SurxRat
Malware family · 5 sample(s) · 7 indicator record(s) · 1 signing certificate(s) · Active 2026-02-11 → 2026-02-21 (experimental)
About SurxRat
SurxRat is an Android RAT of the ArsinkRAT lineage (Cyble, Feb 2026), distributed under adult-content lures such as Hot51live (package com.sisurya.surxratv2). It abuses Accessibility services and requests about 40 permissions including SMS and RECEIVE_BOOT_COMPLETED, and ships a screen-locker component. Command-and-control runs over a Firebase Realtime Database (fir-e9e7b, surya-e2284 and xrat-sisurya projects). The internal marker string ArsinkRAT identifies the builder.
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| fir-e9e7b-default-rtdb.firebaseio.com | domain | 029c00fabe5d… | 2026-02-21 |
| fir-e9e7b-default-rtdb.firebaseio.com | domain | f1350b9bc3b4… | 2026-02-19 |
| fir-e9e7b-default-rtdb.firebaseio.com | domain | e48d586288b4… | 2026-02-18 |
| surya-e2284-default-rtdb.firebaseio.com | domain | 05f77799a631… | 2026-02-13 |
| surya-e2284-default-rtdb.firebaseio.com | domain | 094c5034c2e9… | 2026-02-11 |
| xrat-sisurya-default-rtdb.firebaseio.com | domain | 05f77799a631… | 2026-02-13 |
| xrat-sisurya-default-rtdb.firebaseio.com | domain | 094c5034c2e9… | 2026-02-11 |