{
	"id": "279a241d-3835-40a2-bd9a-fe6f844d6dee",
	"created_at": "2026-04-06T00:06:52.763477Z",
	"updated_at": "2026-04-10T03:36:50.208223Z",
	"deleted_at": null,
	"sha1_hash": "a1d09f1c92aa18c82236b0069b6f8ac585b9cef4",
	"title": "AndroRAT (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51470,
	"plain_text": "AndroRAT (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 15:31:09 UTC\r\napk.androrat (Back to overview)\r\nAndroRAT\r\nAndrorat is a remote administration tool developed in Java Android for the client side and in Java/Swing for the\r\nServer. The name Androrat is a mix of Android and RAT (Remote Access Tool). It has been developed in a team\r\nof 4 for a university project. The goal of the application is to give the control of the android system remotely and\r\nretrieve informations from it.\r\nReferences\r\n2025-05-19 ⋅ cocomelonc ⋅ cocomelonc\r\nAIYA - Mobile malware development book. First edition\r\nAndroRAT Anubis CraxsRAT Dendroid FakeGram Hydra IPStorm SpyNote\r\n2022-05-11 ⋅ Cisco Talos ⋅ Cisco Talos\r\nBitter APT adds Bangladesh to their targets\r\nAndroRAT Artra Downloader Bitter RAT ZxxZ\r\n2021-09-08 ⋅ ⋅ Microstep Intelligence Bureau ⋅ Microstep Online Research Response Center\r\nTrilateral operation: years of cyberespionage against countries in south asia and the middle east (APT36)\r\nAndroRAT Crimson RAT\r\n2021-06-01 ⋅ Stratosphere Lab ⋅ Kamila Babayeva, Sebastian García\r\nDissecting a RAT. Analysis of the Command-line AndroRAT.\r\nAndroRAT\r\n2021-03-31 ⋅ Stratosphere Lab ⋅ Kamila Babayeva, Sebastian García\r\nDissecting a RAT. Analysis of the AndroRAT\r\nAndroRAT\r\n2020-11-18 ⋅ Stratosphere Laboratory ⋅ Stratosphere Labs\r\nAndroid Mischief Dataset\r\nAhMyth AndroRAT SpyMax\r\n2020-06-16 ⋅ Bitdefender ⋅ Alin Mihai Barbatei, Denis Cosmin Nutiu, Oana Asoltanei\r\nBitterAPT Revisited: the Untold Evolution of an Android Espionage Tool\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/apk.androrat\r\nPage 1 of 2\n\nAndroRAT Artra Downloader Bitter RAT HAZY TIGER\r\n2018-10-22 ⋅ Kaspersky Labs ⋅ Ilja Shatilin\r\nMobile beasts and where to find them — part four\r\nAndroRAT\r\n2018-08-29 ⋅ Trend Micro ⋅ Daniel Lunghi, Ecular Xu\r\nThe Urpage Connection to Bahamut, Confucius and Patchwork\r\nAndroRAT Bahamut\r\n2016-08-08 ⋅ Bitdefender ⋅ Liviu Arsene\r\nPossibly Italy-Born Android RAT Reported in China, Find Bitdefender Researchers\r\nAndroRAT\r\n2012-11-16 ⋅ Github (DesignativeDave) ⋅ DesignativeDave\r\nRemote Administration Tool for Android devices\r\nAndroRAT\r\nThere is no Yara-Signature yet.\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/apk.androrat\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/apk.androrat\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/apk.androrat"
	],
	"report_names": [
		"apk.androrat"
	],
	"threat_actors": [
		{
			"id": "732bfd4b-8c15-42a5-ac4b-14a9a4b902e9",
			"created_at": "2022-10-25T16:07:23.38079Z",
			"updated_at": "2026-04-10T02:00:04.574399Z",
			"deleted_at": null,
			"main_name": "Bahamut",
			"aliases": [],
			"source_name": "ETDA:Bahamut",
			"tools": [
				"Bahamut",
				"DownPaper"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "414d7c65-5872-4e56-8a7d-49a2aeef1632",
			"created_at": "2025-08-07T02:03:24.7983Z",
			"updated_at": "2026-04-10T02:00:03.76109Z",
			"deleted_at": null,
			"main_name": "COPPER FIELDSTONE",
			"aliases": [
				"APT36 ",
				"Earth Karkaddan ",
				"Gorgon Group ",
				"Green Havildar ",
				"Mythic Leopard ",
				"Operation C-Major ",
				"Operation Transparent Tribe ",
