It can be seen that the data is sent in plaintext and the character ‘t’ is used as the delimiters to separate parameters name and values.

Figure 2 displays the packet data in a structured way.

Figure 1 shows the initial communication from the phone to the C&C.Īfter establishing the first connection, the phone sends its first packet with some parameters, such as SIM card operator, phone number, SIM card serial number, IMEI, etc. The controller IP 147.32.83.234 is the IP address of a Windows 7 virtual machine in our lab computer, meaning that the IP address is not connected to any known indicator of compromise (IoC).

In our case, the IP address of the controller is 147.32.83.234 and the port is 1337/TCP. To connect, the phone uses the IP address and the port of the controller specified in the APK. Once the APK was installed on the phone, it directly tries to establish a TCP connection with the command and control (C&C) server. UTC time of the infection in the capture: 15:18:00 UTС The details about the network traffic capture are: upload a file, get GPS location, monitor files, etc.), we captured the network traffic on the Android virtual emulator. The network traffic from the phone was captured using Emergency VPN. While performing different actions on the RAT controller (e.g. The Android Application Package (APK) built by the RAT builder was installed in an Android virtual emulator called Genymotion with Android version 8. We executed the builder on a Windows 7 Virtualbox virtual machine with Ubuntu 20.04 as a host. The AndroRAT RAT is a software package that contains the controller software and builder software to create an APK. These RAT captures are functional and used as in real attacks. The goal of each of our RAT experiments is to configure and execute the RAT software and to do every possible action while capturing all traffic and storing all logs. The previous blogs analyzed Android Tester RAT, DroidJack RAT, and SpyMax RAT. In this blog post we provide the analysis of the network traffic of the RAT05-AndroRAT. This is the fourth blog of a series analyzing the network traffic of Android RATs from our Android Mischief Dataset, a dataset of network traffic from Android phones infected with Remote Access Trojans (RAT). This blog post was authored by Kamila Babayeva and Sebastian Garcia RAT analysis research is part of the Civilsphere Project ( ), which aims to protect the civil society at risk by understanding how the attacks work and how we can stop them.

Androrat apk android