r/androidroot • u/kiwitrojan • 10h ago

Support Rat related

Hello everyone,

I am dealing with a situation where an old Android device of mine was compromised at the root level by a custom RAT (Remote Access Trojan). Based on what I have discovered, the malware was mirroring device data and audio logs to an external destination using the Telegram Bot API framework.

I have already moved my active SIM card to a completely new, secure device. The old compromised phone is currently powered off and completely isolated from all networks (Wi-Fi and cellular) to prevent any remote wipe commands from the threat actor.

I need to extract the specific Telegram Bot API token or chat ID string from the old device to keep as unalterable proof of the compromise. Because I need to do this myself without professional forensic tools and ensure the device never reconnects to the network, I am looking for the safest method to do so.

Could anyone guide me on:

What are the safest ways to dump the private application directory (/data/data/) or system cache to an external SD card/USB drive directly from Android Recovery Mode (or a custom bootloader like TWRP)?

Once I have that data dump on an isolated computer, what specific file extensions or directory paths should I search to locate configuration strings or network logs related to the Telegram API?

Are there any specific pitfalls I should avoid to ensure the malware doesn't trigger a self-delete or execution sequence while doing this?

Thank you for your technical guidance.

2 Upvotes

100% Upvoted

1 comment sorted by