PHC-MyHero
Honorary Poster
- Joined
- May 18, 2019
- Posts
- 405
- Reaction
- 760
- Points
- 253
RAT or Remote Administrator Trojan ay isang malware na nagbibigay sayo ng complete control sa isang device, katulad na lang ng Android Phones.
Navigate to the You do not have permission to view the full content of this post. Log in or register now. and download the release for your system. Currently, they only have Linux and Windows files uploaded.
Once you download the right file, open it up on your computer, and You do not have permission to view the full content of this post. Log in or register now.. It will automatically open when it completes. After that, we should be ready to go!
For testing purposes, I'll just be using my local Wi-Fi network. However, if you wanted it to work outside of the local network, you would need to port-forward your computer to the internet and use your public IP address.
AhMyth can build an APK two different ways. It can create a standalone APK or be used to infect another application in order to remain hidden on the target device. To do the latter, select the box beside "Bind With Another Apk" and then browse and select the APK you wish to use. Today I'll just be creating the default standalone APK, but if a malicious user were deploying this in the real, they would very likely be binding it with another APK.
Once you have all the settings selected you're ready to build the APK, just click on "Build."
You can navigate to to "C:\Users\UserName\AhMyth\Output" to find the built APK.
By far the most effective method is if you have physical access to the phone, it only takes a few seconds to download and hide it. If you chose this method, then an easy way to do it is by saving the APK to Google Drive and sending the phone a link. On most phones, the download should only take a second or two.
If the Android phone doesn't want to install it, they probably never You do not have permission to view the full content of this post. Log in or register now. in their settings. Open up the Settings, then go to "Security" and check "Unknown sources." This is how apps that come from outside the Google Play Store can be installed.
Tip: If naka deploy kana ng RAT sa phone ng target, pwede mo ma häçk ang facebook, google, etc. through SMS password recoveries by using the SMS feature ni AhMyth.
(If using Binaries)Also, don't forget to download and install Java from You do not have permission to view the full content of this post. Log in or register now. para gumana ang AhMyth mo.
Credits to: You do not have permission to view the full content of this post. Log in or register now. for the great tutorial.
Download & Install AhMyth
There are two ways to download and install AhMyth. The first is to directly use the source code from GitHub. The second is to use the binaries they provide.Method 1 From Source Code
If you chose to start with the source code, then you'll need to check that you have a few prerequisites installed.- Java — it's used to generate the APK backdoor. - You do not have permission to view the full content of this post. Log in or register now.
- You do not have permission to view the full content of this post. Log in or register now. — it's used to start the desktop application.
- You do not have permission to view the full content of this post. Log in or register now. and You do not have permission to view the full content of this post. Log in or register now. — they are used to build the binaries for macOS, Windows, and Linux.
Then move to the AhMyth-Android-Rat directory with the following.
Once you're in, start AhMyth with the command below.
This program is still in beta development, and as such, it isn't as robust as it could be. Some users have gotten errors when attempting to start it. If you do, try again running it as root, as seen below.
You'll know it's working when you see the GUI launch.
Method 2 From Binaries
The source code is one way to download it, but if you're lazy like me, there's a slightly easier way — use the binaries! It's particularly nice when you're working on a Windows computer and don't want to mess around with the command line. This shouldn't be a concern as most people will already have it, but do check that Java is updated on your computer.Navigate to the You do not have permission to view the full content of this post. Log in or register now. and download the release for your system. Currently, they only have Linux and Windows files uploaded.
Once you download the right file, open it up on your computer, and You do not have permission to view the full content of this post. Log in or register now.. It will automatically open when it completes. After that, we should be ready to go!
Step 2 Build an APK
Now that we have the program up and running, it's time to build an Android application with a backdoor. At the top of the screen, select "APK Builder." The first thing to change is "Source IP." This needs to be the IP address of the computer you'll be sending and receiving commands from.For testing purposes, I'll just be using my local Wi-Fi network. However, if you wanted it to work outside of the local network, you would need to port-forward your computer to the internet and use your public IP address.
AhMyth can build an APK two different ways. It can create a standalone APK or be used to infect another application in order to remain hidden on the target device. To do the latter, select the box beside "Bind With Another Apk" and then browse and select the APK you wish to use. Today I'll just be creating the default standalone APK, but if a malicious user were deploying this in the real, they would very likely be binding it with another APK.
Once you have all the settings selected you're ready to build the APK, just click on "Build."
You can navigate to to "C:\Users\UserName\AhMyth\Output" to find the built APK.
Step 3 Deploy the RAT
Now that you have a working APK, it's time to deploy it by downloading it on the target Android device. All of the standard attack methods apply — anything to get the user to download the APK. You do not have permission to view the full content of this post. Log in or register now. tends to work best. For example, if you know the person, then recommend an app to them and infect it.By far the most effective method is if you have physical access to the phone, it only takes a few seconds to download and hide it. If you chose this method, then an easy way to do it is by saving the APK to Google Drive and sending the phone a link. On most phones, the download should only take a second or two.
If the Android phone doesn't want to install it, they probably never You do not have permission to view the full content of this post. Log in or register now. in their settings. Open up the Settings, then go to "Security" and check "Unknown sources." This is how apps that come from outside the Google Play Store can be installed.
Tip: If naka deploy kana ng RAT sa phone ng target, pwede mo ma häçk ang facebook, google, etc. through SMS password recoveries by using the SMS feature ni AhMyth.
(If using Binaries)Also, don't forget to download and install Java from You do not have permission to view the full content of this post. Log in or register now. para gumana ang AhMyth mo.
Credits to: You do not have permission to view the full content of this post. Log in or register now. for the great tutorial.