Airavat Malware: Sophisticated RAT & Ransomware Targeting Android

Cyble Research Labs analyzed an AIRAVAT Android RAT (including a Pro variant) being distributed via opendir sites and sold on Telegram; the RAT uses Firebase C2 and grants broad permissions to exfiltrate SMS, calls, contacts, audio and camera data, execute shell commands, send SMS, delete files and perform ransomware encryption/decryption. The report includes technical details, command mappings, app metadata, multiple file hashes and C2/distribution URLs as IOCs, and highlights the malware's ease of use and active distribution among threat actors.