RatHat
Malware family · 6 sample(s) · 8 indicator record(s) · 4 signing certificate(s)
About RatHat
AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| admin.fjbjwgyuyftg.qpon/ | domain | 7261b1f4f4b9… | 2026-09-07 |
| andxxxo.com/ | domain | fd4e0923ac2d… | 2026-08-05 |
| cocoacider.cc/ | domain | cf6fab86b34e… | 2026-09-09 |
| www.blackcat880.shop/ | domain | 00ba0d5aea12… | 2026-04-04 |
| www.cheng770.cyou/ | domain | f179f0a98187… | 2026-06-01 |
| www.heilongyk.top/ | domain | 35b19577c09d… | 2026-09-07 |
| zq.hao18.top/0wh/ | domain | f179f0a98187… | 2026-06-01 |
| 207.56.28.183:8889 | ip | cf6fab86b34e… | 2026-09-09 |
Detected samples without extractable endpoint (3)
Family matched by code marker or hash attribution, but no C2 is statically extractable — the endpoint arrives at runtime.
| SHA-256 | Package | Note | First seen |
|---|---|---|---|
| 00ba0d5aea12… | — | RatHat. serverUrl is the registration/WebSocket C2; the primary FRP tunnel C2 is fetched at runtime (liblocal-service.so) and is not a static IOC. Config is ZM26-encrypted with a custom keystream; serverUrl not statically recovered for this build. source | 2026-04-04 |
| cf6fab86b34e… | — | RatHat. serverUrl is the registration/WebSocket C2; the primary FRP tunnel C2 is fetched at runtime (liblocal-service.so) and is not a static IOC. Config is ZM26-encrypted with a custom keystream; serverUrl not statically recovered for this build. source | 2026-09-09 |
| f179f0a98187… | — | RatHat. serverUrl is the registration/WebSocket C2; the primary FRP tunnel C2 is fetched at runtime (liblocal-service.so) and is not a static IOC. Config is ZM26-encrypted with a custom keystream; serverUrl not statically recovered for this build. source | 2026-06-01 |