ArcticRAT Android Malware: AI-Powered Financial Profiling — Detection and Mobile Defense Guide

---
title: ArcticRAT Android Malware - Accessibility Service Abuse for Persistence
id: 3f8a1c42-7b2d-4e9a-b5f1-9c3d7e2a8f01
status: experimental
description: Detects Android applications requesting or abusing Accessibility Service permissions, a hallmark of ArcticRAT and similar Android RATs. Monitors mobile device management (MDM) logs and Android enterprise event logs ingested into SIEM.
references:
  - https://attack.mitre.org/techniques/T1636/
  - https://attack.mitre.org/techniques/T1574/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1636
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: 'accessibility_service_enabled'
    AppPackageName|contains:
      - 'com.android.'
      - 'com.google.'
  filter_system_apps:
    AppPackageName|startswith:
      - 'com.android.settings'
      - 'com.google.android.accessibility'
  condition: selection and not filter_system_apps
falsepositives:
  - Legitimate accessibility apps (password managers, screen readers)
  - Enterprise apps with documented accessibility requirements
level: medium
---
title: ArcticRAT C2 Communication - WebSocket or HTTPS Beaconing from Android Device
id: 6e2d4b81-1a3f-4c7d-9e5b-2f8a6c1d4e03
status: experimental
description: Detects periodic outbound connections from Android devices to non-standard destinations via WebSocket or HTTPS, consistent with ArcticRAT C2 beaconing behavior. Designed for network-level detection via proxy, firewall, or MDM telemetry.
references:
  - https://attack.mitre.org/techniques/T1572/
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1572
  - attack.t1071.001
logsource:
  category: network_connection
  product: android
detection:
  selection_websocket:
    Protocol: 'websocket'
    DeviceType: 'android'
  selection_https_beacon:
    Protocol: 'https'
    DeviceType: 'android'
    DestinationPort:
      - 8443
      - 4443
      - 9443
      - 8080
  condition: selection_websocket or selection_https_beacon
falsepositives:
  - Legitimate apps using WebSocket for real-time features
  - Development and testing applications
level: medium
---
title: ArcticRAT Financial Data Exfiltration - SMS and Contact Data Access by Non-System App
id: 9c1e5f37-4d8b-4a6c-b2e7-5d3f8a1c9e04
status: experimental
description: Detects non-system Android applications accessing SMS databases or contact lists in bulk, consistent with ArcticRAT's data harvesting behavior for AI-powered financial profiling.
references:
  - https://attack.mitre.org/techniques/T1636.003/
  - https://attack.mitre.org/techniques/T1533/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1533
  - attack.exfiltration
logsource:
  category: application
  product: android
detection:
  selection_sms:
    PermissionUsed:
      - 'android.permission.READ_SMS'
      - 'android.permission.RECEIVE_SMS'
    AppCategory|notcontains:
      - 'messaging'
      - 'system'
  selection_contacts_bulk:
    PermissionUsed: 'android.permission.READ_CONTACTS'
    AccessCount: '>50'
    TimeWindow: '60s'
  condition: selection_sms or selection_contacts_bulk
falsepositives:
  - Backup applications
  - CRM applications with legitimate contact sync
level: high

// Hunt for Android devices exhibiting ArcticRAT-like C2 beaconing behavior
// Requires: CommonSecurityLog (proxy/firewall), DeviceNetworkEvents (if Defender for Endpoint on Android), or Syslog ingestion

// Part 1: Identify Android devices making periodic connections to rare external destinations
let TimeWindow = 1h;
let MinBeaconCount = 10;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "Android" or SourceUserAgent has "Android" or AdditionalExtensions has "android"
| summarize ConnectionCount = count(), DistinctPorts = dcount(DestinationPort), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort, DestinationHostName
| where ConnectionCount >= MinBeaconCount
| extend BeaconIntervalSeconds = datetime_diff("second", LastSeen, FirstSeen) / ConnectionCount
| where BeaconIntervalSeconds between (30 .. 600)  // Regular intervals between 30s and 10min
| project SourceIP, DestinationIP, DestinationPort, DestinationHostName, ConnectionCount, BeaconIntervalSeconds
| sort by ConnectionCount desc;

// Part 2: Hunt for Android devices accessing SMS or contact-related API endpoints at high volume
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where DeviceName has_any ("android", "pixel", "samsung", "oneplus")
| where ProcessCommandLine has_any (
    "content://sms",
    "content://contacts",
    "Telephony.Sms",
    "ContactsContract"
)
| summarize AccessCount = count(), UniqueCommands = dcount(ProcessCommandLine)
    by DeviceName, AccountName, InitiatingProcessFileName
| where AccessCount > 50
| sort by AccessCount desc;

