AndroRAT started as a legitimate remote administration tool for Android—IT support teams used it to manage devices remotely. But like many dual-use tools, it didn't take long for attackers to repurpose it for spying and stealing data. For anyone learning cybersecurity, setting up AndroRAT in a sandboxed lab is one of the best ways to see how remote access trojans (RATs) actually behave, what signs to look for, and how to stop them.
How AndroRAT Works
AndroRAT uses a client-server model. The server runs on the attacker's machine (or a command-and-control server), and the client—a malicious app—sits on the target Android device. Once the victim grants permissions (often hidden inside a seemingly harmless app), the client opens a reverse TCP connection back to the server. From there, the attacker can read SMS, grab call logs, record audio, take photos, access contacts, and track GPS location. The traffic is usually plaintext, so network monitors can catch it.
For ethical learning, you can run AndroRAT on your own devices inside an isolated network. The official GitHub repo (use it only for research and testing) has the source code. Compile it yourself to understand how it works, but never install it on any device without explicit permission.
Detecting AndroRAT on a Device
Spotting a RAT infection is a core skill. Look for these red flags:
- Battery drains fast or data usage spikes for no reason
- Apps you don't recognize with permissions to SMS, camera, or microphone
- Strange background processes visible in Developer Options or via ADB
- Network connections to unfamiliar IPs, especially overseas
Use Wireshark to capture traffic from your Android emulator. Watch for persistent TCP connections to a remote host on non-standard ports—AndroRAT often uses port 1200. If you suspect an infection, disconnect the device from the network immediately and run a reputable mobile antivirus scan.
Preventing AndroRAT Infections
Prevention beats cleanup every time. Stick to these habits:
- Only install apps from official sources like Google Play. Sideloading from random websites is how most RATs get in.
- Check permissions. A flashlight app asking for your contacts or SMS? That's a huge red flag.
- Keep Android and apps updated. Many RATs exploit old vulnerabilities that have already been patched.
- Use a firewall or network monitor to catch unexpected outgoing connections.
- Enable Google Play Protect and consider a dedicated mobile security app.
If you see any of these warning signs, our guide on common Android problems you can resolve on your own walks through checking permissions and cleaning up suspicious apps.
Ethical Analysis in a Lab Environment
To study AndroRAT without breaking any laws, build a safe testbed:
- Create a virtual Android device using Android Studio's emulator (API level 23 or higher).
- Build the AndroRAT client from source, changing the default IP to point to your local server (e.g., 127.0.0.1).
- Install the client APK on the emulator and grant the requested permissions.
- Run the server on the same machine and watch the connection establish.
- Use Wireshark to capture the traffic between emulator and server—you'll see plaintext commands and responses.
This exercise shows you how attackers think, what forensic traces they leave, and how to write detection rules. Always keep these experiments on an isolated network with no internet access to avoid accidental exposure.
Download the legitimate open-source version of AndroRAT onto a lab machine, set up a controlled network with an emulated Android device, and observe the traffic. You'll see exactly how a remote access tool operates—and that hands-on experience is the best way to learn how to defend against it.
