Index of /publicDatasets/Android-Mischief-Dataset/AndroidMischiefDataset_v2

	Name	Last modified	Size	Description
	Parent Directory		-
	RAT01_AndroidTester.zip	2021-05-07 15:53	77M
	RAT01_AndroidTester/	2023-04-18 09:26	-
	RAT02_DroidJack.zip	2021-06-27 09:15	56M
	RAT02_DroidJack/	2023-04-18 09:27	-
	RAT03_HawkShaw.zip	2021-05-07 15:53	75M
	RAT03_HawkShaw/	2023-04-18 09:28	-
	RAT04_SpyMAX.zip	2021-05-07 15:53	83M
	RAT04_SpyMAX/	2023-04-18 09:28	-
	RAT05_AndroRAT.zip	2021-05-07 15:53	30M
	RAT05_AndroRAT/	2023-04-18 09:30	-
	RAT06_Saefko.zip	2021-05-07 15:53	47M
	RAT06_Saefko/	2023-04-18 09:31	-
	RAT07_AhMyth.zip	2021-05-07 15:53	38M
	RAT07_AhMyth/	2023-04-18 09:32	-
	RAT08_cli_AndroRAT.zip	2021-05-07 15:53	3.3M
	RAT08_cli_AndroRAT/	2023-04-18 09:32	-
	README.html	2021-06-27 09:16	3.3K
	README.md	2021-06-27 09:16	2.8K

Android Mischief Dataset

• Name: Android Mischief Dataset
• Version: v2
• Publication Date: May 7th, 2021
• Author: Kamila Babayeva, e-mail: kamifai14@gmail.com, twitter: @_kamifai_
• Website: https://www.stratosphereips.org/blog/2020/11/10/android-mischief-rats-dataset

Dataset Description:

The Android Mischief Dataset is a dataset of network traffic from mobile phones infected with Android Remote Access Trojans (RATs). Its goal is to offer the community the dataset to learn and analyze the network behaviour of RATs and propose new detections. Current version of the dataset includes 8 packet captures from 8 executed Android RATs. Android Mischief Dataset was done in the Stratosphere Laboratory, Czech Technical University in Prague.

The password of the zip files is: ‘infected’

RATs executed:

• RAT01 - Android Tester v.6.4.6
• RAT02 - DroidJack v4.4
• RAT03 - HawkShaw
• RAT04 - SpyMAX v2.0
• RAT05 - AndroRAT
• RAT06 - Saefko Attack Systems (SAS)
• RAT07 - AhMyth
• RAT08 - Command-line AndroRAT

Dataset files for each executed RAT:

• README.md - the name of executed RAT, details of the RAT execution environment, details of the pcap (client’s IP and port, server’s IP and port, time of the infection).
• apk - apk generated by the RAT’s builder.
• log - very detailed and specific time log of all the actions performed in the client and the server during the experiment, such as taking a picture.
• pcap - network traffic captured on the victim’s device.
• screenshots - a folder with screenshots of the mobile device and controller while performing the actions on the client and server.
• zeek logs - a folder with Zeek generated log after running Zeek on a pcap.

The phone was using the Emergency VPN (https://www.civilsphereproject.org/emergency-vpn) to capture its traffic. All captures were done in CEST time (GMT+2). Which means that your tools looking at the pcap files may show a different time depending on your time zone. Since the time of capture inside the pcap file is 000000, then if you are in timezone GMT+1, you will see in your tools the packets with 1hs less of when they were captured. The real capture time is in the log file.

Comparison with the first version of Android Mischief Dataset:

Firstly, the second version of Android Mischief Dataset present two more RATs that were not in the first version, namely RAT06_Saefko and RAT08_cli_AndroRAT. Secondly, each RAT packet capture was fixed using the command tcpdump -r <file.pcap> -w <file-fixed.pcap>. This command allows to fix the packets that were cut when terminating a capture. Lastly, each RAT folder contains a new folder with Zeek generated logs after running Zeek on a pcap.

Contacts:

If you have any questions or you want source code of RATs and their requirements, do not hesitate to contact me kamifai14@gmail.com.