1. Home
  2. Software
  3. AhRat

AhRat

AhRat is an Android remote access tool based on the open-source AhMyth remote access tool. AhRat initially spread in August 2022 on the Google Play Store via an update containing malicious code to the previously benign application, "iRecorder – Screen Recorder", which itself was released in September 2021.[1]

ID: S1095
ⓘ
Type: MALWARE
ⓘ
Platforms: Android
Contributors: Edward Stevens; BT Security
Version: 1.0
Created: 18 December 2023
Last Modified: 16 April 2024
Version Permalink
Mobile Layer
download view

Techniques Used

Domain ID Name Use
Mobile T1437 .001 Application Layer Protocol: Web Protocols

AhRat can communicate with the C2 using HTTPS requests.[1]
Mobile T1429 Audio Capture

AhRat can record audio using a device’s microphone.[1]
Mobile T1398 Boot or Logon Initialization Scripts

AhRat can register with the BOOT_COMPLETED broadcast to start when the device turns on.[1]
Mobile T1533 Data from Local System

AhRat can find and exfiltrate files with certain extensions, such as .jpg, .mp4, .html, .docx, and .pdf.[1]
Mobile T1521 Encrypted Channel

AhRat can communicate with the C2 using HTTPS requests.[1]
Mobile T1624 .001 Event Triggered Execution: Broadcast Receivers

AhRat can register with the CONNECTIVITY_CHANGE and WIFI_STATE_CHANGED broadcast events to trigger further functionality.[1]
Mobile T1646 Exfiltration Over C2 Channel

AhRat can exfiltrate collected data to the C2, such as audio recordings and files.[1]
Mobile T1420 File and Directory Discovery

AhRat can enumerate files on external storage.[1]
Mobile T1430 Location Tracking

AhRat can track the device’s location.[1]
Mobile T1406 Obfuscated Files or Information

AhRat can use an encryption key received from its C2 to encrypt and decrypt configuration files and exfiltrated data.[1]
Mobile T1636 .002 Protected User Data: Call Log

AhRat can collect the device’s call log.[1]
.003 Protected User Data: Contact List

AhRat can collect the device’s contact list.[1]
Mobile T1513 Screen Capture

AhRat can record the screen.[1]
Mobile T1582 SMS Control

AhRat can send SMS messages.[1]
Mobile T1426 System Information Discovery

AhRat can obtain device info such as manufacturer, device ID, OS version, and country.[1]

References

  1. Lukas Stefanko. (2023, May 23). Android app breaking bad: From legitimate screen recording to file exfiltration within a year. Retrieved December 18, 2023.