Thursday, March 28, 2024

AndroRAT – A Remote Access Trojan Compromise Android Devices and Inject Root Exploits

A Newly discovered Android Remote Access Trojan called AndroRAT targets unpatched Android Devices that exploit the publicly disclosed critical privilege escalation vulnerability and gain some high-level access from targeted Andriod devices.

This Android-based RAT has the ability to gain some advanced level privileges on any Android devices that unpatched Remote code execution vulnerability CVE-2015-1805 and inject root exploits.

Root Exploits lead to performing various malicious tasks such as silent installation, shell command execution, WiFi password collection, and screen capture.

Basically, RATs are abusing many platforms including Android, windows, and macOS by exploiting the critical vulnerabilities that performing on the targeting platform.

Also Read: Android Rat – TheFatRat to Hack and Gain Access to Targeted Android Phone

How Does this AndroRAT RAT Works

AndroRAT was Initially developed as a university project in order to gain remote access from Android devices but later it was abused by cybercriminals and used for various malicious activities.

A newly discovered AndriodRAT variant posed as a malicious utility app called TrashCleaner which contains an Android exploit.

Initially in distributed via malicious URLs were distributed via various sources such as spam and phishing email or social media shares.

Once TrashCleaner runs on the targeting Android devices, it forces victims to install the Chinese-labeled calculator app that forced victims to replace the default Android calculator app.

Once this Malicious calculator app will be installed on the victim’s device, the Trashcleaner app will disappear from the infected Android devices and RAT will be activated from the background.

Later RAT will communicate with the command & control server which is controlled by the attacker and performs various commands to steal the user’s sensitive information.

According to TrendMicro, The variant activates the embedded root exploit when executing privileged actions. It performs the following malicious actions found in the original AndroRAT:

  • Record audio
  • Take photos using the device’s camera
  • Theft of system information such as phone model, number, IMEI, etc.
  • Theft of WiFi names connected to the device
  • Theft of call logs including incoming and outgoing calls
  • Theft of mobile network cell location
  • Theft of GPS location
  • Theft of contacts list
  • Theft of files on the device
  • Theft of list of running apps
  • Theft of SMS from device inbox
  • Monitor incoming and outgoing SMS

Apart from the original features of the AndroRAT, it also performs new privileged actions:

  • Theft of mobile network information, storage capacity, rooted or not
  • Theft of list of installed applications
  • Theft of web browsing history from pre-installed browsers
  • Theft of calendar events
  • Record calls
  • Upload files to the victim’s device
  • Use the front camera to capture high-resolution photos
  • Delete and send forged SMS
  • Screen capture
  • Shell command execution
  • Theft of WiFi passwords
  • Enabling accessibility services for a keylogger silently

CVE-2015-1805 was patched in 2016 by Google and the unpatched Android devices are still vulnerable to this AndroRAT  Remote access Trojan also the device which is no longer receives this security patch is also vulnerable to this Android RAT which is still being used by a significant number of mobile users. Trend Micro said.

IOC – SHA256

  • 2733377c14eba0ed6c3313d5aaa51171f6aef5f1d559fc255db9a03a046f0e8f
  • fde9f84def8925eb2796a7870e9c66aa29ffd1d5bda908b2dd1ddb176302eced
  • 2441b5948a316ac76baeb12240ba954e200415cef808b8b0760d11bf70dd3bf7
  • 909f5ab547432382f34feaa5cd7d5113dc02cda1ef9162e914219c3de4f98b6e
Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles