api.rathat.live

domain not resolving

Tracked by C2 Tracker · Whois queried never

Registration

Registrar: —
Registered: —
Expires: —

DNS

Resolves to: —
Nameservers: —
Status: —

Observed in malware

Family	Sample SHA-256	First seen
RatHat	784dadd0653a…	2025-12-10

About RatHat

AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.

Zimperium: RatHat - AI-powered mobile threat targeting credentials & bank accounts Zimperium IOC repository: 2026-09-RatHat

Signing certificate

Subject CN: com.wallet.android
Issuer CN: com.wallet.android
Valid: 2025-10-09 → 2107-11-29
Fingerprint: c4d43b50b117983edee6dc72ce96117069bf7076e4e00a6f88a66ba3eb824944

Other samples signed with this certificate? That's a lead worth checking — but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.