MALWARE FAMILY

AndroRAT

Internal ID: apk.androrat

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Androrat is a remote administration tool developed in Java Android for the client side and in Java/Swing for the Server. The name Androrat is a mix of Android and RAT (Remote Access Tool). It has been developed in a team of 4 for a university project. The goal of the application is to give the control of the android system remotely and retrieve informations from it.

Threat Analysis

AndroRAT is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html

→https://blog.trendmicro.com/trendlabs-security-intelligence/the-urpage-connection-to-bahamut-confucius-and-patchwork/

→https://cocomelonc.github.io/book/2025/05/19/aiya-mmd-book.html

→https://github.com/DesignativeDave/androrat

→https://hotforsecurity.bitdefender.com/blog/possibly-italy-born-android-rat-reported-in-china-find-bitdefender-researchers-16264.html

→https://mp.weixin.qq.com/s/AhxP5HmROtMsFBiUxj0cFg

→https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf

→https://www.kaspersky.com/blog/mobile-malware-part-4/24290/

→https://www.stratosphereips.org/blog/2020/11/10/android-mischief-rats-dataset

→https://www.stratosphereips.org/blog/2021/3/29/dissecting-a-rat-analysis-of-the-androrat

Quick Facts

TypeMalware Family

Aliases1

Also Known As

apk.androrat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search AndroRAT