AndroRAT
MITRE ATT&CK: S0292 View on attack.mitre.org
Aliases: AndroRAT
- First seen
- 2012-11-25 00:00:00
- Malware type
- rat, spyware
- Family
- Malware family
- Operating systems
- android
- Related IoCs
- 16 (16 malicious)
- Last IoC activity
- 2026-08-19 17:59:33
- Profile updated
- 2026-07-07 15:45:28
Context
AndroRAT is an open-source remote access tool for Android devices. AndroRAT is capable of collecting data, such as device location, call logs, etc., and is capable of executing actions, such as sending SMS messages and taking pictures. It is originally available through the `The404Hacking` Github repository.
Recent IoC activity
16 malicious indicators in Maltiverse are attributed to AndroRAT (S0292). The 16 most recently updated:
Malware & tools used
- SMS Control (attack-pattern)
- Call Log (attack-pattern)
- Video Capture (attack-pattern)
- SMS Messages (attack-pattern)
- Contact List (attack-pattern)
- Audio Capture (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Match Legitimate Name or Location (attack-pattern)
- Call Control (attack-pattern)
- Location Tracking (attack-pattern)
Reports & references
- bitdefender.com — Bitdefender Pr Whitepaper Bitterapt Creat4571 En En Genericuse (report)
- Cisco Talos — Bitter Apt Adds Bangladesh To Their (report)
- forcepoint.com — Bitter Targeted Attack Against Pakistan (report)
- stratosphereips.org — Android Mischief Rats Dataset (report)
- malpedia.caad.fkie.fraunhofer.de — Apk.Androrat (report)
- github.com — Androrat (report)
- hotforsecurity.bitdefender.com — Possibly Italy Born Android Rat Reported In China Find Bitdefender Researchers 16264 (report)
- kaspersky.com — 24290 (report)
- Trend Micro — The Urpage Connection To Bahamut Confucius And Patchwork (report)
- cocomelonc.github.io — Aiya Mmd Book (report)
- stratosphereips.org — Dissecting A Rat Analysis Of The Androrat (report)
- mp.weixin.qq.com — Ahxp5Hmrotmsfbiuxj0Cfg (report)
- stratosphereips.org — Dissecting A Rat Analysis Of The Command Line Androrat (report)
- blog.lookout.com — Spoofed Apps (report)
- MITRE ATT&CK — S0292 (report)
- web.archive.org — Androrat (report)
- latesthackingnews.com — How To Hack Android Phones With Androrat (report)
- github.com — Androrat (report)