Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareUsed by 3 actors

CapraRAT

CapraRAT is an Android remote access trojan/backdoor used in espionage campaigns attributed to Transparent Tribe, also tracked as APT36, COPPER FIELDSTONE, Operation C-Major, and related aliases. Reporting in the provided content links it to suspected Pakistan state-aligned operations primarily targeting Indian and Pakistani users, especially individuals of military, political, diplomatic, government, education, activist, and other strategic interest. The malware has also been described as based on the open-source AndroRAT framework.

CapraRAT is typically delivered through trojanized Android APKs distributed outside Google Play via attacker-controlled websites and social engineering, including spear-phishing and romance or honey-trap lures. Documented disguises include secure messaging and calling apps such as MeetsApp and MeetUp; YouTube-themed apps; a lure using the persona "Piya Sharma"; and themed apps targeting mobile gamers, weapons enthusiasts, TikTok users, and viewers of adult content, including Crazy Game, Weapons, TikTok, and Sexy Videos. Some samples preserved benign-looking functionality by embedding WebView content such as YouTube or CrazyGames while covertly enabling spyware behavior.

Capabilities directly described in the content include collection or exfiltration of SMS messages, MMS, contacts, call logs, recorded calls, ambient audio, screenshots, photos, files, file listings, notification text, running apps, and device location. CapraRAT can access the microphone and camera, including front and rear cameras, record audio and video, take screenshots, browse, download, delete, and modify files, list contacts, collect call logs, receive SMS, send SMS, block or intercept incoming SMS, initiate phone calls, launch or kill apps/processes, and in some reporting stream audio. It has also been described as able to override GPS and network settings and request installation of updates. Persistence and execution details mentioned in the content include use of the open-source Autostarter project and recurring alarms for periodic execution.

The content associates CapraRAT with multiple campaigns and infrastructure clusters. ESET-linked reporting tied MeetsApp and MeetUp samples to C2 66.235.175[.]91:4098 and domains including meetsapp[.]org, meetup-chat[.]com, phone-drive[.]online, and share-lienk[.]info. SentinelLABS reporting linked CapraRAT samples to domains including newsbizshow[.]net, ptzbubble[.]shop, and shareboxs[.]net; IPs including 95[.]111.247.73, 209[.]127.19.241, 173[.]249[.]50[.]243, and 173[.]212[.]206[.]227; and ports including 14862, 18892, 10284, and 18582. Additional sample and infrastructure details in the content include SHA-1 values 4C6741660AFED4A0E68EF622AA1598D903C10A01 and 542A2BC469E617252F60925AE1F3D3AB0C1F53B6 for Android/Spy.CapraRAT.A; yt.apk (8beab9e454b5283e892aeca6bca9afb608fa8718); YouTube_052647.apk (83412f9d757937f2719ebd7e5f509956ab43c3ce); Piya Sharma.apk (14110facecceb016c694f04814b5e504dc6cde61); Crazy Game signed.apk (c307f523a1d1aa928fe3db2c6c3ede6902f1084b); Sexy Videos signed.apk (dba9f88ba548cebfa389972cddf2bec55b71168b); TikTok signed.apk (28bc3b3d8878be4267ee08f20b7816a6ba23623e); and Weapons signed.apk (fff24e9f11651e0bdbee7c5cd1034269f40fc424).

The malware has been observed in ongoing Android-focused surveillance operations since at least 2021, with public reporting noting continued modification and compatibility updates, including successful execution on newer Android versions such as Android 13 and 14.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Transparent Tribe

It distributed the Android CapraRAT backdoor via trojanized secure messaging and calling apps branded as MeetsApp and MeetUp; the backdoor can exfiltrate any sensitive information from its victims’ devices.

via eset welivesecurity blogwelivesecurity.com
APT-36

SentinelLABS has identified four new CapraRAT APKs associated with suspected Pakistan state-aligned actor Transparent Tribe. These APKs continue the group’s trend of embedding spyware into curated video browsing applications, with a new expansion targeting mobile gamers, weapons enthusiasts, and TikTok fans.

via sentinelone labssentinelone.com
APT-C-56

在泄露数据中我们还发现了一个疑似攻击者的设备,该设备上存在一个名称为“y.apk”的文件,该文件属于透明部落组织CapraRAT家族移动端RAT样本。… 在同家族样本的某个投递地址下,我们发现了一个名称为“ynjhjhgfdt.apk”的APK文件,该文件也属于透明部落组织CapraRAT恶意家族。

via ctfiotctfiot.com
MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques
T1189Drive-by CompromiseEvidence1

The group relies heavily on social engineering attacks to deliver a variety of Windows and Android spyware, including spear-phishing and watering hole attacks.

T1566PhishingEvidence1

The group relies heavily on social engineering attacks to deliver a variety of Windows and Android spyware, including spear-phishing and watering hole attacks.

