OPERATIONAL // CLASSIFIED BUILD SYSTEM

WUHZEN RAT

Android Remote Access Suite / v3.0.0 / API 24 → 36 / Android 7 → 16

Capabilities

Service Modules

Hardening Tiers

Dependencies

User Action Required

[01] Surveillance & Capture

SURV Data Acquisition Suite

12 VECTORS

LIVE

Keystroke Logging — every text field, attributed to app + field name, 4s batched exfil // Acc.java

LIVE

Screen Text Scraping — full UI tree dump: text, IDs, bounds, passwords flagged // Acc.scrape()

LIVE

Live Screen Stream — MediaProjection JPEG @ 5fps adaptive, fractional touch bridge // ScreenMirror.java

LIVE

Notification Interception — dual lane (listener + accessibility mirror), <1s delivery // Notifier.java

LIVE

SMS Capture — ContentObserver id-delta push, sub-second new-message delivery // SmsObserver.java

CMD

Camera Both Lenses — Camera2 stills + video clips, front & rear on demand // CameraService.java

CMD

Microphone Recording — audio capture on command // CameraService.java

LIVE

GPS Tracking — GPS + network providers, 15m filter, continuous + forced fix // LocationTracker.java

LIVE

Filesystem Index — full tree sweep incl. hidden files, capped paging // FileExplorer.java

LIVE

Gallery Media Sweep — MediaStore crawl with metadata // GalleryCapture.java

CMD

Clipboard Read — primary clip extraction on demand // Acc.clipboard()

LIVE

Foreground App Tracking — every app switch streamed in real time // Acc.focus()

[02] SMS Control

SMS Read / Write / Forward

9 CMDS

LIVE

Inbound Capture — ContentObserver id-delta, sub-second delivery // SmsObserver

LIVE

Full Inbox Sweep — every folder, capped paging, on boot + poll // MessageCapture

CMD

Send SMS — dual-SIM aware, multipart, audit-logged // SmsControl.send()

CMD

Write SMS — inject fake rows into provider (needs default SMS app) // SmsControl.write()

AUTO

Auto-Forward — regex rules re-send inbound to operator numbers same-second // SmsControl.forwardBatch()

CMD

Mark Read / Delete — hide evidence, wipe threads by number // SmsControl.markRead/delete

LIVE

OTP Interceptor — 4 regex patterns lift codes from bank/wallet SMS, shipped on dedicated channel // SmsObserver.shipOtps()

CMD

OTP Inbox Scan — retroactively scrape all stored codes // sms_otp_scan

CMD

SIM Enumeration — slots, carriers, ICCIDs for targeted sends // sms_sims

CALL Call Forward / Block / Redirect

12 CMDS

NET

Carrier MMI Forward — *21*NUM# arms network-level forwarding, survives reboot/uninstall // CallControl.forward()

NET

Forward Variants — busy (*67*) · no-answer (*61*) · unreachable (*62*) + cancel + status // call_forward_cancel/status

ROLE

Call Screening Service — sees every call before dialer, silent reject of blocklist // CallScreener

ROLE

Call Redirection Service — rewrites outgoing destinations (victim calls "bank", reaches operator) // CallRedirector

CMD

Block List — number never rings, no log entry, no notification // call_block

CMD

Call Log — full read with names/locations, wipe by number or all // call_log / call_log_wipe

CMD

Dial / Answer / End — direct call (CALL_PHONE) or dialer fallback // call_dial/answer/end

AUTO

Role Auto-Grant — accessibility confirms screening/redirection system dialogs // call_role_screen/redirect

AUTO

Redirect Rules — regex-matched outgoing numbers swapped or cancelled // call_redirect_rules

LIVE

Real-Time Call Feed — inbound/outbound streamed to panel events // CallControl.onIncoming/onOutgoing

