Welcome
NOTE: This tutorial is for educational purpose only. Thinking about things in theory is fine, but don't use your knowledge to harm others. I am not reliable for any harm that is done with the information I cover in this tutorial.
Table of contents
I. Introduction
II. Requirements and setup
III. Spreading
IV. Final words
I. Introduction:
Most of the people reading this will already know how to successfully spread a RAT like Darkcomet.
You can infect a computer with your trojan and do whatever you like to. But our world is changing rapidly.
Of course, computers will never die. But most of the people got a smartphone aswell. I would call it a "mini-computer".
Infecting smartphones isn't as easy as using Darkcomet, but it's nothing impossible.
We will be using the most popular RAT for Android systems: Androrat
There are some main reasons you should think about, and decide yourself whether an "Smartphone-Slave" is useful or not:
- Get all your slaves contacts and their information
- Get all messages
- Their location
and so on.. a full list can be found here: Spoiler (Click to View)
Note that Androrat (obviously) only works on android systems.
II. Requirements and setup:
There is no need to reinvent the wheel, and this tutorial focuses on spreading your RAT, so I suggest you to check out this thread from Raziel to learn how to set up Androrat.
A safe link to download the latest version of Androrat: HERE
The Android SDK is needed aswell, download it from the official website
Security information:
Quote:Your phone provider stores all the information about you. So I don't advise you to spread your RAT with your own smartphone.
You could use a VPN to spread (upload and share) your RAT using your computer. Another option would be to buy a prepaid sim card from a nearby store.
If you wanna spread with your own number (for whatsapp spreading for example), you will need a good excuse in case your victim finds out that you're spreading a virus.
III. Spreading:
So you set up Androrat and are ready to spread now. Don't worry, it's not that hard to spread your RAT!
There is no big difference between spreading a .exe or an app. You want to get your file downloaded, so make it look worthy.
For doing so, you will need a .apk binder, so you can bind your RAT with a legit application.
You can purchase such a binder on this thread.
Now you need to find an app that people would like to have. If you want to infect a specific target, you'll probably already know what apps he could like.
If you are unsure, just head over to the google play store and check the top 10 paid apps.
Or simply rename your RAT to something like "Clash_of_clans_gemgen.apk". In this case you don't even have to bind your RAT to a real app (since there is no legit one).
You can find any app from the app store on the internet. Just google for it.
I can't link you to such a site or tell you how it's done.
You won't need a crypter for Androrat. Most people don't have an AV program on their smartphone.
If they do, you can just tell them that the alert is normal since it's from another "source" - or just be creative.
I will now give you some ideas on how to spread your RAT (binded with a legit app):
Torrents:
You can upload your RAT to a torrent. There are alot of different sites you could upload your RAT to, so I don't think you'll have any troubles finding some.
However, alot of sites will automatically detect the virus. This is a good way to mass spreading.
Social Networks:
Set up a legit looking facebook account or try spreading with your real one. You can set up your own page about the application you're spreading.
Buy or work for some fake views to make your page look more legit. If you're good with SE, you can try convincing your "friends" or targets to download the app.
Youtube:
The best working strategy for youtube is to advertise an app like "Clash_of_clans_gemgen.apk" since alot of teens are looking for game hacks.
Just follow the tutorials about youtube spreading.. shouldn't be hard to find.
Now you're probably noticing that you can use the most spreading methods for .apk files aswell.
This is true, but there is one, in my opinion the best, method that won't really work when spreading .exe files.
WhatsApp:
This is by far the best method if you want to infect a friend of yours. You can tell them anything you like to make them download your app. Some ideas would be:
- "I wrote this app myself, could you check it out? :)"
- In case your friend loves a game. "Heyy since you always play that game, see that I found gamehack*"
- In case your friend is looking for some special app. "Hey just found something for you"
- In case it's your girlfriend. "Heyy check this out <3 *cute app, whatever
- "Hey this app isn't working for me :( Can you try if it's working for you?"
- "Have you heard about that app from the news? O.o"
- "Hahaha see what I've found.. imagine the fun :P screamer app, whatever
There are way more things you can tell your victim, the only thing you need is trust.
Make your victim trust you and they will download everything from you.
If you didn't read the part about security just before chapter III of this tutorial, do it now.
Spreading with your own phone number is dangerous, and sadly this is necessary if you want to spread with whatsapp.
Unless you got a good excuse in case someone asks you why you are sending him a virus, you should consider doing the following:
Set up Bluestacks!
This is a way to use apps on your computer. Set up Whatsapp.
Now you can spread through your Whatsapp account while beeing hidden behind a VPN.
There are VPN's for Android aswell, but using one from your computer would make it easier in my opinion.
If you're doing it right, you can rely on plausible deniability.
Make up your own story. For example: Your phone got stolen and you got it back, but you didn't notice this stuff happening on your phone.
You're most secure if you use a fake number (no number that is connected to your real information) and spread through a VPN.
There are alot of stories you could tell the police or anyone asking for it.
But in fact this is going way too far since I highly doubt any of you will need plausible deniability.
IV. Final words:
Thanks for reading my tutorial!
I hope someone learned something new while reading it. If you got any questions, feel free to PM me or post on the thread.
If you found any bigger mistakes, let me know.
You may want to check out my other tutorials and lists aswell:
Spoiler (Click to View)
Have a nice day everyone 🤝
