Analysis of an Android Remote Access Trojan (RAT)
To thoroughly analyze an Android remote-access-trojan threat, analysts drove AVL Code with a single natural-language instruction, closing the loop from malicious sample to a complete analysis report.
Built with AVL Code + the Landi model
Overview
Facing a 4.9MB Android APK heavily obfuscated by a commercial packer (overall entropy 7.72), analysts drove AVL Code with one natural-language instruction. With the sample sandbox read-only and unpacking blocked, they reached a verdict from entropy and string/IOC static analysis alone: a banking trojan / RAT targeting users of five major brands — Huawei, Xiaomi, OPPO, vivo and Samsung — reconstructing five core malicious behaviors (accessibility-service abuse, lock-screen password theft, screen monitoring and recording, covert camera capture, and floating-window phishing overlays), and producing a report with a complete IOC list, YARA detection rules and remediation advice — classified as Critical.
Key results
- Completed an in-depth static verdict on the commercially packed 4.9MB APK (overall entropy 7.72), identifying 5 core malicious capabilities (accessibility-service abuse, lock-screen password theft, screen monitoring/recording, covert camera capture, floating-window phishing overlays)
- Extracted a complete IOC list — 3 file hashes, a dozen-plus suspicious Activity/layout components, 13 brand-impersonation image resources — and generated deployment-ready YARA detection rules
- Identified its UI-impersonation capability against five phone brands (Huawei, Xiaomi, OPPO, vivo, Samsung), classifying it as a Critical-severity threat
- Reached the verdict from entropy and string/IOC static analysis alone under a read-only, unpack-blocked sandbox, and gave unpacking-and-deep-reversing plus remediation guidance
Technical highlights
Practical value
Helps security operations rapidly identify and respond to Android remote-control-trojan threats, provides end-to-end guidance from detection to protection, strengthens detection and handling of mobile malware, and effectively protects mobile users’ privacy and financial safety.
Artifacts
Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model