P9A Overlay RAT (provisional)

P9A Overlay RAT (provisional) is a China-nexus Android Accessibility banking RAT delivered by a nested SVLT “shelltemplate” vault dropper (the vault key is carried in AndroidManifest meta-data). The child abuses Accessibility services for overlay credential theft, captures the screen via MediaProjection, uses Firebase, and talks to its operator over a WebSocket command channel at v3.p9a.xyz (endpoints /api/ws/, /gate, /api/ping). Named provisionally after its C2 domain.