AhRat
Software · ATTACK:mobile:S1095
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:S1095",
"title": "AhRat",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1095",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--24c8f6db-71e0-41ef-a1dc-83399a5b17e5",
"external_id": "S1095",
"domain": "mobile",
"created": "2023-12-18T19:00:02.259Z",
"modified": "2025-04-22T21:22:24.938Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "welivesecurity_ahrat_0523",
"url": "https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1437.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e822ff0-b1e1-4d80-b1a2-956919511809
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1533
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21ab4328-7908-4fef-9636-d4d162e4a0cf
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1646
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--349c2f82-1166-4dab-88d0-cfe920804b70
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1636.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43af5696-ac4d-4618-9da9-0784b8f7e433
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1398
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51bd38a1-465b-49c0-9218-5984f391a51c
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1430
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56a0173f-68ec-48f6-88d8-ed1e7a2470ba
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1636.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5738479d-47fb-4d6f-9f04-5ce988327694
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1406
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--597579b4-7e2f-4843-8cd3-f9143eca34f2
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1420
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--792ae0c6-8b0c-4adf-9c7f-83ebee84bb57
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9fb0c414-6216-4b42-a080-cb42ef4011c5
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1513
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a617fa0d-0dfc-432a-95f5-94ee4ae63860
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1429
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be07d829-9a12-4d90-ad8c-9e56782af120
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1426
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c32cbb0c-b5d7-44ad-94aa-43e2fbade91d
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1624.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c75f3a08-b58f-4681-8ef0-75fa634503b9
welivesecurity_ahrat_0523ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1582
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dbdaa604-b94c-43d1-b8cc-e8e2bbc3fdce
welivesecurity_ahrat_0523