Analysis Links SURXRAT Android RAT to ArsinkRAT and Finds Conditional LLM Download
Summary
Cyble analyzed 180+ SURXRAT samples, linking the Android RAT to ArsinkRAT and detailing its Telegram MaaS model, Firebase C2, surveillance and extortion features, and conditional download of a >23GB LLM for selected Free Fire apps.
Key points
- Cyble identified more than 180 related samples; a Telegram channel promoted SURXRAT from late 2024, and development likely began in early 2025. The actor is suspected to be Indonesian.
- Source-code references and a Firebase database label support the assessment that SURXRAT evolved from the ArsinkRAT codebase.
- SURXRAT is marketed through reseller and partner licenses priced at 200k and 500k, respectively; affiliates can create builds while the operator retains centralized infrastructure.
- Recent samples conditionally download a >23GB LLM when specified Free Fire apps are active, or when triggered by backend commands. Researchers describe possible purposes as experimental, not confirmed.
- The RAT abuses Android permissions and Accessibility Services, collects sensitive device and account data, and uses Firebase for near-real-time command and control.
- Operators can capture audio and images, issue remote commands, and activate a PIN-protected screen locker that can be removed remotely.
Article Details
- Attack Vectors
- SURXRAT is sold through a Telegram-based malware-as-a-service operation that lets affiliates generate and distribute customized Android builds.
- After installation, the malware prompts victims to grant sensitive permissions and enable Android Accessibility Services, which it uses to monitor screen activity and automate actions.
- SURXRAT connects to attacker-controlled Firebase Realtime Database infrastructure for command and control and data exfiltration.
- Recent samples conditionally download an LLM module exceeding 23 GB when specified Free Fire apps are active; the trigger can also be configured through attacker-backend commands.
- Operators can issue remote commands for surveillance and device control, including audio recording, camera capture, file enumeration, SMS sending, and storage wiping.
- An operator-activated screen locker displays a persistent lock message and PIN requirement; failed PIN attempts are sent to the backend.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//xrat-sisuriya-default-rtdb[.]firebaseio[.]com | Firebase Realtime Database endpoint identified as SURXRAT's command-and-control infrastructure. |
MITRE ATT&CK
T1412SURXRAT collects SMS messages from infected devices.T1417.002The article says SURXRAT abuses Accessibility Services to monitor screen activity.T1418Operators can remotely retrieve lists of installed apps.T1420Operators can remotely enumerate files on infected devices.T1426SURXRAT collects device brand and model, Android version, and other device information.T1429Operators can remotely command SURXRAT to record audio.T1430The malware requests access to location data on infected devices.T1432SURXRAT collects victims' contact lists.T1437.001SURXRAT communicates with its Firebase Realtime Database command-and-control infrastructure over a web-based protocol.T1516The article reports that SURXRAT uses Accessibility Services to automate actions on the device.T1646The malware sends collected device and personal data to its Firebase-based command-and-control infrastructure.
Malware
ArsinkRATCode links to ArsinkRAT and more than 180 identified samples show rapid evolution, and unusual features—like the conditional download of a >23GB LLM from Hugging Face triggered by Free Fire titles—signal AISURXRATSURXRAT is an Android Remote Access Trojan sold as a commercial MaaS on Telegram with reseller and partner licensing that centralizes infrastructure while enabling affiliates to generate and distribute customized builds.
Products
AndroidSURXRAT is an Android Remote Access Trojan sold as a commercial MaaS on Telegram with reseller and partner licensing that centralizes infrastructure while enabling affiliates to generate and distribute customized builds.Firebase Realtime DatabaseAfter permissions are secured, SURXRAT connects to a Firebase Realtime Database at hxxps://xrat-sisuriya-default-rtdb.firebaseio[.]com, using a database reference labeled “arsinkRAT,” further reinforcing theFree Fire MAX x JUJUTSU KAISENis triggered when specific gaming applications are active on the infected device, including Free Fire MAX x JUJUTSU KAISEN (com.dts.freefiremax) and Free Fire x JUJUTSU KAISEN (com.dts.freefireth). Alternatively, theFree Fire x JUJUTSU KAISENon the infected device, including Free Fire MAX x JUJUTSU KAISEN (com.dts.freefiremax) and Free Fire x JUJUTSU KAISEN (com.dts.freefireth). Alternatively, the trigger conditions can be configured dynamically viaHugging Facesamples show rapid evolution, and unusual features—like the conditional download of a >23GB LLM from Hugging Face triggered by Free Fire titles—signal AI experimentation for automation, evasion, and hybridTelegramSURXRAT is an Android Remote Access Trojan sold as a commercial MaaS on Telegram with reseller and partner licensing that centralizes infrastructure while enabling affiliates to generate and distribute customized builds.