S1095 AhRat

malwareMobile

platformsAndroid

also known asAhRat

AhRat is an Android remote access tool based on the open-source AhMyth remote access tool. AhRat initially spread in August 2022 on the Google Play Store via an update containing malicious code to the previously benign application, “iRecorder – Screen Recorder,” which itself was released in September 2021.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1398Boot or Logon Initialization Scripts
T1406Obfuscated Files or Information
T1420File and Directory Discovery
T1426System Information Discovery
T1429Audio Capture
T1430Location Tracking
T1437.001Web Protocols
T1513Screen Capture
T1521Encrypted Channel
T1533Data from Local System
T1582SMS Control
T1624.001Broadcast Receivers
T1636.002Call Log
T1636.003Contact List
T1646Exfiltration Over C2 Channel

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan