Loading malware…
DroidJack, also known as SandroRAT, is an Android remote access trojan used to obtain near-complete remote control of infected mobile devices. It has been distributed through trojanized Android applications that masquerade as popular or legitimate software, including repackaged game-themed lures and fake utility or update apps, typically relying on users to sideload malicious APKs from outside trusted app stores. The malware has also appeared in targeted intrusion activity against Syrian opposition figures, where it was delivered as part of a broader multi-platform operation with Iran nexus indicators.
Once installed, DroidJack supports extensive surveillance and data theft from Android devices. Documented capabilities include capturing SMS data, harvesting call logs and call-related data, recording device phone calls, extracting WhatsApp data, and using the device camera to capture video. Reporting also attributes broader remote-administration and spying functionality to DroidJack, including effective full control of the victim phone and, in some campaigns, theft of contacts, file browsing, location tracking, and remote activation of camera and microphone functions. Collected data may be staged locally before transmission to command-and-control infrastructure.
DroidJack is notable for masquerading as legitimate applications by embedding or repackaging benign app code so the malicious APK appears authentic to the victim. Observed lures have exploited demand around high-profile mobile games and fake software updates to drive installation. The malware is primarily associated with Android surveillance, espionage, and criminal abuse scenarios rather than destructive activity.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"The APK is an instance of DroidJack. According to Symantec, this malware evolved from an older codebase known as SandroRAT."
11 distinct techniques documented for this family, organized by ATT&CK tactic.
"we uncovered a watering hole website with malicious programs, malicious PowerPoint files, and Android malware" ... "Group5 operated a website, assadcrimes[.]info that served as a watering hole for Android and Windows malware"
Bouncing Golf distributed malware as repackaged legitimate applications, with the malicious code in the com.golf package.
"Boot Completed Allows the application to re-connect when the device restarts"; "starts the Controller Service when the phone boots"
"Boot Completed Allows the application to re-connect when the device restarts"; "starts the Controller Service when the phone boots"
The malicious package claims to be the Super Mario Run game... but in reality this is a malicious RAT called DroidJack (also known as SandroRAT) that is getting installed.
"Upon execution, the malware is installed and then hidden from the list of installed applications... Application icon will be removed... yet it will still be running in the background"
DroidJack RAT starts capturing sensitive information like call data, SMS data, videos, photos, etc... Upon further inspection, we have observed that this RAT extracts WhatsApp data too.
Observe below the code routine for call recording... This RAT records all the calls and stores the recording to an “.amr” file.
The following is the code routine for video capturing... Here, the RAT stores all the captured videos in a “video.3gp” file.
The RAT stores all the data in a database (DB) in order to send it to the Command & Control (C&C) server. We saw the following hardcoded C&C server location in the RAT package.
OmniRat is currently being used and spread by criminals to gain full remote control of devices... Once installed, OmniRat gives full remote administrative control of the device to the attacker.
No-ip.org is a service used to associate a domain name with a dynamic IP address... but is also used frequently by threat actors, along with other similar services like DynDNS.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.