zq.hao18.top/0wh/
domainTracked by C2 Tracker · Whois queried 2026-10-05T14:08:39
Registration
- Registrar
- —
- Registered
- —
- Expires
- —
DNS
- Resolves to
- 104.21.33.28, 172.67.140.187
- Nameservers
- —
- Status
- —
Observed in malware
| Family | Sample SHA-256 | First seen |
|---|---|---|
| RatHat | f179f0a98187… | 2026-06-01 |
About RatHat
AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.
Signing certificate
- Subject CN
- Mobile Development Team
- Issuer CN
- Mobile Development Team
- Valid
- 2023-11-01 → 2054-01-05
- Fingerprint
- 7c62fcb862fb296297074dd4ca550e3a87ce224c5b1ed62fed7ad6f66ac1e2be
Other samples signed with this certificate? That's a lead worth checking — but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.