The phone connects directly to the IP address and port specified in APK.

The connection between the phone and the controller is long, i.e. more than 30 minutes.

Packets sent from the phone have the format {data length}{delimiter}{gzip compressed data}.

Packets sent from the controller have a format {data length}{delimiter}{data in plain text}.

There is a heartbeat between the controller and the phone.

The phone connects directly to the IP address and ports specified in APK (default port and custom port).

Some connections over port 1337/TCP between the phone and the controller are long, i.e. more than 30 minutes.

There is a heartbeat between the controller and the phone over 1337/TCP.

Packets sent from the phone and the C&C over port 1337/TCP have a form of {00 00 00}{data length}{delimiter}{data in plain text}.

A new connection over 1334/TCP is established when a new command is received from the C&C.

The phone sends UDP packets to the C&C every 20 seconds.

Packets sent from the phone to the C&C over 1334/TCP and 1337/UDP are in plain text.

The RAT is hosted on the cloud with the use of Firebase platform.

Firebase provides an encrypted connection between the HawkShaw online service and the victim.

The targeted device connects to api.ipify.org and api6.ipify.org to retrieve and send its IPv4 and IPv6 addresses.

There is no heartbeat in the communication between the C&C and the phone.

There are no simultaneous connections established to the C&C.

There are a lot of connections to the Firebase platform, but of a very small size.

The phone connects directly to the IP address and ports specified in APK (default port and custom port).

The main APK is a dropper that installs small APKs that aim to control the phone’s applications, file system, microphone, terminal, calls, sms, contacts and information.

Some connections over port 8000/TCP between the phone and the controller are long, i.e. more than 90 minutes.

There is a heartbeat between the controller and the phone over 8000/TCP.

Packets sent from the phone and the C&C over port 8000/TCP have a form of {data length}{gzip magic number}{compressed data}.

A new connection over 8000/TCP but with a different phone source port is established when a new command from C&C that requires an exchange large amount of data is received.

The phone sends ICMP messages to the C&C every 45 seconds.

The phone connects directly to the IP address and ports specified in APK (default port and custom port).

There is only one long connection, i.e. more than 40 minutes, between the phone and the controller over the port 1337/TCP.

There is no heartbeat between the controller and the phone.

The data is sent in the plain text.

The C&C uses mapping to present the C&C command as a single character.

Packets sent from the phone have a structure of {byteTotalLength}{byteLocalLength}{byteMoreF}{bytePointeurData}{byteChannel}{data}

Packets sent from the C&C have a structure of {byteTotalLength}{byteLocalLength}{byteMoreF}{bytePointeurData}{byteChannel}{C&C command}{targetChannel}{arguments}.

The RAT is capable of controlling the targeted phone over IRC servers, HTTP request, and TCP connection.

The RAT’s database is hosted on the 000webhost.com web hosting service. And is up to the user to install it.

The connection from the infected device to the database in the 000webhost.com hosting is encrypted.

The packets sent from the controller and the phone over IRC servers follow the structure: ‘SASENCODE’+base64_encode(data + ‘T_T’+timestamp)

The packets sent from the controller and the phone over TCP follow the structure: base64_encode(data in JSON format)

The phone connects to the website ipinfo.io to retrieve and send its location to the C&C.

There is no heartbeat in the TCP communication between the C&C and the phone.

There is a heartbeat between the IRC server and the victim, but it is a normal behaviour for this protocol.

The connections with the C&C over TCP were closed with RSTR and S1 states.

There are 34 connections established to different IRC servers.

There are 21 connections established to the database in the 000webhost.com hosting with the server_name ‘experimentsas.000webhostapp.com’.

The phone connects directly to the IP address and ports specified in APK (default port and custom port).

The protocol used for the connection is switched from the HTTP to WebSocket.

There are several simultaneous connections established between the phone and the C&C over port 8000/TCP.

There is a heartbeat between the controller and the phone over port 8000/TCP. ‘Ping’ and ‘pong’ packets are sent every 25 seconds, according to the parameters setup in the beginning of the connection.

Packets sent from the C&C are in the plain text and JSON-encoded. 

Packets sent from the phone are in the plain text, JSON-encoded but masked by the WebSocket protocol. This effectively hides their content from human eyes unless decoded. 

The duration of the connection between the phone and the C&C is supposed to be long, but due to the RAT code being unstable, the connection breaks often, generating multiple short connections.

The C&C sends the packets in plaintext without any structure.

The infected phone sends the packets in plaintext without any structure.

The communication between the C&C and the phone is done in one flow of long duration (approximately 16 minutes).

Even though the connection between the controller and the phone was closed, the phone tries to reconnect every 3 seconds.

There is no heartbeat in the traffic between the phone and the controller.