The new version of the malware also comes with additional capabilities, allowing attackers to see all applications installed on the device. See also: What is phishing? Everything you need to know to protect yourself from scam emails and more Once active on a device, AndroRAT is controlled by a remote server, which can perform a wide variety of different actions by activating the embedded root exploit to execute privileged actions.Īs a result, AndroRAT is able to record audio, take photos, monitor communications, see the GPS location of the device, steal Wi-Fi names connected to the device and more. It appears that the attackers are relying on users not being suspicious of an app they've just downloaded installing an additional app then disappearing.

If downloaded and installed, TrashCleaner will then prompt the Android device to install a Chinese-labelled calculator app with a logo which looks similar to the standard Android calculator.Īt the same time, the TrashCleaner icon is removed from the UI of the infected device and the RAT is activated in the background.

'Spear phishing campaign through email could also be a viable vector, as most people are using their mobile devices email.' 'There is a good chance the URL could have been delivered through an 'in-app' advertisement in another app such as a popular game,' Bharat Mistry, principal security strategist at Trend Micro told ZDNet. The new variant of AndroRAT is disguised as an app called 'TrashCleaner' and researchers at Trend Micro say it's distributed via a malicious URL - indicating that this threat comes from third-party download sites or phishing attacks. While newer Android devices can be patched against attacks exploiting the vulnerability, Google's lack of support for older devices means many remain vulnerable to attacks designed to gain additional privileges on the phone. Silent installation, shell command execution and the collection of credentials, Wi-Fi passwords and screenshots are just some of the capabilities of AndroRAT, which exploits CVE-2015-1805, a Linux kernel vulnerability that was publicly disclosed in 2016. An Android trojan that started out as an open-source project has been updated to allow hackers to gain access to virtually all data on infected devices.

Androrat apk 2017