Blog

AndroRAT is an open-source remote access trojan designed for Android devices. First published on GitHub in 2013, it quickly became a staple in both security research and real-world attacks because of its simplicity and power. Unlike commercial remote administration tools such as TeamViewer, AndroRAT is built specifically for covert surveillance—it can read SMS messages, record calls, track GPS location, capture keystrokes, and even take photos with the device camera without the user's knowledge. For a beginner in cybersecurity, studying AndroRAT is an excellent way to understand how mobile malware operates and, more importantly, how to defend against it.

What Is AndroRAT Exactly?

AndroRAT stands for Android Remote Access Tool. It is a client-server application: the attacker runs a server component (typically a Java-based controller) on their machine, and the victim unknowingly installs the client APK on their Android phone. Once the client connects to the server over the internet, the attacker gains near-total control of the device. The code is publicly available on platforms like GitHub, which makes it a double-edged sword—legitimate pentesters use it in controlled labs to test defenses, while malicious actors repackage it into fake apps and distribute them through third-party stores or phishing links.

How AndroRAT Operates

After installation, the AndroRAT client typically requests a set of dangerous permissions: READ_SMS, ACCESS_FINE_LOCATION, CAMERA, RECORD_AUDIO, INTERNET, and READ_CONTACTS. Modern Android versions (10 and above) show a permission prompt, but many users blindly tap “Allow” when an app claims to be a game or utility. Once permissions are granted, the client connects to the attacker’s IP address (hardcoded or retrieved from a dynamic DNS service) and opens a persistent socket. The attacker can then send commands such as:

• getSMS – retrieve all text messages
• getContacts – exfiltrate the contact list
• getGPS – fetch real-time GPS coordinates
• startCamera – silently take a photo using the front or rear camera
• startVoiceRecord – record ambient audio through the microphone
• openURL – force the browser to open a phishing page

The data is sent back over the same TCP connection, often encrypted with a simple XOR or AES scheme to evade network-based detection. Because the connection is initiated from the device (outbound), many firewalls do not block it.

Common Infection Vectors

Understanding how AndroRAT spreads is key to prevention. The most common methods include:

• Repackaged apps – Attackers take a popular game or utility, decompile it, inject the AndroRAT client, recompile, and upload the infected APK to unofficial app stores or torrent sites.
• Phishing links – A text message or email urges the victim to “update your banking app” or “claim a prize” and provides a direct APK download link.
• Bluetooth or NFC – In close proximity, an attacker can send the APK file via Bluetooth or use an NFC tag to trigger a download.
• USB debugging – If a device has USB Debugging enabled and is connected to a compromised computer, an attacker can sideload the APK via ADB.

Detection Techniques for Defenders

As a security learner, you should know how to spot an AndroRAT infection without relying on antivirus alone. Look for these indicators on a test device:

• Unexplained data usage – A sudden spike in background data, especially to an unfamiliar IP address, is a red flag.
• Overheating and battery drain – The malware keeps the CPU active for network communication and GPS polling.
• Strange permissions – An app that claims to be a calculator but requests access to SMS and camera is suspicious.
• Background services – Use adb shell dumpsys activity services to list running services; look for packages with generic names like com.android.service or com.system.update.
• Network traffic anomalies – Tools like tcpdump or Wireshark can capture packets leaving the device. AndroRAT often sends periodic heartbeat messages or data chunks to a remote server.

For a deeper dive into common Android security pitfalls, check out our guide on 5 Android Issues You Can Fix Easily by Yourself, which covers permission management and app vetting.

Prevention and Digital Hygiene

Defending against AndroRAT and similar mobile RATs comes down to solid digital hygiene. Here are concrete steps every Android user should follow:

• Install apps only from Google Play – While not perfect, Play Store scans apps with Google Play Protect, reducing the chance of encountering repackaged malware.
• Review permissions carefully – Deny any permission that does not directly support the app’s core function. For example, a flashlight app does not need access to your contacts.
• Keep Android and apps updated – Many AndroRAT variants exploit vulnerabilities patched in newer OS versions. Enable automatic updates.
• Disable “Install from unknown sources” – This setting should remain off unless you intentionally sideload a trusted APK for testing.
• Use a firewall app – Tools like NetGuard (for non-rooted devices) can block specific apps from accessing the internet unless you explicitly allow them.
• Regularly audit installed apps – Go through your app list every month and remove anything you do not recognize or use.

Setting Up a Safe Analysis Lab

If you want to study AndroRAT from a defensive perspective, you must do so in an isolated environment. Here is a practical lab setup:

• Android emulator – Use Android Studio’s AVD (Android Virtual Device) with an older API level (e.g., API 24) to mimic a vulnerable device. Do not connect it to your production network.
• Network isolation – Run the emulator inside a virtual machine (VirtualBox or VMware) with a host-only adapter. This prevents the malware from reaching the internet and leaking data.
• Monitoring tools – Install mitmproxy or Wireshark on the host machine to capture and inspect all traffic from the emulator. You can also use Frida to hook into the app’s functions and observe its behavior.
• Static analysis – Decompile the AndroRAT APK using jadx or apktool to examine its code, permissions, and hardcoded C2 addresses. This is a great way to learn Android reverse engineering.
• Controlled execution – After you understand the malware’s logic, run it in the isolated emulator and watch how it behaves. Note the network connections it tries to make, the files it creates, and the permissions it abuses.

Remember: never run AndroRAT on a device you care about or on a network that has access to sensitive data. The entire point of a lab is to contain the threat. Once your analysis is complete, destroy the virtual machine or restore the emulator to a clean snapshot.

To take your first concrete step today: download the official Android Studio, create an emulator with API 24, and install mitmproxy on your host. Configure the emulator to route traffic through the proxy, and then practice capturing benign app traffic before you ever touch a malware sample. This builds the foundational skill of traffic analysis that you will use against real threats like AndroRAT.