CMD

State Snapshot — roles + blocklist + SIMs + log in one call // call_state

CMD

USSD/MMI Dial — ACTION_CALL_BUTTON (no UI) with ACTION_DIAL fallback // CallControl.dial()

[03] Banking Attack Engine

BANK Overlay / ATS / Tapjacking / PIN

4 ATTACK PATHS

AUTO

Overlay Injection — full-screen WebView over real bank via TYPE_ACCESSIBILITY_OVERLAY (zero SAW prompt). Targets + HTML from panel at runtime. Credentials POST back tagged with institution // BankAttack.showOverlay()

AUTO

Blackout Mode — solid overlay hides automation while ATS runs // bank blackout

ATS

Automated Transfer System — walks live view tree, fills IBAN+amount, confirms, lifts OTP from inbound SMS, submits. Transfer from victim's own device+session — defeats device-binding // BankAttack.runAts()

AUTO

Transparent Tap Layer — invisible overlay records every touch coordinate, re-dispatches to real app. PIN digits resolved by keypad geometry // BankAttack.startTapLayer()

LIVE

Lock-Screen PIN Capture — PIN/password char-by-char, pattern via dot indices, from keyguard events // Acc.captureKeyguardEvents()

AUTO

Self-Unlock — wake + gesture replay of captured secret; device unlocks unattended // BankAttack.selfUnlock()

CMD

Recipe Storage — per-bank field IDs stored once, reused for ATS // bank_recipe

CMD

Audit Trail Purge — deletes OTP SMS after use // purge_sms flag

Live Credential Feed — every overlay submission streams to panel instantly // /api/device/overlay + socket

Live OTP Strip — codes appear in dedicated dashboard tab the second they arrive // /api/device/otp + socket

[04] Remote Control

CTRL Input Injection

10 OPS

CMD

Tap / Swipe / Long-Press — fractional coords scaled to device pixels // Acc.dispatchGesture

CMD

Global Actions — BACK · HOME · RECENTS · SHADE · POWER · LOCK // Acc.global()

CMD

Text Injection — set text on focused field or by node ID // Acc.type()

CMD

Click by Selector — walks up to clickable parent automatically // Acc.click()

CMD

Scroll Control — forward/backward on scrollable containers // Acc.scroll()

CMD

Silent Screenshot — API 30+, zero MediaProjection prompt // Acc.shot()

CMD

Shell Script Runner — sequenced ops with waits // runScript()

CMD

APK Push & Install — download from URL, trigger installer // Drag.push()

CMD

Icon Visibility Toggle — vanish from launcher on demand // Acc.hideIcon()

CMD

Play Protect Disable — navigates Play Store settings via accessibility // Acc.disablePlayProtect()

GRNT Auto-Grant Engine

BTMOB / CRAXRAT PARITY

AUTO

Runtime Permission Dialogs — clicks ALLOW on permissioncontroller across Android versions // autoGrantPermissions()

AUTO

MediaProjection Consent — auto-clicks START NOW every session before user reacts // autoGrantMediaProjection()

AUTO

Device Admin Activation — auto-confirms the admin consent dialog // autoGrantDeviceAdmin()

AUTO

Special Permission Switches — navigates Settings, flips OVERLAY · NOTIF · BATTERY · ALL-FILES · UNKNOWN-SOURCES // autoGrantSpecialPermsInSettings()

AUTO

Panel-Triggered Sequences — one click runs the full grant walk on device // Hub: auto_grant_perms

Single Manual Gate — accessibility toggle. After that: zero prompts, forever

[05] Persistence & Survival

SURV Anti-Removal

6 LAYERS

IMPL

Device Admin Lock — system refuses uninstall until admin deactivated // LockUnlockManager

IMPL

AppOps Uninstall Mask — UNINSTALL_PACKAGES=IGNORED hides the button entirely // blockOp()

IMPL

Settings Interception — accessibility detects uninstall flow, force-HOME // antiUninstall()