T1566.003Spearphishing via ServiceEvidence2

Victims were probably targeted through a honey-trap romance scam, where they were initially contacted on another platform and then convinced to use supposedly “more secure” apps, which they were then lured into installing.

Execution

3 techniques
T1053Scheduled Task/JobEvidence1

MainActivity is responsible for driving the application’s key features. This activity sets persistence through the onCreate method... this method calls the serviceRefresh method, which creates an alarm at the interval specified in the settings file’s timeForAlarm variable... the alarm and persistence launcher run once per minute.

T1059Command and Scripting InterpreterEvidence1

TPSClient contains CapraRAT’s commands, which are invoked through the run method via a series of switch statements that map the string command to a related method.

T1204.002Malicious FileEvidence1

In September 2023, SentinelLABS outlined the CapraTube campaign, which used weaponized Android applications (APK) designed to mimic YouTube... The activity highlighted in this report shows the continuation of this technique...

Persistence

2 techniques
T1053Scheduled Task/JobEvidence1

MainActivity is responsible for driving the application’s key features. This activity sets persistence through the onCreate method... this method calls the serviceRefresh method, which creates an alarm at the interval specified in the settings file’s timeForAlarm variable... the alarm and persistence launcher run once per minute.

T1112Modify RegistryEvidence1

Notable features include: Overriding system settings such as GPS & Network Modifying files on the phone’s filesystem.

Privilege Escalation

1 technique
T1053Scheduled Task/JobEvidence1

MainActivity is responsible for driving the application’s key features. This activity sets persistence through the onCreate method... this method calls the serviceRefresh method, which creates an alarm at the interval specified in the settings file’s timeForAlarm variable... the alarm and persistence launcher run once per minute.

Stealth

4 techniques
T1036MasqueradingEvidence3

This campaign has distributed CapraRAT backdoors through at least two similar websites, while representing them as untainted versions of those secure messaging apps.

T1070.004File DeletionEvidence1

MainActivity calls the TCHPClient class... including... killFile (file deletion)

T1497.001System ChecksEvidence1

mRun performs a connectivity check to decide whether to connect to the C2 using the hostname shareboxs[.]net or the hardcoded IP address 173[.]249[.]50[.]243 .

T1564Hide ArtifactsEvidence1

The hideApp method now checks if the system is running Android version 9 or earlier... if applicable, the app will be hidden from the user’s view.

Defense Impairment

1 technique
T1112Modify RegistryEvidence1

Notable features include: Overriding system settings such as GPS & Network Modifying files on the phone’s filesystem.

Discovery

2 techniques
T1083File and Directory DiscoveryEvidence1

MainActivity calls the TCHPClient class, which contains the malicious capabilities leveraged by CapraRAT. This class drives several spyware classes and methods, including... DirLister (file browsing)

T1497.001System ChecksEvidence1

mRun performs a connectivity check to decide whether to connect to the C2 using the hostname shareboxs[.]net or the hardcoded IP address 173[.]249[.]50[.]243 .

Collection

3 techniques
T1113Screen CaptureEvidence2

When the app first launches, the user is prompted to grant several risky permissions, including... Record audio and screen, take screenshots

T1123Audio CaptureEvidence2

When the app first launches, the user is prompted to grant several risky permissions, including... Record audio and screen, take screenshots... MainActivity calls the TCHPClient class, which contains the malicious capabilities leveraged by CapraRAT. This class drives several spyware classes and methods, including: audioStreamer ( aStreamer )

T1125Video CaptureEvidence2

When the app first launches, the user is prompted to grant several risky permissions, including... Use camera... MainActivity calls the TCHPClient class... including... PhotoTaker

Command and Control

3 techniques
T1071Application Layer ProtocolEvidence3

The sendData method is responsible for constructing the data collected by other methods and classes and sending it to the C2. The mRun method constructs the socket and sends the data to the C2 server using the variables specified in the Settings class.

T1090.003Multi-hop ProxyEvidence1

mRun performs a connectivity check to decide whether to connect to the C2 using the hostname shareboxs[.]net or the hardcoded IP address 173[.]249[.]50[.]243 .

T1105Ingress Tool TransferEvidence2

MainActivity calls the TCHPClient class... including... downloadFile

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

CapraRAT is a comprehensive RAT that provides the actors with the ability to harvest data on demand and exfiltrate it.

Impact

1 technique
T1489Service StopEvidence1

MainActivity calls the TCHPClient class... including... killProcess

INDICATORS OF COMPROMISE

IOCs tracked for this family

26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
16 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app1 year ago
domain●●●●●●●●●●●●View more in app1 year ago
hash.sha1●●●●●●●●●●●●View more in app1 year ago
ip.v4●●●●●●●●●●●●View more in app1 year ago
domain●●●●●●●●●●●●View more in app1 year ago
hash.sha1●●●●●●●●●●●●View more in app1 year ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching26

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.