SURXRAT Malware

SURXRAT is a sophisticated Android remote access Trojan (RAT) distributed under a malware-as-a-service (MaaS) model through a Telegram-based platform. Source code analysis and functional similarities indicate that it likely evolved from Arsink RAT. Designed to infiltrate Android devices, SURXRAT enables extensive data theft, remote device manipulation, and even full device lockdown.

Criminal Business Model: Reseller and Partner Schemes

SURXRAT is commercialized through two one-time payment subscription tiers, each tailored to different levels of criminal enterprise:

Reseller Plan: Permits up to three malware builds per day and allows redistribution under pricing determined by the operator.

Partner Plan: Allows up to ten builds per day and authorizes buyers to establish their own reseller networks.

Both packages include complimentary server upgrades, reinforcing the structured and scalable nature of this illicit ecosystem.

Infection Workflow and Permission Abuse

Upon execution, SURXRAT aggressively requests high-risk permissions, including access to location data, contacts, SMS messages, and device storage. Once granted, the malware prompts the victim to enable Android Accessibility Services. This critical step allows the malicious application to monitor on-screen activity and perform automated actions without user awareness.

After securing the required privileges, SURXRAT collects extensive device intelligence, including contact lists, SMS content, call logs, device manufacturer and model, Android version, battery level, SIM card details, network information, and public IP address. The malware maintains persistent background execution while sustaining communication with its Command-and-Control (C2) infrastructure. It also activates dedicated modules responsible for surveillance, system control, and data harvesting.

Surveillance and Data Exfiltration Capabilities

SURXRAT provides operators with broad visibility into compromised devices. Its data theft capabilities include access to SMS messages, contacts, call logs, installed applications, and detailed system information. The malware can also extract Gmail account data, monitor location in real time, and gather network and connectivity metrics.

Additional surveillance features extend to notification interception, clipboard monitoring, and browser history tracking. The malware can capture cellular tower data, scan available WiFi networks, log connection histories, and access all files on the device through an integrated file management component.

Remote Device Manipulation and Disruption

Beyond espionage, SURXRAT grants attackers full remote control over infected devices. Capabilities include unlocking the device, initiating phone calls, altering wallpapers, playing audio, generating artificial network lag, sending push notifications, and forcing the device to open specified websites. It can also activate the flashlight, trigger vibration, and overlay custom text on the screen.

More severe functions enable operators to lock the device using a PIN of their choosing or completely erase stored data. A recent version introduces an internet throttling mechanism that deliberately slows a victim’s connection. This is achieved by initiating the download of a massive file hosted on Hugging Face. The download process is automatically triggered when certain gaming applications, including special editions of Free Fire, are active, or when the attacker specifies alternative target applications via the control server.

Built-In Ransomware Functionality

SURXRAT incorporates a ransomware-style locking feature that displays a full-screen message and secures the device with a PIN. Attackers can demand payment, monitor incorrect PIN entry attempts in real time, and remotely remove the lock if desired. Such capabilities are commonly leveraged for financial extortion.

Impact and Security Implications

As a multifunctional Android threat, SURXRAT combines data theft, espionage, remote control, and ransomware operations within a single framework. The consequences for victims may include financial fraud, identity theft, account compromise, privacy violations, operational disruption, and increased exposure to secondary cyberattacks.

Android malware such as SURXRAT is commonly distributed through deceptive applications hosted on unofficial marketplaces or malicious websites. Threat actors frequently disguise payloads as legitimate applications, modified games, cracked software, or software updates. Delivery methods also include phishing links sent via SMS, email, social media, and messaging platforms. In other campaigns, attackers exploit system vulnerabilities or deploy malicious advertising. In most cases, successful infection depends on user interaction that unknowingly authorizes the malicious application to execute.