# wishihab/Android-RATList: A Catalog of Android Remote Access Trojans > Android-RATList is a documentation repository that catalogs known Android remote access trojans and summarizes their reported features. It is useful for security research and threat inventory work, but it is not an Android RAT implementation and does not provide a safe installation workflow. **wishihab/Android-RATList** — Android - Remote Access Trojan List - Repository: https://github.com/wishihab/Android-RATList - Stars: 1,643 · Forks: 369 - Language: Unknown - License: not declared - Published: 2026-10-16 · Updated: 2026-10-16 · Language: en - Canonical page: https://hysenlabs.com/projects/wishihab-android-ratlist ## What Android-RATList Covers Android-RATList solves a cataloging problem rather than an operational one. Its README describes the repository as a list of known Android Remote Access Trojans, both free and paid, accompanied by key features and required permissions. The entries include DroidJack, AndroRAT, SpyNote, AhMyth, TheFatRAT, BetterAndroRAT, OmniRAT, Android Voyage, NetWire, Dendroid, Pegasus, Monokle and many other names. The associated Android-RAT-Dataset is linked as a separate resource, but the README does not explain its format, contents or relationship to the list. The intended audience is researchers and defenders who need a starting point for identifying families or comparing documented capabilities. The list is not an Android application, command-and-control implementation, payload generator or detection engine. Its value depends on the accuracy and provenance of each entry. The README asks readers to report missing or incorrect information through issues or pull requests, which indicates that the catalog is expected to be corrected as its maintainers learn more. The entries also contain links to repositories for individual projects, but the presence of those links does not turn Android-RATList into a package index with tested builds. The README explicitly warns against downloading or installing the listed projects unless the risks are fully understood. That warning is central to evaluating this repository. It is a descriptive collection of offensive tools, so accidental installation could expose a researcher's device or network. ## Capability Entries and Their Research Limits The list is organized by named RAT or spyware family. Each entry is a short bullet list rather than a technical specification. For example, DroidJack is associated with camera, microphone, location, storage, SMS, calls, contacts, WhatsApp reading, browser history and app management. AndroRAT is associated with contacts, call logs, calls, SMS, location, camera, microphone, streaming video for an activity-based client, messages, calls, URL opening and vibration. These are claims recorded by the repository, not results of an analysis performed by Android-RATList. The catalog covers several categories of behavior. Some entries describe surveillance functions, such as microphone recording, screenshots, keylogging, browser history collection or contact access. Others describe device manipulation, including app installation or removal, opening URLs, locking or unlocking a device, hiding an app, changing settings or adding and removing applications. A smaller group is associated with command execution, shell access, command-and-control changes, denial-of-service attacks or destructive behavior. That range makes the list useful for triage, but it also limits its reliability. The README does not provide version numbers, hashes, sample dates, Android API levels, permission manifests or evidence for each capability. It also does not distinguish between a feature present in one release, a feature requiring particular configuration, and a feature attributed to a related project. The direct statement that Cerberusapp is notdeletable and that Android Voyage can include anti-antivirus, brick, self-destruction or password-grabbing behavior should therefore be treated as catalog entries that require separate verification. The repository is most appropriate as a lead index. It cannot establish whether a named family is still available, whether a linked repository is authentic, or whether its current behavior matches the summary. ## A Safe First Use of the Catalog Android-RATList does not document installation steps for the repository itself because it is not presented as an installable tool. The README instead says that it contains a list and links to a dataset and separate external projects. It does not provide a supported clone command, package manager command, build command, Android SDK setup or configuration file. There is therefore no project-specific installation tutorial to reproduce safely. A first use should remain within documentation review. Start with the README, identify the family name relevant to a research question, record the exact URL shown for that entry, and separate the documented capabilities from assumptions. Do not download an executable from a linked repository simply because its name appears in the list. The README's warning says that a Trojan inside a Trojan is possible and recommends caution with executable files from unknown sources. If a separate investigation is authorized, the first artifact to inspect is the external project's own documentation and source tree, not an APK or executable obtained from a search result. This catalog gives no safe test device, emulator image, network isolation procedure or malware-analysis