#AndroidRat - Twitter Hashtag

7 days ago

BTMOB shifted from a central Android RAT MaaS into a fragmented market of resellers, source-code vendors, and private server operators, with official prices dropping as listings spread across Telegram. #BTMOB #AndroidRAT #Telegram https://t.co/DCbR00jrGJ

0

237

Group-IB Global

@GroupIB

about 1 month ago

#Androidmalware continues to evolve, and #RedHook is a prime example of how legitimate developer features can be repurposed for malicious gain. Our latest research analyzes the newest version of the RedHook #AndroidRAT, which introduces a sophisticated privilege abuse chain by leveraging ADB Wireless Debugging to obtain shell-level access.. Key findings from our analysis: 🔹 Autonomous abuse of ADB Wireless Debugging to gain shell-level privileges (uid 2000) 🔹 Integration of the Shizuku framework to execute protected Android system APIs 🔹 An expanded command-and-control framework supporting 53 remote commands 🔹 A robust persistence stack designed to survive reboots and evade process termination 🔹 Distribution through spoofed government and financial websites, with malicious APKs hosted on trusted platforms such as #GitHub and AWS S3 🔹 Recent activity indicating an expansion of targeting from Vietnam to Indonesia As attackers continue to weaponize legitimate Android features, understanding these evolving tradecrafts is becoming increasingly important for defenders. Read the full technical analysis: https://t.co/wD3ts4OhH9

GroupIB's tweet photo. #Androidmalware continues to evolve, and #RedHook is a prime example of how legitimate developer features can be repurposed for malicious gain.

Our latest research analyzes the newest version of the RedHook #AndroidRAT, which introduces a sophisticated privilege abuse chain by leveraging ADB Wireless Debugging to obtain shell-level access..

Key findings from our analysis:
🔹 Autonomous abuse of ADB Wireless Debugging to gain shell-level privileges (uid 2000)
🔹 Integration of the Shizuku framework to execute protected Android system APIs
🔹 An expanded command-and-control framework supporting 53 remote commands
🔹 A robust persistence stack designed to survive reboots and evade process termination
🔹 Distribution through spoofed government and financial websites, with malicious APKs hosted on trusted platforms such as #GitHub and AWS S3
🔹 Recent activity indicating an expansion of targeting from Vietnam to Indonesia

As attackers continue to weaponize legitimate Android features, understanding these evolving tradecrafts is becoming increasingly important for defenders.

Read the full technical analysis: https://t.co/wD3ts4OhH9

0

14

9

3

1K

Coral Jasmine @Fact_Finder03

5 months ago

Albiriox- #AndroidRAT #bot, #bankingtrojan, cryptocurrency malware, remote access tool. 185.208.156.79 Report: https://t.co/9CIyIElFGF @500mk500 @ViriBack @AndreGironda @skocherhan @Cleafy #Albiriox #RAT #panel #ThreatIntelligence

Fact_Finder03's tweet photo. Albiriox- #AndroidRAT #bot, #bankingtrojan, cryptocurrency malware, remote access tool.

185.208.156.79

Report: https://t.co/9CIyIElFGF

@500mk500
@ViriBack
@AndreGironda
@skocherhan
@Cleafy

#Albiriox #RAT #panel #ThreatIntelligence https://t.co/MbA2hw5QyS

0

2

0

1

395

Coral Jasmine @Fact_Finder03

7 months ago

++ https://82.146.60[.30/ https://purchase[.albiriox.com/ https://albiriox[.com http://privacei[.com/ http://vanish[.exchange/ http://albiriox[.su http://albiriox.pages[.dev @500mk500 @AndreGironda @skocherhan #Albiriox #RAT #panel #ThreatIntelligence #AndroidRAT #Malware

Fact_Finder03's tweet photo. ++ https://82.146.60[.30/
https://purchase[.albiriox.com/
https://albiriox[.com
http://privacei[.com/
http://vanish[.exchange/
http://albiriox[.su
http://albiriox.pages[.dev

