Index of /publicDatasets/Android-Mischief-Dataset/AndroidMischiefDataset_v2/RAT01_AndroidTester

	Name	Last modified	Size	Description
	Parent Directory		-
	RAT01_AndroidTester.apk.zip	2023-04-18 09:25	473K
	RAT01_AndroidTester.log	2021-05-07 15:53	13K
	RAT01_AndroidTester.pcap	2021-05-07 15:53	77M
	RAT01_AndroidTester_screenshots/	2021-05-07 15:53	-
	RAT01_AndroidTester_zeek/	2021-05-07 15:53	-
	README.html	2021-05-07 15:53	2.7K
	README.md	2021-05-07 15:53	2.2K
	suricata/	2023-01-16 16:30	-

Details of the execution of the Android Tester v.6.4.6

Author: Kamila Babayeva (kamifai14@gmail.com, @_kamifai_), Student Researcher at the Stratosphere Laboratory. https://www.stratosphereips.org/

RAT downloaded from: https://hackforums.net/showthread.php?tid=6042225

Executed RAT Contoller Environment:

• VirtualBox with Windows 7, host is Linux Ubuntu 20.04

Executed Victim Environment:

• Nokia Phone with Android 10

Phone Status Before The Infection:

• Applications:
  • Gmail, logged in
  • Facebook, logged in
  • Instagram, logged in
  • Whatsapp, logged in
  • Twitter, logged in
  • Skype, logged in
  • Messenger, logged in
• Data:
  • One contact
  • One photo in gallery
  • One video in gallery

RAT APK (RAT01_AndroidTester.apk):

- App Name: Android Tester
- Service Name: Android Tester
- File Name when put in the phone: 8fcc7ce91c1b2b75bf8b1469743e18a5.apk (md5 of apk)

Packet Capture (RAT01_AndroidTester.pcap):

- Controller IP: 147.32.83.234
- Victim IP: 10.8.0.61
- First Packet of the Infection: 26854
- UTC Time of the Infection: 2020-08-07 09:01:59 UTC

The phone was using the EVPN (https://www.civilsphereproject.org/emergency-vpn) to capture its traffic. All captures were done in CEST time (GMT+2). Which means that your tools looking at the pcap files may show a different time depending on your time zone. Since the time of capture inside the pcap file is 000000, then if you are in timezone GMT+1, you will see in your tools the packets with 1hs less of when they were captured. The real capture time is in the log file.

Files with information about this execution:

- Log file RAT01_AndroidTester.log - very detailed and specific time log of all the actions performed in the client and the server during the experiment, such as taking a picture, etc.
- Screenshots folder RAT01_AndroidTester_screenshots - a folder with screenshots of the mobile device and controller while performing the actions on the client and server
- Packet capture RAT01_AndroidTester.pcap - network traffic captured on the victim’s device
- APK RAT01_AndroidTester.apk- APK generated by the RAT’s builder
- Folder RAT01_AndroidTester_zeek - generated Zeek logs of RAT01_AndroidTester.pcap