Telegram Bot API Abused by TeleRAT Android Malware and Steal Sensitive Data from Android Phone

A Newly Discovered Andoird Malware called TeleRAT are abused Telegram Bot API that used to command and control the malicious Android applications.

TeleRAT is a Dubbed IRRAT Malware that steal information ranging from SMS and call history to file listings from infected Android devices.

“Telegram Bots are special accounts that do not require an additional phone number to set up and are generally used to enrich Telegram chats with content from external services or to get customized notifications and news.”

Old IRRAT once  launched into victims Android Phone, It works by making and after that populating the malicious files on the phone’s SD Card and sending them to the remote server.

TeleRAT Android Malware Leveraging Telegram’s Bot API  and it mainly targeting individual Iranian Users.

How Does Telegram Bot  API abuse by TeleRAT

Once it launched into the victim’s files as a post-Installation operation, it creates two files in the app’s internal directory

  • telerat2.txt – containing a slew of information about the device – including the System Bootloader version number, total and available Internal and External memory size, and a number of cores.
  • thisapk_slm.txt – mentioning a Telegram channel and a list of commands.

Later This TeleRAT inform to its author about the successful installation by sending a message to a Telegram bot via the Telegram Bot API along with current date and time of the infection.

According to paloaltonetworks, End of the operation it’s fetching updates from the Telegram bot API every 4.6 seconds.

TeleRAT listening various commands such as Get contacts, Get the clipboard, Get location, Receive (SMS) messages, Take a photo, Receive calls and Etc – Full List.

TeleRAT new future allowing for uploads exfiltrated data using sendDocument API and it eliminates the possibility of network-based detection.

Looking further in Source code, Malware authors don’t focus about to hide their identity and its advertising through a Telegram channel called ‘vahidmail67’   and also being sold on forums.

Also its distributed via several third-party Android application stores and shared via both legitimate and nefarious Iranian Telegram channels. Researchers said.


BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

OilRig: Never-seen C#/.NET Backdoor to Attack Wide Range of Industries

OilRig (APT34) is an Iranian cyberespionage group active since 2014, targeting Middle Eastern governments and…

5 hours ago

Most Important Network Penetration Testing Checklist

Network Penetration Testing checklist determines vulnerabilities in the network posture by discovering Open ports, troubleshooting…

1 day ago

Cryptojacking Campaign Infected Online Thesaurus With Over 5 Million Visitors

Students, authors, and anybody else wishing to improve their vocabulary and language abilities frequently utilize…

3 days ago

Gold Melody Attacking Organizations With Burp Extension, Mimikatz, and Other Tools

The financially motivated GOLD MELODY threat group has been active at least since 2017, attacking…

3 days ago

MOVEit Transfer SQL Injection Let the Attacker Gain Unauthorized Access to the Database

MOVEit transfer service pack has been discovered with three vulnerabilities associated with SQL injections (2)…

4 days ago

LUCR-3 Attacking Fortune 2000 Companies Using Victims’ Own Tools & Apps

A new financially motivated threat group named “LUCR-3” has been discovered targeting organizations to steal…

4 days ago