IMPL

Boot Receiver — BOOT_COMPLETED + QUICKBOOT + USER_PRESENT + MY_PACKAGE_REPLACED // BootReceiver

IMPL

Service Resurrection — onDestroy restarts itself as foreground service // WuhzenService

IMPL

Task-Removed Defense — swipe-away from recents re-spawns service // onTaskRemoved

LOCK Device Lock / PIN

DASHBOARD VISIBLE

IMPL

Random 6-Digit PIN — generated at first run, persisted locally // Core.generateLockPin()

CMD

Lock Now — resetPassword + lockNow, screen dies instantly // lockNow()

CMD

Unlock Remotely — clears credential, admin stays armed // unlockNow()

CMD

Rotate PIN — fresh PIN pushed to device lock on demand // rotatePin()

IMPL

PIN on Dashboard — operator sees the key at all times // lock_pin field

IMPL

Survives Reboot — PIN + admin persist through power cycle

[06] Stealth & Evasion

FAST

~20–40s

Per-build seeded class/field/method rename, string encryption, constant-pool rebuild

STRONG · DEFAULT

~90–180s

+ BlackObfuscator control-flow flattening (depth 2–4), reflection redirection

MAX

~3–5 min

+ dpt-shell function-extraction: hollowed codeitems, runtime fill-back, anti-Frida, anti-debug

VMP

~8–15 min

+ dex-to-native opcode-randomised VM. Java analysis becomes moot

FUD Anti-Detection Stack

8 TECHNIQUES

BUILD

Unique Signature Per Build — fresh RSA-2048 keystore, random CN/alias/pass. Never repeats // build2.sh

BUILD

Per-Build String Encryption — ProGuard -encryptstrings with random key each build // obfuscate.pro

BUILD

Junk String Injection — StringObfuscator class pollutes string pool with randomised constants

BUILD

Logging Annihilation — all Log.d/v/i/w/e stripped at compile // assumenosideeffects

BUILD

Package Flattening — repackageclasses → wz, zero original namespace survives

IMPL

Session Installer — PackageInstaller.Session bypasses Android 13+ Restricted Settings // SessionDropper

IMPL

Auto-Hide on First Launch — icon vanishes after setup, runs headless forever // DropperActivity

OPT

Container Manipulation — ZIP flag/method poisoning breaks scanners (opt-in) // container_mode

[07] Command & Control

C2 Transport Layer

ZERO DEPS

IMPL

Long-Poll Channel — 22s server hold, sub-second command latency // Hub.pollThread()

IMPL

Zero Third-Party Libraries — HttpURLConnection only. Compiles with android.jar + javac + d8

IMPL

Binary Uplinks — screen frames, camera stills, mic clips, files as raw POST // Net.up()

IMPL

Wake-Embedded Keep-Alive — poll hold doubles as dyno keep-alive on free hosting

IMPL

Chrome User-Agent Masking — traffic indistinguishable from mobile browser // Net.open()

PANEL Operator Dashboard

9 TABS / DEVICE

Live Screen Mirror — click / swipe / long-press injected straight to device // wireTouch()

Real-Time Feed — SMS · notifications · keystrokes stream via Socket.io

Notification Toasts — pop the moment device receives one

OSM Location Map — pinned to newest GPS fix, accuracy radius // paintLoc()

Build Generator — tier · container · package · name · icon, all editable // renderBuild()

APK Binder — weave implant into any host APK, keep its launcher // renderBind()

State Persistence — survives server restart via debounced JSON flush

WUHZEN v3.0.0 — ANDROID REMOTE ACCESS SUITE
TARGET: API 24–36 · MIN USER INTERACTION · MAX PERSISTENCE

4 HARDENING TIERS UNIQUE SIG / BUILD A13+ BYPASS BANK ATS ENGINE CARRIER CALL FWD SMS FWD + OTP SESSION INSTALLER ANTI-UNINSTALL ×3 ZERO DEPS