Super Mario Run Malware #2 – DroidJack RAT

This Zscaler ThreatLabZ analysis describes a DroidJack (SandroRAT) Android RAT distributed as a fake Super Mario Run app; the malware records calls, captures video/photos, harvests SMS and WhatsApp data, persists information in local databases, and exfiltrates to a hardcoded command-and-control server. The report includes technical artifacts (code snippets and screenshots), demonstrates active device registration and data collection routines, and recommends installing apps only from trusted stores and disabling installation from unknown sources.