-- Hunt for suspicious APK installations and Accessibility Service abuse on Android devices
-- Requires: Android device forensics via Velociraptor or equivalent agent

-- Part 1: List recently installed APKs outside of official stores
SELECT
    FileName,
    FullPath,
    Size,
    Mtime AS InstallTime,
    hash(path=FullPath) AS FileHash
FROM glob(globs='/data/app/*/base.apk')
WHERE Mtime > (now() - 86400 * 7)  -- Last 7 days
ORDER BY InstallTime DESC;

-- Part 2: Identify apps with Accessibility Service permissions granted
SELECT
    pslist().Pid,
    pslist().Name,
    pslist().Exe,
    pslist().CommandLine
FROM pslist()
WHERE CommandLine =~ 'accessibility'
   OR Exe =~ 'AccessibilityService';

-- Part 3: Check for processes with active network connections to suspicious ports
SELECT
    netstat().Pid,
    netstat().ProcessName,
    netstat().RemoteAddress,
    netstat().RemotePort,
    netstat().State,
    netstat().Protocol
FROM netstat()
WHERE RemotePort IN (8443, 4443, 9443, 8080, 6667, 5555)
   AND State = 'ESTABLISHED'
ORDER BY RemotePort;

#!/bin/bash
# ArcticRAT Detection and Hardening Script for Android Devices (via ADB)
# Run this on each managed Android device connected via ADB
# Requires: ADB enabled and authorized on target device

echo "[+] ArcticRAT Mobile Threat Detection and Hardening Script"
echo "[+] $(date)"
echo ""

# === SECTION 1: Detection ===

echo "[*] Checking for apps with Accessibility Service permissions..."
adb shell settings get secure enabled_accessibility_services | tr ':' '\n' | while read -r service; do
    if [ -n "$service" ]; then
        echo "  [!] Accessibility service enabled: $service"
    fi
done

echo ""
echo "[*] Checking for apps with Device Administrator privileges..."
adb shell dumpsys device_policy | grep -A 5 "Active admin" || echo "  [-] No active device admins found"

echo ""
echo "[*] Checking for recently installed non-store APKs..."
adb shell pm list packages -3 | while read -r pkg; do
    pkg_name=$(echo "$pkg" | cut -d: -f2)
    installer=$(adb shell pm get-installer "$pkg_name" 2>/dev/null)
    install_path=$(adb shell pm path "$pkg_name" 2>/dev/null | head -1)
    echo "  [?] Package: $pkg_name | Installer: $installer | Path: $install_path"
done

echo ""
echo "[*] Checking for apps with SMS permissions..."
adb shell pm list packages -3 | while read -r pkg; do
    pkg_name=$(echo "$pkg" | cut -d: -f2)
    sms_perm=$(adb shell dumpsys package "$pkg_name" 2>/dev/null | grep "android.permission.READ_SMS: granted=true")
    if [ -n "$sms_perm" ]; then
        echo "  [!] ALERT: $pkg_name has READ_SMS permission granted"
    fi
done

echo ""
echo "[*] Checking for active network connections on suspicious ports..."
adb shell netstat -an 2>/dev/null | grep -E '(4443|8443|9443|8080|5555|6667).*ESTABLISHED' || echo "  [-] No connections on suspicious ports"

echo ""
echo "[*] Checking for overlay-capable apps (potential screen overlay attacks)..."
adb shell pm list packages -3 | while read -r pkg; do
    pkg_name=$(echo "$pkg" | cut -d: -f2)
    overlay_perm=$(adb shell dumpsys package "$pkg_name" 2>/dev/null | grep "SYSTEM_ALERT_WINDOW: granted=true")
    if [ -n "$overlay_perm" ]; then
        echo "  [!] ALERT: $pkg_name has SYSTEM_ALERT_WINDOW (overlay) permission"
    fi
done

# === SECTION 2: Hardening ===

echo ""
echo "[*] Applying hardening recommendations..."

echo "  [*] Verify Google Play Protect is enabled:"
adb shell settings get global package_verifier_enable
echo "  [*] Verify unknown sources installation is blocked:"
adb shell settings get secure install_non_market_apps
echo "  [*] Check if device is running latest security patch:"
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release

echo ""
echo "[+] Scan complete. Review any [ALERT] or [!] findings above."
echo "[+] For remediation: revoke unnecessary permissions, uninstall suspicious APKs, and factory reset if compromise is confirmed."