@500mk500
@AndreGironda
@skocherhan

#Albiriox #RAT #panel #ThreatIntelligence #AndroidRAT #Malware https://t.co/RdWZINY08a

Coral Jasmine @Fact_Finder03

7 months ago

Albiriox- #AndroidRAT #bot, #bankingtrojan, cryptocurrency malware, remote access tool. https://albiriox[.dev/ http://185.208.156[.92/ Report: https://t.co/eARUOlkgFH @500mk500 @ViriBack @AndreGironda @skocherhan @Cleafy #Albiriox #RAT #panel #ThreatIntelligence

0

7

1

2

2K

0

8

2

11

2K

Coral Jasmine @Fact_Finder03

7 months ago

Albiriox- #AndroidRAT #bot, #bankingtrojan, cryptocurrency malware, remote access tool. https://albiriox[.dev/ http://185.208.156[.92/ Report: https://t.co/eARUOlkgFH @500mk500 @ViriBack @AndreGironda @skocherhan @Cleafy #Albiriox #RAT #panel #ThreatIntelligence

0

7

1

2

2K

ArmoredMobile

@ArmoredMobile

8 months ago

A new Android RAT called Cellik offers full device control, live screen streaming, keylogging, and stealth surveillance, with Google Play app integration to hide malware inside legitimate apps. Read: https://t.co/iwB4zYJWgR #iVerify #Cellik #AndroidRAT #GooglePlay @ArmoredMobile

0

6

1

144

reverseame @reverseame

over 1 year ago

DroidBot: Insights from a new Turkish MaaS fraud operation #DroidBot #MaaS #TurkishFraud #AndroidRAT #CleafyLabs https://t.co/GOZ5TXpBm1

0

9

1

3

722

CyberSkillsHub | Cyber Security Trainings @CyberSkills_Hub

almost 2 years ago

🚨 Android cihazlar için büyük tehdit: RAT’ler! 📱💀 Nedir, nasıl çalışır ve nasıl korunuruz? Detaylar için👇 https://t.co/hIxTgOoelQ #CyberSecurity #AndroidRAT #MobileThreats #Malware #SiberGüvenlik #Android

CyberSkills_Hub's tweet photo. 🚨 Android cihazlar için büyük tehdit: RAT’ler! 📱💀 Nedir, nasıl çalışır ve nasıl korunuruz? Detaylar için👇

https://t.co/hIxTgOoelQ

#CyberSecurity #AndroidRAT #MobileThreats #Malware #SiberGüvenlik #Android https://t.co/tGYIQKplqa

0

1

0

113

✇ ⚪🛡 CyberMaterial ✪ @Cybermaterial_

about 2 years ago

🔒 Stay informed, stay safe! More at https://t.co/3gokVEKttl 🌐 Which recent cyber alert concerns you the most? Comment below! #CyberSecurity #InfoSec #DDoS #DataBreach #Ransomware #FBI #CISA #AndroidRAT #macOSMalware #OneBlood #Fresnillo #TechNews #StaySafeOnline #android

0

3

1

908

Cyber_OSINT @Cyber_O51NT

about 2 years ago

A new Android RAT called SpyMax has been discovered, targeting Telegram users. This Trojan poses a threat to Android users globally. #SpyMax #AndroidRAT #TelegramThreat https://t.co/r4Cggd0rOO

0

3

2

840

K7 Computing @k7computing

about 3 years ago

Stay safe from Spynote Android RAT! Learn how to protect your sensitive information from spies and hackers. Read our latest blog on Spynote and discover how bad actors target IRCTC users. https://t.co/LkKHWliVd0 #K7Security #Spynote #AndroidRAT #CyberSecurity #IRCTC #android

0

1

0

289

Brute Bee @BruteBee

almost 4 years ago

Anyone up for a challenge? This #androidrat zip file is password protected. Its authors are supposed to be Brazilians. It also has #Ransomware features. Not official page may have backdoors 🤣: https://t.co/irs3TeH3yr #malware @malwrhunterteam @ESETresearch

BruteBee's tweet photo. Anyone up for a challenge?
This #androidrat zip file is password protected. Its authors are supposed to be Brazilians. It also has #Ransomware features.

