New AndroRAT Exploits Allow for Permanent Rooting

Trend Micro identified a new AndroRAT Android variant (ANDROIDOS_ANDRORAT.HRXC) distributed as a fake utility app (TrashCleaner) that uses the CVE-2015-1805 privilege escalation to gain root and perform extensive espionage and remote-control actions (audio/photo/call recording, SMS/contacts/files exfiltration, screen capture, shell execution, WiFi password theft). The report includes technical behavior, recommended countermeasures (avoid third-party app stores, update OS, use mobile security), and IoCs (several SHA256 hashes and the package name com.cleaner.trashcleaner).