Add Quark malware analysis report for AndroRAT

[pulorsok]

AndroRAT Malware Family Analysis Report

This report analyzes the AndroRAT malware family using Quark's rule classification. AndroRAT is one of the earliest open-source Android remote access trojans, originating from a 2012 university project (DesignativeDave/AndroRAT). Its source code has been extensively forked and repackaged over the years — including the DroidJack commercial fork, the karma9874 revival, and various trojanized carrier apps in third-party stores. A new Quark rule (#278) was generated to detect the video-capture pattern used by the DroidJack fork (MediaRecorder.setVideoSource + setProfile); other distinctive bytecode patterns (microphone audio capture, last-known-location lookups, SMS send + inbox reads, phone-call intents, call-log reads via ContentResolver) are already covered by Quark's existing rule set. Check here for the rule set details.

Quark's rule classification flagged 5 of 5 AndroRAT samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. See tested APKs below.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0292 AndroRAT software entry. Of the 10 techniques documented for the family, Quark's static bytecode analysis surfaces the 7 listed below; see the coverage-gap notes at the end of this section for why the other 3 are not demonstrated here.

MITRE Technique	Real-world manifestation in AndroRAT
T1429 Audio Capture	Recording ambient microphone audio via MediaRecorder from a background service for on-device surveillance
T1430 Location Tracking	Reading the device's last-known GPS coordinates via LocationManager.getLastKnownLocation for later collection by the RAT dispatcher
T1582 SMS Control	Receiving operator commands over the C2 socket and issuing outbound SmsManager.sendTextMessage sends from the command dispatcher
T1616 Call Control	Constructing an Intent.ACTION_CALL intent with an operator-supplied phone number and invoking startActivity to place the call
T1512 Video Capture	Configuring a MediaRecorder video source and camcorder profile inside a helper class that records video for exfiltration
T1636.002 Call Log	Querying the call-log ContentResolver URI to extract call history for exfiltration
T1636.004 SMS Messages	Reading SMS inbox contents (sender address, message body) via ContentResolver for exfiltration

All cluster representatives below were extracted from either sample 48d25786... (net.droidjack.sandrorat — the DroidJack fork) or sample 9c8d02ff... (my.app.client — the pristine AndroRAT builder default) or sample 347f1b01... (com.example.reverseshell2 — a widely-forked open-source variant). Different techniques picked different samples as their strongest evidence source. The remaining samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then walk through the call sequence and list the underlying rules.

1. T1429 Audio Capture

T1429 Audio Capture — attack.mitre.org

MITRE definition (T1429): Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.

Lnet/droidjack/sandrorat/VideoCap;a (an attacker-authored capture helper in the DroidJack fork) initializes a MediaRecorder with the microphone as its audio source and starts recording ambient audio to a file. The captured audio is then read back by the RAT dispatcher for delivery to the operator.

Behaviors detected by Quark:

• Initialize the recorder and start recording (Clean Up the Direct Use of MethodAnalysis (Sourcery refactored) #198)

2. T1430 Location Tracking

T1430 Location Tracking — attack.mitre.org

MITRE definition (T1430): Adversaries may track a device's physical location through use of standard operating system APIs via malicious or exploited applications on the compromised device. On Android, applications holding the ACCESS_COARSE_LOCATION or ACCESS_FINE_LOCATION permissions provide access to the device's physical location.

Lnet/droidjack/sandrorat/GPSLocation;e (an attacker-authored location helper in the DroidJack fork) calls LocationManager.getLastKnownLocation and reads the latitude/longitude off the returned Location instance. The call sequence returns the device's last-known GPS coordinates to the RAT dispatcher.

Behaviors detected by Quark:

• Get last known location of the device (Modify the update mechanism of quark-rules according to issue #114 #115)

3. T1582 SMS Control

T1582 SMS Control — attack.mitre.org

MITRE definition (T1582): Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware via SMS, or various external effects.

Lmy/app/client/ProcessCommand;process (the C2 command dispatcher in the pristine AndroRAT builder namespace) receives operator commands over the socket and routes each command to a helper. Two of those helpers — the SMS-send branch reaching SmsManager.sendTextMessage and the SMS-read branch reaching SMSLister;listSMS — together let the remote operator both inject outbound SMS and pull inbox content on demand.

Behaviors detected by Quark:

• Send a SMS message (Show Parent Functions' Cross-References In Rule Classification (Sourcery refactored) #193)

4. T1616 Call Control

T1616 Call Control — attack.mitre.org

MITRE definition (T1616): Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.

Lnet/droidjack/sandrorat/m;a (an attacker-authored call helper in the DroidJack fork) constructs an Intent with the ACTION_CALL action, packs an operator-supplied phone number into the intent's URI via setData, and invokes startActivity — placing an outbound phone call without user consent.

