00ba0d5aea129f098b5a6096…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

RatHat (AI-powered Android credential stealer, Zimperium 2026-09). Launcher package com.plus.base. Operator handle yushuai. C2 wss://www.blackcat880.shop/, recovered from assets/0.bt (ZM26 container + ENC: inner layer). buildTime 2026-04-04T08:11:08+08:00. Config decrypt: ZM26 (xor_key∥salt, offset 20) → JSON → serverUrl = ENC: (base64 → byte-pair swap → double XOR). Primary FRP tunnel C2 is runtime-fetched by liblocal-service.so.

Identification

SHA-256: 00ba0d5aea129f098b5a609633ac77cd642fddba8b64f6332e49e6d33294992e
MD5: 1124bbbda3347b9d0bf59022e487935e

Observed

Families: RatHat
First seen: 2026-04-04

APK metadata

Summary

Type: Android · APK
Package: com.plus.base
Main activity: com.peak.speed.moon.DefaultLauncherAlias
Internal version: 20719
Displayed version: 2.7.19
Min SDK: 24
Target SDK: 34

Signing certificate

Valid from: 2026-04-04 00:11:34
Valid to: 2053-08-20 00:11:34
Serial: 56837744
Thumbprint: bfd530c57db68ede2cfc7db54b2e5069c96c8c8b
Subject: C:CN, CN:Chen Lei, L:Hangzhou, O:Smart Systems Inc, ST:Shanghai, OU:Smart Solutions
Issuer: C:CN, CN:Chen Lei, L:Hangzhou, O:Smart Systems Inc, ST:Shanghai, OU:Smart Solutions

Permissions (51)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_NOTIFICATION_POLICYandroid.permission.ACCESS_WIFI_STATEandroid.permission.BIND_DEVICE_ADMINandroid.permission.BROADCAST_STICKYandroid.permission.CAMERAandroid.permission.CHANGE_NETWORK_STATEandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.CHANGE_WIFI_STATEandroid.permission.DISABLE_KEYGUARDandroid.permission.EXPAND_STATUS_BARandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GET_INSTALLED_APPSandroid.permission.GET_PACKAGE_SIZEandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.MEDIA_PROJECTIONandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.QUICKBOOT_POWERONandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_AUDIOandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_MEDIA_VISUAL_USER_SELECTEDandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECORD_AUDIOandroid.permission.REORDER_TASKSandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.REQUEST_PASSWORD_COMPLEXITYandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.TURN_SCREEN_ONandroid.permission.USE_BIOMETRICandroid.permission.USE_EXACT_ALARMandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SETTINGScom.huawei.permission.external_app_settings.USE_COMPONENTcom.peak.speed.moon.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONoppo.permission.OPPO_COMPONENT_SAFE

Activities (15)

com.peak.speed.moon.activity.AccessibilityTrampoline
com.peak.speed.moon.activity.BackgroundTaskActivity
com.peak.speed.moon.activity.TransparentHelperActivity
com.peak.speed.moon.activity.jnioknvc
com.peak.speed.moon.activity.jzpwbhejfwz
com.peak.speed.moon.activity.lbwhpqmbow
com.peak.speed.moon.activity.orrfeupsgz
com.peak.speed.moon.activity.ouvutjfpkbpa
com.peak.speed.moon.activity.teqgropbpmf
com.peak.speed.moon.activity.vawzhrczmhu
com.peak.speed.moon.inject.tezeldypmj
com.peak.speed.moon.otnjjzjnljm
com.peak.speed.moon.service.modules.yw5xud.wqzydduaxa
com.peak.speed.moon.ui.bhcpvmzyxt
com.peak.speed.moon.ui.wqzydduaxa

Services (10)

androidx.room.MultiInstanceInvalidationService
androidx.work.impl.background.systemalarm.SystemAlarmService
androidx.work.impl.background.systemjob.SystemJobService
androidx.work.impl.foreground.SystemForegroundService
com.peak.speed.moon.service.AppCoreService
com.peak.speed.moon.service.InitWorkerService
com.peak.speed.moon.service.MediaDisplayService
com.peak.speed.moon.service.etnlldytfpv
com.peak.speed.moon.service.kgomyvgkjc
com.peak.speed.moon.service.rizmfimneet

Receivers (18)

androidx.profileinstaller.ProfileInstallReceiver
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy.BatteryChargingProxy
androidx.work.impl.background.systemalarm.ConstraintProxy.BatteryNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy.NetworkStateProxy
androidx.work.impl.background.systemalarm.ConstraintProxy.StorageNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.background.systemalarm.RescheduleReceiver
androidx.work.impl.diagnostics.DiagnosticsReceiver
androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
androidx.work.impl.utils.ForceStopRunnable.BroadcastReceiver
com.peak.speed.moon.receiver.cczjijlgjdfb
com.peak.speed.moon.receiver.eoinofvhnb
com.peak.speed.moon.service.enlrdxopna
com.peak.speed.moon.service.xdguocup

Providers (1)

androidx.startup.InitializationProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.ACTION_PASSWORD_CHANGEDandroid.app.action.ACTION_PASSWORD_EXPIRINGandroid.app.action.ACTION_PASSWORD_FAILEDandroid.app.action.ACTION_PASSWORD_SUCCEEDEDandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.AIRPLANE_MODEandroid.intent.action.BATTERY_CHANGEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DATE_CHANGEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.HEADSET_PLUGandroid.intent.action.LOCALE_CHANGEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_CHANGEDandroid.intent.action.PACKAGE_REMOVEDandroid.intent.action.PACKAGE_REPLACEDandroid.intent.action.POWER_CONNECTEDandroid.intent.action.POWER_DISCONNECTEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.intent.action.SCREEN_OFFandroid.intent.action.SCREEN_ONandroid.intent.action.SIM_STATE_CHANGEDandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_PRESENTandroid.intent.action.USER_UNLOCKEDandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.STATE_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.service.notification.NotificationListenerServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.htc.intent.action.QUICKBOOT_POWERONcom.peak.speed.moon.action.BACKUP_SYNCcom.peak.speed.moon.action.HEALTH_CHECKcom.peak.speed.moon.action.QUICK_SYNCcom.peak.speed.moon.intent.RESTART_SERVICES

Intent filters — categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
www.blackcat880.shop/	domain	—	wss	RatHat	2026-04-04

Signing certificate

Subject CN: Chen Lei
Issuer CN: Chen Lei
Fingerprint: c80355bea43b333be23ac156c2cf72ddd0cc06ffd3fa4ebd1209392b199650ed

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About RatHat

AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.

Zimperium: RatHat - AI-powered mobile threat targeting credentials & bank accounts Zimperium IOC repository: 2026-09-RatHat