				"Pasty Draco ",
				"ProjectM ",
				"Storm-0156 "
			],
			"source_name": "Secureworks:COPPER FIELDSTONE",
			"tools": [
				"CapraRAT",
				"Crimson RAT",
				"DarkComet",
				"ElizaRAT",
				"LuminosityLink",
				"ObliqueRAT",
				"Peppy",
				"njRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "37714790-40c0-4b6b-8e49-1c8f45a0463f",
			"created_at": "2022-10-25T16:07:24.37091Z",
			"updated_at": "2026-04-10T02:00:04.961707Z",
			"deleted_at": null,
			"main_name": "Urpage",
			"aliases": [],
			"source_name": "ETDA:Urpage",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "655f7d0b-7ea6-4950-b272-969ab7c27a4b",
			"created_at": "2022-10-27T08:27:13.133291Z",
			"updated_at": "2026-04-10T02:00:05.315213Z",
			"deleted_at": null,
			"main_name": "BITTER",
			"aliases": [
				"T-APT-17"
			],
			"source_name": "MITRE:BITTER",
			"tools": [
				"ZxxZ"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "bbf66d2d-3d20-4026-a2b5-56b31eb65de4",
			"created_at": "2025-08-07T02:03:25.123407Z",
			"updated_at": "2026-04-10T02:00:03.668131Z",
			"deleted_at": null,
			"main_name": "ZINC EMERSON",
			"aliases": [
				"Confucius ",
				"Dropping Elephant ",
				"EHDevel ",
				"Manul ",
				"Monsoon ",
				"Operation Hangover ",
				"Patchwork ",
				"TG-4410 ",
				"Viceroy Tiger "
			],
			"source_name": "Secureworks:ZINC EMERSON",
			"tools": [
				"Enlighten Infostealer",
				"Hanove",
				"Mac OS X KitM Spyware",
				"Proyecto2",
				"YTY Backdoor"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "f99641e0-2688-47b0-97bc-7410659d49a0",
			"created_at": "2023-01-06T13:46:38.802141Z",
			"updated_at": "2026-04-10T02:00:03.106084Z",
			"deleted_at": null,
			"main_name": "Bahamut",
			"aliases": [],
			"source_name": "MISPGALAXY:Bahamut",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "fce5181c-7aab-400f-bd03-9db9e791da04",
			"created_at": "2022-10-25T15:50:23.759799Z",
			"updated_at": "2026-04-10T02:00:05.3002Z",
			"deleted_at": null,
			"main_name": "Transparent Tribe",
			"aliases": [
				"Transparent Tribe",
				"COPPER FIELDSTONE",
				"APT36",
				"Mythic Leopard",
				"ProjectM"
			],
			"source_name": "MITRE:Transparent Tribe",
			"tools": [
				"DarkComet",
				"ObliqueRAT",
				"njRAT",
				"Peppy"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "7a8dbc5e-51a8-437a-8540-7dcb1cc110b8",
			"created_at": "2022-10-25T16:07:23.482856Z",
			"updated_at": "2026-04-10T02:00:04.627414Z",
			"deleted_at": null,
			"main_name": "Confucius",
			"aliases": [
				"G0142"
			],
			"source_name": "ETDA:Confucius",
			"tools": [
				"ApacheStealer",
				"ByeByeShell",
				"ChatSpy",
				"Confucius",
				"MY24",
				"Sneepy",
				"remote-access-c3",
				"sctrls",
				"sip_telephone",
				"swissknife2"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "7ea1e0de-53b9-4059-802f-485884180701",
			"created_at": "2022-10-25T16:07:24.04846Z",
			"updated_at": "2026-04-10T02:00:04.84985Z",
			"deleted_at": null,
			"main_name": "Patchwork",
			"aliases": [
				"APT-C-09",
				"ATK 11",
				"Capricorn Organisation",
				"Chinastrats",
				"Dropping Elephant",
				"G0040",
				"Maha Grass",
				"Quilted Tiger",
				"TG-4410",
				"Thirsty Gemini",
				"Zinc Emerson"
			],
			"source_name": "ETDA:Patchwork",
			"tools": [
				"AndroRAT",
				"Artra Downloader",
				"ArtraDownloader",
				"AutoIt backdoor",
				"BADNEWS",
				"BIRDDOG",
				"Bahamut",
				"Bozok",
				"Bozok RAT",
				"Brute Ratel",
				"Brute Ratel C4",
				"CinaRAT",
				"Crypta",
				"ForeIT",
				"JakyllHyde",
				"Loki",
