08ddce94ca93c1c5f21305d6…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256: 08ddce94ca93c1c5f21305d64ccdbfb2851cdfa9ea71cbb92ab8b302c7758770
MD5: 5137bf592e54a2f6217392a7699c80d5

Observed

Families: RatHat
First seen: 2026-10-01

APK metadata

Summary

Type: Android · APK
Package: com.smart.zero.view
Main activity: —
Internal version: 90910
Displayed version: 9.9.10
Min SDK: 24
Target SDK: 34

Signing certificate

Valid from: 2026-09-22 08:53:02
Valid to: 2056-09-14 08:53:02
Serial: 3cd77b60aebd964f
Thumbprint: da968907f308fef2213946cd087db7466b1264b4
Subject: C:CN, CN:TeeEd Local, L:SZ, O:Local, ST:GD, OU:Build
Issuer: C:CN, CN:TeeEd Local, L:SZ, O:Local, ST:GD, OU:Build

Permissions (51)

android.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.ANSWER_PHONE_CALLSandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.CHANGE_WIFI_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_CAMERAandroid.permission.FOREGROUND_SERVICE_LOCATIONandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.FOREGROUND_SERVICE_MICROPHONEandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GET_ACCOUNTSandroid.permission.INTERNETandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_CALL_LOGandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_AUDIOandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_MEDIA_VISUAL_USER_SELECTEDandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SEND_SMSandroid.permission.USE_BIOMETRICandroid.permission.USE_CREDENTIALSandroid.permission.USE_EXACT_ALARMandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SECURE_SETTINGSandroid.permission.WRITE_SETTINGScom.coloros.permission.SAFE_COMPONENTcom.google.android.c2dm.permission.RECEIVEcom.miui.permission.START_IN_BACKGROUNDcom.samsung.android.permission.BACKGROUND_START_ACTIVITYcom.smart.zero.view.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONcom.vivo.abe.permission.CLEAN_NOTIFICATIONcom.vivo.permission.manage.permission.ACCESScom.xiaomi.permission.BACKGROUND_START_ACTIVITYoppo.permission.OPPO_COMPONENT_SAFE

Activities (8)

com.google.android.gms.common.api.GoogleApiActivity
com.smart.zero.view.activity.AccGuideActivity
com.smart.zero.view.activity.GrantRequestPage
com.smart.zero.view.activity.MainGateway
com.smart.zero.view.activity.SplashGateway
com.smart.zero.view.activity.WakeScreenPage
com.smart.zero.view.features.credential.CredentialPromptActivity
com.smart.zero.view.inject.WebPayloadPage

Services (18)

androidx.room.MultiInstanceInvalidationService
androidx.work.impl.background.systemalarm.SystemAlarmService
androidx.work.impl.background.systemjob.SystemJobService
androidx.work.impl.foreground.SystemForegroundService
com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
com.google.firebase.components.ComponentDiscoveryService
com.google.firebase.messaging.FirebaseMessagingService
com.smart.zero.view.features.screen.ScreenCastService
com.smart.zero.view.keepalive.AdminKeepAliveDaemon
com.smart.zero.view.keepalive.FcmWakeService
com.smart.zero.view.keepalive.KeepAliveMediaBrowserService
com.smart.zero.view.keepalive.KeepAliveMediaRouteService
com.smart.zero.view.keepalive.KeepAliveTileService
com.smart.zero.view.keepalive.RecoveryJobService
com.smart.zero.view.service.CoreTaskAgent
com.smart.zero.view.service.NotificationListener
com.smart.zero.view.service.PlatformAssistDaemon

Receivers (16)

androidx.profileinstaller.ProfileInstallReceiver
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.background.systemalarm.RescheduleReceiver
androidx.work.impl.diagnostics.DiagnosticsReceiver
androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
com.google.firebase.iid.FirebaseInstanceIdReceiver
com.smart.zero.view.keepalive.AdminEventReceiver
com.smart.zero.view.keepalive.AlarmKeepAliveReceiver
com.smart.zero.view.keepalive.KeepAliveWidgetProvider
com.smart.zero.view.receiver.BootReceiver
com.smart.zero.view.receiver.PackageEventReceiver

Providers (4)

androidx.core.content.FileProvider
androidx.startup.InitializationProvider
com.google.firebase.provider.FirebaseInitProvider
com.smart.zero.view.keepalive.KeepAliveProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.appwidget.action.APPWIDGET_UPDATEandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.ACTION_SHUTDOWNandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_CHANGEDandroid.intent.action.PACKAGE_REMOVEDandroid.intent.action.PACKAGE_REPLACEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.SCREEN_ONandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_PRESENTandroid.media.MediaRouteProviderServiceandroid.media.browse.MediaBrowserServiceandroid.net.conn.CONNECTIVITY_CHANGEandroid.service.notification.NotificationListenerServiceandroid.service.quicksettings.action.QS_TILEandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.coloros.intent.action.BOOT_COMPLETEDcom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENTcom.htc.intent.action.QUICKBOOT_POWERONcom.huawei.intent.action.BOOT_COMPLETEDcom.huawei.systemmanager.optimize.bootStart.action.BOOTcom.meizu.intent.action.BOOTcom.miui.intent.action.BOOT_COMPLETEDcom.oppo.intent.action.BOOT_COMPLETEDcom.samsung.android.intent.action.BOOT_COMPLETEDcom.vivo.intent.action.BOOT_COMPLETED

Intent filters — categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
kkyk1688.cc	domain	—	https	RatHat	2026-10-01

Signing certificate

Subject CN: TeeEd Local
Issuer CN: TeeEd Local
Fingerprint: 36fe21c231e424ebd2ee54ff079104d93f6068d7836592c8e0577400c49be293

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About RatHat

AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.

Zimperium: RatHat - AI-powered mobile threat targeting credentials & bank accounts Zimperium IOC repository: 2026-09-RatHat