLE - `c5ab0adaedf391a395387df33b0bf6854f1ccc9c5da937915ea86b5eec6e6103` ### Static Analysis After extracting zip I directly jumped for analysis and while examining decompiled apk, I saw that malware isn't obfuscated which made work easy. So, I started my analysis from `AndroidManifest.xml` because its where permissions are declared and there i saw some permissions like `READ/WRITE_EXTERNAL_STORAGE, READ_SMS, RECORD_AUDIO, READ_CALL_LOG, ACCESS_FINE_LOCATION` and one major thing that caught my attention was permission for `CAMERA` and certain other like `jobScheduler` and a code `1337` something `SECRET_CODE` that the malware listens.

Figure 1: Dangerous Permissions

Figure 2: SECRET_CODE and Job Scheduling

Figure 3: Creates a TCP connection to C2 server

In the `config` of the apk there is initilization of IP and PORT like `192.169.x.x` and `8000` now coming to `MainActivity` it makes a TCP connection to the C2 server when `onCreate` is executed.

Figure 4: Initilize shell, audio/video manager

Tracing the `tcpConnection` it shows how this malware works, there are initilization of `shell, IPAddr, audioManager, videoRecorder, so on` lets analyze them one by one. First, `ipAddr` it has two functions `getMACAddress` which return a MAC address and `getIPAdress` which return a IP, we will see it in upcoming code.

Figure 5: Recording audio and storing in cache dir

Figure 6: Encodes audio in base64 and attach END123 marker

Now, in `audioManager` there are function responsible for recording audio and saving it. One of the function `startRecording` which records audio only if the `BUILD.VERSION` is greater than or equal 26 otherwise `Lower Android SDK Cant Record Audio` and it records audio in `.mpeg4` format and stores in **cache** directory. When `stopRecording` is called it converts the audio data into **base64** for transmission and write `END123` at end of it, it act as marker that server look for and once transmission is completed it stops `audioManager`. `videoRecorder` utlizes similar approach to record video in `.mp4` and rest is similar.

Figure 7: Extracts critical infomartions

Figure 8: Extracts phone number

Now there is a function `functions` which extracts all the information about the phone including `Model, IMEI, Phone Number of each sim, Brand, Manufacturer, so on` also there is a function `readFromClipboard` which reads the content of clipboard of user that might get to info like **passowrds, OTP**. A `jobScheduler` function to schedule the malware to start automatically.

Figure 9: Clicks photo using phone's camera

Afterwards, there is `cameraPreview` function which click photo and sends to server using same encoding on **jpeg** image and attaching `END123` marker to it.

Figure 10: Reads messages

Now `readSMS` reads all the messages from **Android system SMS databse** including Bank OTP, and other confidential information. And with `locationManager` it points out the exact latitude and logitude of user using gps and netowrk location. Using `readCallLogs` it reads all the call history of the user including whom user talked to, duration of call, date of it and phone number of other user by reading `content://call_log/calls` system call log database.

Figure 11: Sends encoded data to C2 server

Now `newShell` is responsible for sending all the encoded data including messages, clipboard, call\_logs from `/sdcard/temp` to the C2 server. Coming back to `tcpConnection` there is a function `doInBackground` which keeps the connection between server and victim and in in case phone got disconncted from newtork, it won't stop it will keep trying indefinitely unless gets the connection back. When the server gots the connection it will show a message to server `Hello there, welcome to reverse shell of XXXX` with model specific.

Figure 12: Commands attacker can send to victim

Then a infinite loop starts which will keeps asking of inputs but exits when a **null** is provided, it has commands such as `camList, takepic \\d, shell, getClipData, deviceInfo, getIP, getSimDetails, getSMS, vibrate, getLocation, start/stop audio/video, getCallLogs` which will provided each confidential information to the attacker and the most critical command was **shell** through which the attacker can even get a shell to victim's device. ### Dynamic Analysis For dynamic analysis, since the ip which was given is a private dummy ip so I changed that IP to my laptop's IP so that i can test it. I have rebuild and signed the apk again with my configuration for testing. After i installed and open app in my spare phone i got a call back from my device.

Figure 13: Call back from android device

Also tried the above found commands and everything is working as it was intended.

Figure 14: Working commands

### IOCs * IP - `192.168.x.x` * PORT - `8000` * C2 COMMANDS - `getLocation, deviceInfo, shell, camList, getClipData` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://0xsec.gitbook.io/0xsec/malware-analysis/2026-02-01-androrat.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.