Not official page may have backdoors 🤣:
https://t.co/irs3TeH3yr

#malware
@malwrhunterteam @ESETresearch https://t.co/1bdLWMfo19

1

0

R. @0xrb

almost 4 years ago

Recent #TransparentTribe APT spreading fake whatsapp apk #AhMyth #AndroidRAT C2 IP: 78.138.107(.)166:12862 MD5 Hash: 58cbacf171c0c24268bf2ee356e1566d VT: https://t.co/mDZrwotHg8 cc: @teamcymru_S2 @h2jazi @ShadowChasing1 @Arkbird_SOLG

0xrb's tweet photo. Recent #TransparentTribe APT spreading fake whatsapp apk #AhMyth #AndroidRAT
C2 IP: 78.138.107(.)166:12862
MD5 Hash: 58cbacf171c0c24268bf2ee356e1566d
VT: https://t.co/mDZrwotHg8
cc: @teamcymru_S2 @h2jazi @ShadowChasing1 @Arkbird_SOLG https://t.co/1jscrfcCbY

0

15

7

2

0

R. @0xrb

over 4 years ago

Recent #AndroidRAT #TransparentTribe CrimsonRAT APT C2 IP: 95.111.230.252:4098, 3349 Hash: 868b3d9c6431e57b5a10b04c2c385ee4e507395224e431fdef8012c1351d5325 / new.apk / Google Calendar / 694e9f128904c4e456c76cff2d7534d43afb53384999fd32e4f0b72dd078385e cc: @teamcymru_S2

0xrb's tweet photo. Recent #AndroidRAT #TransparentTribe CrimsonRAT APT
C2 IP: 95.111.230.252:4098, 3349
Hash:
868b3d9c6431e57b5a10b04c2c385ee4e507395224e431fdef8012c1351d5325 / new.apk / Google Calendar /
694e9f128904c4e456c76cff2d7534d43afb53384999fd32e4f0b72dd078385e
cc: @teamcymru_S2 https://t.co/IMXa4vBYuU

0

30

16

1

0

R. @0xrb

over 4 years ago

#TransparentTribe #CrimsonRAT C2 Infrastructure server & multiple C2 servers link to #AhMyth #AndroidRAT also cc: @abuse_ch @h2jazi @ShadowChasing1 @bofheaded

0xrb's tweet photo. #TransparentTribe #CrimsonRAT C2 Infrastructure server & multiple C2 servers link to #AhMyth #AndroidRAT also
cc: @abuse_ch @h2jazi @ShadowChasing1 @bofheaded https://t.co/j5HK9kdMxC

3

53

15

5

0

DynamicCISO @dynamicCISO

almost 5 years ago

A state-sponsored threat actor set up #phishing sites to deliver commodity malware, including #dcRAT and #QuasarRAT for #Windows and #AndroidRAT for mobile devices targeting #Afghanistan and #India. https://t.co/4c8olBhSHw @talossecurity @rneelmani @hacback17 #infosec #ciso #cio

dynamicCISO's tweet photo. A state-sponsored threat actor set up #phishing sites to deliver commodity malware, including #dcRAT and #QuasarRAT for #Windows and #AndroidRAT for mobile devices targeting #Afghanistan and #India.
https://t.co/4c8olBhSHw

@talossecurity @rneelmani @hacback17 #infosec #ciso #cio https://t.co/dELbc9BhmV

0

6

0

Re-ind @ReBensk

almost 5 years ago

#AndroidRAT App Name: 'Balochi Shayri'

MalwareHunterTeam

@malwrhunterteam

almost 5 years ago

Some Android malware sample seen with name "مقبوضہ بلوچستان نیوز.apk" from Pakistan: afc9fbb1ff8cfdd79a781bf493dc426bb059916debbb98c1b7c20a9d0f24a5f7 @bl4ckh0l3z