Behaviors detected by Quark:

• Put a phone number into an intent (Make Apkinfo implement the standard APK interface #203)
• Make a phone call (Have Click as an optional dependency #202)
• Implicit intent(view a web page, make a phone call, etc.) via setData (fixes bug issue in #50 #51)

5. T1512 Video Capture

T1512 Video Capture — attack.mitre.org

MITRE definition (T1512): An adversary can leverage a device's cameras to gather information by capturing video recordings. Images may also be captured, potentially in specified intervals, in lieu of video files.

Lnet/droidjack/sandrorat/VideoCap;a (an attacker-authored capture helper in the DroidJack fork) calls MediaRecorder.setVideoSource to select the device camera as the recording input, then MediaRecorder.setProfile to apply a camcorder recording profile in preparation for exfiltrating the captured video to the RAT dispatcher. Rule #278 was added in this run to cover this pair.

Behaviors detected by Quark:

• Configure video source and camcorder profile for video capture recording (fix: add missing comma between two depends in debian/control #278)

6. T1636.002 Call Log

T1636.002 Call Log — attack.mitre.org

MITRE definition (T1636.002): Adversaries may utilize standard operating system APIs to gather call log data. On Android, this can be accomplished using the Call Log Content Provider.

Lcom/example/reverseshell2/Payloads/readSMS;readSMSBox (an attacker-authored payload class in the reverseshell2 open-source variant — despite the SMS-suggestive name, the method queries both the SMS and call-log content-provider URIs) opens a ContentResolver cursor against those URIs and copies the returned rows into an exfiltration buffer.

Behaviors detected by Quark:

• Query data from URI (SMS, CALLLOGS) (Welcome gwalstat #11)
• Read sensitive data(SMS, CALLLOG, etc) (UnicodeEncodeError: 'gbk' codec can't encode character '\u037d' #77)

7. T1636.004 SMS Messages

T1636.004 SMS Messages — attack.mitre.org

MITRE definition (T1636.004): Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider.

Lnet/droidjack/sandrorat/bd;b (an attacker-authored SMS reader in the DroidJack fork) opens a ContentResolver cursor against the SMS content URI, iterates the result set, and extracts sender address, inbox row IDs, and message body strings for exfiltration.

Behaviors detected by Quark:

• Get messages in the SMS inbox (Show Parent Functions' Cross-References in Rule Classification #191)
• Get the address of a SMS message (Bug in the call graph function #188)
• Get the content of a SMS message (Refactor/enrich the rest of Quark's tests #189)

Coverage-gap notes

The 3 MITRE techniques documented for AndroRAT that this report does NOT demonstrate:

• T1422 System Network Configuration Discovery — the samples do read SIM operator and SIM state, but the reads are single-API calls (TelephonyManager.getSimOperator, getSimState) whose bytecode is indistinguishable from what carrier, dual-SIM, roaming-detector, and MFA apps do for legitimate reasons. Quark's rule format requires two APIs linked by data flow, so this single-API dual-use surface cannot be expressed as a stand-alone rule without a companion API that isolates the malware use case — a rule of that shape does not currently exist in the pool.
• T1636.003 Contact List — reading the contacts content provider is likewise a single-step call (ContentResolver.query(Contacts.CONTENT_URI)) that every messenger, dialer, and address-book app performs. This hits the same Quark architectural limit as T1422: no discriminative two-API pattern is available.
• T1655.001 Match Legitimate Name or Location — this is a runtime impersonation technique (app icon / name / package-name similarity to a real app) requiring cross-app comparison at install time; it is out of scope for static bytecode analysis.

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	347F1B018F643DE0B9C946C94BD490A7426503869A0828B0A70B4D318FA097D6
2	48D25786B7512761ED561BB50DE4C0BD8A19DF0E5DE2BC40CD9D84DDDF11C16D
3	9C8D02FF190F5929BC6745A541C326B2CD387D3145C759823D24972E65398A99
4	C5AB0ADAEDF391A395387DF33B0BF6854F1CCC9C5DA937915EA86B5EEC6E6103
5	D62705186C488BB26FCCDB1404931223A887004FD6704AC1483E599A15E92792

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.29%. Comparing base (0a39d96) to head (03bdd4a).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #954      +/-   ##
==========================================
+ Coverage   80.27%   80.29%   +0.01%     
==========================================
  Files          82       82              
  Lines        7185     7190       +5     
==========================================
+ Hits         5768     5773       +5     
  Misses       1417     1417              

Flag	Coverage Δ
unittests	80.29% <ø> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[haeter525]

LGTM!