RadzaRat New Android Trojan Disguised as File Manager Emerge...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.certosoftware.com/insights/radzarat-new-android-trojan-disguised-as-file-manager-emerges-with-zero-detection-rate/
• Blog Title: RadzaRat: New Android Trojan Disguised as File Manager Emerges with Zero Detection Rate
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new subsections such as "Accessibility Service Abuse for Keylogging and UI Monitoring", "Android Persistence via Boot Receivers, Foreground Services & Battery Optimization Bypass", and a short note under C2/exfiltration patterns about "Low-Cost C2 via Telegram Bot API + Free Hosting" and "Chunked Large-Volume Storage Exfiltration").

🎯 Content Summary

This blog post presents a technical analysis of RadzaRat, a new Android Remote Access Trojan (RAT) offered as malware-as-a-service (MaaS). RadzaRat is shipped as a fake file manager app and, at the time of analysis, showed a 0/66 detection rate on VirusTotal for the sample with hash 911c27786b58ddbd14dd79279b0855d1098149144148b00ca37b186a016bbfba. The APK is publicly distributed via a GitHub repository (compiled APK directly downloadable) and the operation is advert...

🔧 Technical Details

Abusing Android Accessibility Services for Keylogging and Global UI Monitoring
RadzaRat demonstrates how an Android app can turn the Accessibility framework into a device-wide keylogger. By declaring a custom service (e.g., MyAccessibilityService) in the manifest and requesting BIND_ACCESSIBILITY_SERVICE, the app can, once enabled by the user, receive accessibility events for other apps. These events include text input and UI changes, allowing the malware to capture credentials, financial data, and private messages without root. This technique can be reused by any attacker who can social-engineer users into enabling their accessibility service.

Building a Low-Cost C2 Using Telegram Bot API Plus Free Cloud Hosting
The blog outlines a generic C2 pattern where a minimal backend is deployed on a free cloud platform (e.g., Render.com) and connected to a Telegram bot. The backend exposes HTTP endpoints like /upload ...

🤖 Agent Actions

Summary:

• Added a new “Android Malware Tradecraft” section to the Android Applications Pentesting page, detailing how RATs weaponize Accessibility Services for keylogging/UI awareness, persist via boot receivers + foreground services + battery optimization bypasses, and operate low-cost Telegram-based C2 with chunked storage exfiltration.
• Included Kotlin/Python snippets illustrating keylogging listeners, boot-time service relaunch, Doze bypass requests, and chunked upload logic for practical replication/detection cues.
• Extended the References list with the RadzaRat technical analysis source.

Tests: Not run (not applicable).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.certosoftware.com/insights/radzarat-new-android-trojan-disguised-as-file-manager-emerges-with-zero-detection-rate/

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new subsections such as "Accessibility Service Abuse for Keylogging and UI Monitoring", "Android Persistence via Boot Receivers, Foreground Services & Battery Optimization Bypass", and a short note under C2/exfiltration patterns about "Low-Cost C2 via Telegram Bot API + Free Hosting" and "Chunked Large-Volume Storage Exfiltration").".

Repository Maintenance:

• MD Files Formatting: 913 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0