(Jul 8, 2023 04:05 PM)Dyne Wrote:  AndroSpy, Android Tester 6.4.6 should get you started and used to Android RATs and their functionality. It's important to learn the strict differences between windows and Android. Including a firm understanding of Last in, first Out (LIFO) work process.

However, keep in mind, most free and even paid RATs don't include a working remote desktop/"VNC" like functions and house very limited functionality. Infact, alot of applications cannot be viewed over TLS because of the nature of "VNC". Some overlay permissions strip the rights of android OS sub user to overlay permission on applications, thus preventing screenshots. Software that can somewhat overcome these restrictions are known as Android/iOS Banking Trojans, under the strain name "Botnet"/"Loader" and not referred to as a RAT.

Most working VNC-like modules for mobile devices are based on rapid screenshot interval, which take screenshots of the device on timed interval, action intervals and send them back to the C2(C&C center) for review by the operator of the malware. Couple this with a mapped TouchID injection (graph mapping "touch" areas of the device by (x , y)) can make for a devastating trojan.

Some examples of commercial Android Banking Trojans are Octo, Hook/ERMAC-2, AlienBot, JokerrBot(subscribeware banking trojan).
Each botnet has its' own strengths and weaknesses.



EDIT:
The Shitlist of RATs are as follows: Spynote, CraxsRAT, BrataRAT, CypherRAT, PekkaRAT and any other RAT that looks like it was made in AutoIT x MSPaint.
Please do not purchase without a thorough test of the product.

(Jul 9, 2023 05:09 AM)Dyne Wrote:  jpeg exploits do not exist. These are well crafted scams reliant on OLD exploits that are long patched.
a jpeg exploit in modern day that could be independently sent regardless of software would be worth millions and utilized by state actors for political agendas.

Hooks output is an .apk, just like Octo and Alien.

The best method of spreading at the current time without exploits that drop and install the .apk would be to host a legitimate application on the google play store with an aged cert/account, and have the application fetch an automatic "update" from an update server hosted by you.
Hardcode the .apk once permissions are granted on the initial app disguised as an update.

When the app is launched, it will fetch an automatic update, installing your app.


There are other methods of installation, too. Though it has gotten more difficult since Android11, they are still available but fetch a higher price tag like the Samsung phishing page installable via spoofed notification bar triggered by sms here;

Spoiler (Click to View)









Which will feed and install your malicious .apk disguised as a security update for Samsung Mobile devices. The same exists for LG, Google and most other popular vendors.



So, in short, spreading for mobile devices is not cheap, and often requires a high degree of social engineering to target the victim to install the actual application if you aren't willing to shell out capital funds for an adequate delivery method.

(Jul 9, 2023 04:29 PM)Dyne Wrote:  A backdoor doesn't effect their performance and capabilities.
Tell EVLF I said "Hi, no matter how many times you put on a different mask; it won't hide the bad development".

(Jul 9, 2023 04:29 PM)Dyne Wrote:  A backdoor doesn't effect their performance and capabilities.
Tell EVLF I said "Hi, no matter how many times you put on a different mask; it won't hide the bad development".

(Nov 18, 2023 05:28 PM)vancy Wrote:  hook rat is a good one , it works very good