Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareUsed by 1 actor

DroidJack

DroidJack is an Android remote access trojan (RAT), also known as SandroRAT, that can provide an attacker with near-complete control of an infected phone. Reported capabilities include capturing SMS data, capturing call data, browsing files, stealing contacts, tracking device location, activating the camera and microphone remotely, and capturing video using device cameras. The malware has been observed embedded in trojanized Android APKs, including a malicious Pokemon GO APK uploaded in July 2016 and an Android APK masquerading as an Adobe Flash Player update used in a campaign targeting Syrian opposition members. In the Pokemon GO case documented by Proofpoint, the infected APK preserved the legitimate app’s startup screen, added malicious classes, and was configured to communicate with the command-and-control domain pokemon.no-ip.org over TCP and UDP port 1337; at the time of analysis, that domain resolved to 88.233.178.130 in Turkey. Proofpoint identified the malicious APK with SHA256 15db22fd7d961f4d4bd96052024d353b3ff4bd135835d2644d94d74c925af3c4 and MD5 d350cc8222792097317608ea95b283a8. DroidJack was also identified in the Group5 operation targeting Syrian opposition figures, where it was delivered via the watering-hole site assadcrimes[.]info as adobe_flash_player.apk (MD5 8EBEB3F91CDA8E985A9C61BEB8CDDE9D) and configured to use command-and-control host 88.198.222[.]163. The Group5 reporting assessed, with moderate confidence, an Iranian nexus for that broader campaign.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Group5

"The APK is an instance of DroidJack. According to Symantec, this malware evolved from an older codebase known as SandroRAT."

via citizenlabcitizenlab.ca
MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1189Drive-by CompromiseEvidence1

"we uncovered a watering hole website with malicious programs, malicious PowerPoint files, and Android malware" ... "Group5 operated a website, assadcrimes[.]info that served as a watering hole for Android and Windows malware"

Persistence

1 technique
T1547Boot or Logon Autostart ExecutionEvidence1

"Boot Completed Allows the application to re-connect when the device restarts"; "starts the Controller Service when the phone boots"

Privilege Escalation

1 technique
T1547Boot or Logon Autostart ExecutionEvidence1

"Boot Completed Allows the application to re-connect when the device restarts"; "starts the Controller Service when the phone boots"

Stealth

2 techniques
T1036MasqueradingEvidence1

"decoy application... displays images... while simultaneously infecting"; "malware masquerading as an Adobe Flash Player update notification"; "drops a file named dvm.gif to disk, renames it to dvm.exe"

T1564Hide ArtifactsEvidence1

"Upon execution, the malware is installed and then hidden from the list of installed applications... Application icon will be removed... yet it will still be running in the background"

Collection

2 techniques
T1123Audio CaptureEvidence1

"spy on the computer user via the microphone"; "Remote camera and microphone"; "record calls"

T1125Video CaptureEvidence1

"spy on the computer user via the ... webcam"; "allow the operator to use the infected device’s camera to take pictures and record video"

Command and Control

2 techniques
T1219Remote Access ToolsEvidence2

The malicious remote access tool (RAT) called DroidJack (also known as SandroRAT) ... would virtually give an attacker full control over a victim’s phone.

T1568.001Fast Flux DNSEvidence1

No-ip.org is a service used to associate a domain name with a dynamic IP address... but is also used frequently by threat actors, along with other similar services like DynDNS.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.md5●●●●●●●●●●●●View more in app5 months ago
ip.v4●●●●●●●●●●●●View more in app5 months ago
domain●●●●●●●●●●●●View more in app5 months ago
domain●●●●●●●●●●●●View more in app10 years ago
hash.md5●●●●●●●●●●●●View more in app10 years ago
hash.sha256●●●●●●●●●●●●View more in app10 years ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.