sandbox configuration. It also does not document how to neutralize a sample after analysis. Those omissions matter because the listed families can involve permissions such as camera, microphone, location, storage, SMS, contacts and call logs. The repository's contribution instructions point to its issues and pull requests for corrections. That is the only documented maintenance workflow. No release artifact, release note or upgrade procedure is provided. ## How the List Differs From a RAT Dataset or Framework Android-RATList differs from an Android RAT framework because it does not describe an executable client-server architecture, command protocol, payload builder or Android project structure. A framework would normally document how to build an Android application, connect it to a controller and issue commands. This README instead lists capabilities reported for existing projects. It also differs from a malware analysis report. There is no sample corpus description, static analysis method, behavioral test setup, detection signature or incident timeline. The list does not explain whether an item was observed in a particular application package, whether a feature is conditional, or whether the project behind the name has changed. The linked Android-RAT-Dataset may provide additional data, but the README does not define that relationship, so its contents cannot be assumed from the name. A more procedural alternative for defenders is an internally maintained capability matrix based on authorized malware samples and documented analysis. Such a matrix would record source provenance, package identity, hash, Android version, permissions, observed behavior and confidence for each claim. That is a different approach from a community list of names and feature bullets, because it links each statement to a specific artifact and analysis record. For researchers comparing Android malware, the distinction affects both accuracy and safety. A capability index can reduce search time, while a traceable analysis record supports conclusions. Android-RATList currently offers the former, based on the README, rather than the latter. ## Maintenance, Licensing and Operational Boundaries The repository is not marked as archived, and the last push was on 2026-10-15. The README does not document a release cadence, version scheme or compatibility policy. There are no GitHub releases. That means a reader cannot use release notes to determine when an entry was checked, and changes to the catalog may not correspond to changes in the linked RAT projects. The repository metadata does not identify a license. The README contains research and documentation language, but it does not state terms for copying, modifying or redistributing the list. No legal interpretation is possible from the information available here. Users who need a licensed dataset or a redistribution policy should verify the repository files and obtain clarification from the relevant rights holders before republishing content. The operational boundary is equally important. This project should not be treated as a defensive scanner, a legal authorization guide or a source of safe samples. Several entries are described with functions associated with surveillance, credential collection, hidden execution, destructive actions or command execution. The README explicitly warns against installation. Its documentation purpose does not remove the risk of following a link to malware. There is also no documented rollback procedure, compatibility matrix or migration path for consumers who copy the list into another system. A correction submitted as an issue or pull request is not the same as a released data version. That gap matters for downstream security inventories that require stable attribution and reproducible records. ## Conclusion Use Android-RATList when you need a quick, human-readable inventory of documented Android RAT names and capabilities. Do not treat it as an operational RAT framework, a malware sample repository, or a source of installation guidance. Before relying on an entry, verify its original project, permissions, code provenance, and current behavior. The repository has no published GitHub releases and its license is not stated, while the last push was on 2026-10-15. ## FAQ ### What is wishihab/Android-RATList? It is a GitHub repository containing a list of known Android Remote Access Trojans, with brief feature and permission descriptions intended for documentation and research. The README also links to a separate Android-RAT-Dataset. ### Does Android-RATList let me install or operate an Android RAT? No installation or operation instructions for an RAT are documented in the repository. The README explicitly warns users not to download or install the listed projects unless they fully understand the risks. ### Which Android RAT capabilities are included? The entries include reported capabilities such as camera and microphone access, location tracking, storage access, SMS and contact collection, screenshots, app management, keylogging, shell commands and remote control. The README does not provide evidence or version-specific verification for each feature. ## Sources - [Issues](https://github.com/wishihab/Android-RATList/issues) - [README](https://github.com/wishihab/Android-RATList/blob/master/README.md) - [wishihab/Android-RATList on GitHub](https://github.com/wishihab/Android-RATList) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/wishihab-android-ratlist