				"Loki.Rat",
				"LokiBot",
				"LokiPWS",
				"NDiskMonitor",
				"Nadrac",
				"PGoShell",
				"PowerSploit",
				"PubFantacy",
				"Quasar RAT",
				"QuasarRAT",
				"Ragnatela",
				"Ragnatela RAT",
				"SocksBot",
				"TINYTYPHON",
				"Unknown Logger",
				"WSCSPL",
				"Yggdrasil"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c81067e0-9dcb-4e3f-abb0-80126519c5b6",
			"created_at": "2022-10-25T15:50:23.285448Z",
			"updated_at": "2026-04-10T02:00:05.282202Z",
			"deleted_at": null,
			"main_name": "Patchwork",
			"aliases": [
				"Hangover Group",
				"Dropping Elephant",
				"Chinastrats",
				"Operation Hangover"
			],
			"source_name": "MITRE:Patchwork",
			"tools": [
				"NDiskMonitor",
				"QuasarRAT",
				"BackConfig",
				"TINYTYPHON",
				"AutoIt backdoor",
				"PowerSploit",
				"BADNEWS",
				"Unknown Logger"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "acd789fa-d488-47f3-b9cc-fdb18b1fa375",
			"created_at": "2023-01-06T13:46:39.332092Z",
			"updated_at": "2026-04-10T02:00:03.290017Z",
			"deleted_at": null,
			"main_name": "HAZY TIGER",
			"aliases": [
				"T-APT-17",
				"APT-C-08",
				"Orange Yali",
				"TA397"
			],
			"source_name": "MISPGALAXY:HAZY TIGER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "8fddd571-37dc-4bb2-84b4-e41ac6fd11f5",
			"created_at": "2024-02-08T02:00:04.32487Z",
			"updated_at": "2026-04-10T02:00:03.584509Z",
			"deleted_at": null,
			"main_name": "Urpage",
			"aliases": [],
			"source_name": "MISPGALAXY:Urpage",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "ada9e5d3-1cb2-4b70-a3c8-96808c304ac8",
			"created_at": "2022-10-25T15:50:23.6515Z",
			"updated_at": "2026-04-10T02:00:05.352078Z",
			"deleted_at": null,
			"main_name": "Windshift",
			"aliases": [
				"Windshift",
				"Bahamut"
			],
			"source_name": "MITRE:Windshift",
			"tools": [
				"WindTail"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "caf95a6f-2705-4293-9ee1-6b7ed9d9eb4c",
			"created_at": "2022-10-25T15:50:23.472432Z",
			"updated_at": "2026-04-10T02:00:05.352882Z",
			"deleted_at": null,
			"main_name": "Confucius",
			"aliases": [
				"Confucius",
				"Confucius APT"
			],
			"source_name": "MITRE:Confucius",
			"tools": [
				"WarzoneRAT"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "bf6cb670-bb69-473f-a220-97ac713fd081",
			"created_at": "2022-10-25T16:07:23.395205Z",
			"updated_at": "2026-04-10T02:00:04.578924Z",
			"deleted_at": null,
			"main_name": "Bitter",
			"aliases": [
				"G1002",
				"T-APT-17",
				"TA397"
			],
			"source_name": "ETDA:Bitter",
			"tools": [
				"Artra Downloader",
				"ArtraDownloader",
				"Bitter RAT",
				"BitterRAT",
				"Dracarys"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c68fa27f-e8d9-4932-856b-467ccfe39997",
			"created_at": "2023-01-06T13:46:38.450585Z",
			"updated_at": "2026-04-10T02:00:02.980334Z",
			"deleted_at": null,
			"main_name": "Operation C-Major",
			"aliases": [
				"APT36",
				"APT 36",
				"TMP.Lapis",
				"COPPER FIELDSTONE",
				"Storm-0156",
				"Transparent Tribe",
				"ProjectM",
				"Green Havildar",
				"Earth Karkaddan",
				"C-Major",
				"Mythic Leopard"
			],
			"source_name": "MISPGALAXY:Operation C-Major",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434012,
	"ts_updated_at": 1775792210,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/a1d09f1c92aa18c82236b0069b6f8ac585b9cef4.pdf",
		"text": "https://archive.orkl.eu/a1d09f1c92aa18c82236b0069b6f8ac585b9cef4.txt",
		"img": "https://archive.orkl.eu/a1d09f1c92aa18c82236b0069b6f8ac585b9cef4.jpg"
	}
}