Rafel RAT: A Pest Invading Droid Systems

Mobile security is facing a major challenge in the form of Android malware. Picture a smartphone, an essential part of daily life, becoming a tool for cybercriminals. Attackers are drawn to Android systems for several reasons: a massive user base, extensive customization options, and flaws in Android’s update and security processes. With such high stakes impacting user and system data, understanding these threats is crucial to staying protected. Attackers are irresistibly drawn to Android due to its vast user base. With over three billion users globally, Android offers a lucrative opportunity for large-scale cyberattacks. This far exceeds the iOS user base, which stands at just over one billion. The sheer volume of potential targets makes Android an attractive playground for cybercriminals, eager to exploit its reach for their malicious endeavors.

While Android offers more customization options than iOS, this can be a double-edged sword. Unintentional security gaps, such as unchecked features or or inactive verification mechanisms, can significantly increase risks. For example, allowing applications to run from unverified sources or having permissions granted automatically without user input would increase a user’s likelihood of malware exposure.

Unlike iOS, Android systems experience inconsistent updates and security fixes due to manufacturer-specific issues like delayed or fragmented patch cycles. These inconsistencies can leavevulnerabilities unaddressed across various Android devices. Consequently, the Android OS has seen a spike in targeted attacks, including those launched with the aid of remote access trojans (RATs) like Rafel RAT.

Rafel RAT: A Stealthy Threat to Android Devices

Rafel RAT is an Android malware with an open-source design and the ability to camouflage its application type, often masking as a common BlackMart application. BlackMart, also known as BlackMart Alpha, is an application marketplace where users can download Android applications; the applications available are typically pirated, free versions of the commercial offerings found on the Google Play Store that are embedded with malwareAn active GitHub repository has the source code and elements needed to build Rafel RAT and launch an attack.

 

Rafel RAT targets out-of-date Android operating systems, specifically mobile phones and tablets, making it a convenient and powerful tool for a bad actor’s campaign. Check Point Software uncovered that common targets are devices with Android versions 11, 5, and 8. While this means that devices older than Android 11 are the most vulnerable to a Rafel RAT infection, devices with newer OS versions may be susceptible to this attack. User failure to push software/firmware updates or delays in rolling out security fixes are two causes that could result in a newer device becoming vulnerable.

Malware-as-a-Service (MAAS) is a subscription model that allows criminal organizations to purchase malware from various markets and use it to benefit their operations. While Rafel RAT does not fall into the MAAS model due to its open-source nature, that may change in time as its design and usage evolves.

The Infection

The graphic below illustrates the steps involved to get Rafel RAT onto a victim’s system. A phishing campaign is one method to initiate the first step in the process of downloading Rafel RAT to a target device. Once a user clicks a malicious object or link in an email, the download occurs, and an installation process follows. It is worth noting that an Android device does not need to be rooted for the download and installation process to occur.

Figure 1: The initial infection

Once Rafel RAT finishes installing, it activates a process to request permissions; a prompt may appear for the user to accept permission to enable notifications and allow access to several settings and applications. After the user hits allow on the prompts to grant permissions, the attacker has elevated permissions to access the following Android services: System and Storage, Camera and Microphone, Contacts, Calls, and Messages.

Equipped with access to these services, the bad actor can steal device, caller, and account information such as credentials and take control of the device, including the ability to lock it and set a new PIN. It is important to note that while the Rafel RAT attack may disrupt the user’s ability to start and stop applications or processes and can lead to data loss due to an attacker’s targeted deletion of files, the total loss of device functionality is not an outcome that is associated with this attack.

After step three in the process, the attacker has two options. They can either proceed with 4A: Deploy Ransomware, or the more common choice, 4B: Establish an addition route alongside the C2 server to continue exfiltrating data and intercepting authentication codes.

Basic Capabilities

When looking at the design of malware, the ideal Android malware will operate in a fashion like other malware types; Rafel RAT gains access to a target system, alters the system’s settings, establishes a connection with the attacker network, and exfiltrates the data and other assets that it collects in the process.

Advanced Capabilities

The table below defines Rafel RAT’s greater capabilities which distinguishes it from other common Android trojans.

	Ransomware panel. This panel allows the attacker to introduce a malicious payload (ransomware) and encrypt device data.
	Message interception functionality: Rafel RAT can intercept SMS messages, including 2FA codes. It typically captures 2FA codes from the target device and passes them on through a Discord message. While Rafel RAT can obtain data from user text messages, Authenticator Apps are not a common attack vector.
	Hidden and background processes: Rafel RAT can run hidden processes in the background to load other malicious objects on a victim device.
	Surveillance: Since Rafel RAT can take control of a phone, and exploit permissions to log phone keystrokes and capture photos and video.

