Loading malware…
AhRat is an Android remote access trojan used for surveillance and data theft on compromised mobile devices. Its observed functionality includes collecting device profiling information such as manufacturer, device identifier, operating system version, and country; harvesting sensitive user data including contact lists and call logs; sending SMS messages; and locating and exfiltrating files of interest, including common media and document formats. AhRat also exfiltrates collected material such as audio recordings and files to command-and-control infrastructure and communicates with its operators over HTTPS. For persistence and event-triggered execution, it can register Android broadcast receivers for connectivity-related events, allowing additional functionality to be activated when network state changes. The malware is therefore characterized by a combination of mobile surveillance, data collection, exfiltration, and Android-specific persistence mechanisms.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
AbstractEmu can collect files from or inspect the device’s filesystem. AhRat can find and exfiltrate files with certain extensions, such as .jpg, .mp4, .html, .docx, and .pdf. BOULDSPY can access browser history and bookmarks, and can list all files and folders on the device.
SpyNote RAT can copy files from the device to the C2 server. ViceLeaker can copy arbitrary files from the device to the C2 server, can exfiltrate browsing history, can exfiltrate the SD card structure, and can exfiltrate pictures as the user takes them. TriangleDB has collected and exfiltrated files.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android malware capable of locating and exfiltrating files with selected extensions.
Remote access trojan capable of locating and exfiltrating files with selected extensions.
Android malware capable of locating and exfiltrating files with selected extensions.
Android malware that can send SMS messages from infected devices.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.