The response codes have a base of 200 and add a value ranging from 0 to 15 to that base. This packet includes the acknowledgement data, total length, data length, the channel (multiplexed), as well as a short and bool for following the packet sequence. The response message is packed into a custom packet via the following function call sequence (format: ClassName.function): The APK gives an acknowledgment to requests received. The resulting packet data size for requests hovers around 21 bytes. Then it is wrapped with other meta info in TransportPacket. This is wrapped with the target channel (multiplexed) and arguments in CommandPacket.

For requests the base number is 100, then a value ranging from 0 to 23 is added to it for the code. As well, a few were not compatible with the Android emulator (for example, vibrate).Ĭommunication In the file inout/Protocol.java the request and response codes are listed. A few of the functions gave errors, but most worked. Here we can see the debug apk and the server program:Īfter setting up a contact list, a few fake conversations, and a call log I went to test these out. The debug APK conveniently allows the user to set the server's IP and port. To test that everything was working I ran the server from Eclipse and simply loaded up the debug APK. I was pleasantly surprised at how easy this was to get working. To get the server running, I was able to simply drop all of the source files into an Eclipse project, add the dependencies, and fix up one import that didn't agree with my system.

Additionally, it contained all of the source code for the server as well as its dependencies.

It contained two compiled debug versions of the Androrat APK, the source code for these, and some class files. It has since been removed from the Github account on which it was hosted, and for privacy reasons these students will not be named here.Ī law enforcement agency provided us with a zip file that appears to be a dump of the Github repository. According to their README, it was completed in one month. According to the post, Androrat is the default malicious package provided with this software.Īndrorat was the project of four university students from France. Androrat recently fell into the spotlight thanks to this Webroot blog post that highlights a user-friendly Android trojan maker. In case you're unfamiliar, RATs provide backdoor functionality to an operator, giving access to your system and private data. Androrat is an appropriately named remote access tool (or RAT) for Android.

Androrat apk android