Figure 2: Additional functions

Ransomware Functionality

It is important to note that while Rafel RAT’s ransomware panel incorporates the ability to launch a ransomware attack, Rafel RAT itself is only a vehicle to deliver that weapon. Rafel RAT is malware that is primarily designed to spy on victims and steal data and communications. The graphic below expands on the chain of actions that occur after the phishing campaign.

Anti-Analysis Capabilities

Rafel RAT does not employ packing or obfuscation techniques to conceal its malicious attributes. However, Rafel RAT has emulation detection properties, which will prompt it to disrupt or stop malicious processes in instances where an analysis or testing environment is detected. As a result, researchers must exercise due diligence when selecting methods to analyze Rafel RAT samples and bypass emulation detection.

Figure 3: Rafel RAT attack structure.

Conclusion and Recommendations

Rafel RAT poses a great threat to Android users, especially those who have devices using Android versions older than 11. Victims of cyber espionage and data theft are commonplace in the current threat landscape. As a result, users must exercise caution when accessing unknown or suspicious links and applications. They should stay informed to identify the signs of a malware infection and understand best practices to maintain good cyber hygiene.

Users concerned that their Android device is infected may monitor their device for the following changes:

• Sudden Restrictions (impacting the use of the phone, apps, or change of permissions)
• Inconsistent Battery Life
• Unprompted Screen Locks
• Slowing of Device Performance
• New Applications and Services
• Missing Files or Directories

An organization that implements best practices can reduce the risk of falling victim to a Rafel RAT attack. These practices include incorporating threat intelligence, patch management, and mobile device security processes into a mature information security program.

Advanced Threat Intelligence: The right threat intelligence solutions can provide critical insights about attacks. Bitdefender IntelliZone is an easy-to-use solution that consolidates all the knowledge we've gathered regarding cyber threats and the associated threat actors into a single pane of glass for the security analysts, including access to Bitdefender’s next-generation malware analysis service. If you already have an IntelliZone account, you can find additional structured information under Threat IDs BD8svvodp8, BDuq18888y, BDgo7ejvh8, BDqnetx899, BDsd3agxn3, BDgl4j8m5n, and BDdvnaspz1.

Mobile Device Management: Organizations who use a MDM solution to enforce system and application security requirements can minimize the risk of a vulnerable device being exploited.

Mobile Threat Defense: MTD or Mobile Threat Defense adds another type of protection for a mobile ecosystem on top of MDM. Unlike MDM, the purpose of Mobile Threat Defense is to protect mobile devices from cyber threats and attacks thereby safeguarding sensitive data and maintaining user privacy. It is the only solution responsible for eliminating cyber threats.

For more information about Bitdefender Mobile Security and solutions available to protect your devices and data, please refer to the links below:

• Bitdefender GravityZone Security for Mobile official site: GravityZone Security for Mobile
• Bitdefender GravityZone Security for Mobile Solution Brief: GravityZone Security for Mobile Solution Brief
• Bitdefender GravityZone Security for Mobile Datasheet: GravityZone Security for Mobile Datasheet

Indicators of Compromise

Domains
bazfinc.xyz
casperbc.com
districtjudiciarycharsadda.gov.pk
raas.site
uni2phish.ru
zetalinks.tech

 

MD5
21c2de1ee0ea905c3c9ed6ab1bb09ced
4a40410e3ed082aa20d4eaa508ed451d
4e604e03cba3ad8da5f1ebbd7ba100bb
578ab3fb6d1b6313f106518128053931
94bca3926cd70f60d54be7218dd7ac55
d92eecc462e59f3e2061a6a568935b96

 

SHA1
14596ae969626eecdb7aa5d73a1b89dd0fbc53f8
3229106dee092e03d7344e398e57e47961e1df8c
3b6fceace06f575f4ce1791a7f6c35e35b1ee703
9b9ac365f701904533d21465f4e55a38e2f093c4
ace5a4e3ab9a2d25ce475ef88ddc1d3a27cacb9e
b0a58d44603f9b184cf26bf5b265644f9843faef

 

SHA56
344d577a622f6f11c7e1213a3bd667a3aef638440191e8567214d39479e80821
442fbbb66efd3c21ba1c333ce8be02bb7ad057528c72bf1eb1e07903482211a9
5148ac15283b303357107ab4f4f17caf00d96291154ade7809202f9ab8746d0b
9b718877da8630ba63083b3374896f67eccdb61f85e7d5671b83156ab182e4de
c94416790693fb364f204f6645eac8a5483011ac73dba0d6285138014fa29a63
d1f2ed3e379cde7375a001f967ce145a5bba23ca668685ac96907ba8a0d29320