C2Tracker

35b19577c09d231a2bbfc822…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

RatHat. Operator handle caozuo1. C2 wss://www.heilongyk.top/ (plaintext server_config.json). buildTime 2026-06-22T19:04:11+08:00. Carries a Google Gemini API key AQ.Ab8RN6ILQvb_db-vvjKQV5kOTB8gICPm0dmunDyRVSxGnI4xnA — RatHat serializes the accessibility tree to Gemini to drive synthetic clicks.

Identification

SHA-256
35b19577c09d231a2bbfc82263a9a01958af53febc6fcc4eaf8462a1ad4eef82
MD5
949a59f12836e190b46b0d7d18ce14e8

Observed

Families
RatHat
First seen
2026-09-07

APK metadata

Summary

Type
Android · APK
Package
—
Main activity
—
Internal version
—
Displayed version
—
Min SDK
—
Target SDK
—

Signing certificate

Valid from
2008-02-29 01:33:46
Valid to
2035-07-17 01:33:46
Serial
936eacbe07f201df
Thumbprint
61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email
android@android.com
Issuer
C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Activities (19)

  • com.google.android.gms.common.api.GoogleApiActivity
  • com.node.quick.pure.activity.BackgroundTaskActivity
  • com.node.quick.pure.activity.CompatSetupActivity
  • com.node.quick.pure.activity.PackageVerifyActivity
  • com.node.quick.pure.activity.ServiceConfigActivity
  • com.node.quick.pure.activity.TransparentHelperActivity
  • com.node.quick.pure.activity.WelcomeActivity
  • com.node.quick.pure.activity.dpjuxzxd
  • com.node.quick.pure.activity.dyjuyjtaedgx
  • com.node.quick.pure.activity.jlggknlmmvf
  • com.node.quick.pure.activity.nmumfngsucci
  • com.node.quick.pure.activity.ohxyekfez
  • com.node.quick.pure.activity.srbjbsafvch
  • com.node.quick.pure.activity.unhbqhbchvb
  • com.node.quick.pure.erpfkfmymbvq
  • com.node.quick.pure.inject.eaxpofoaehx
  • com.node.quick.pure.service.modules.yw5xud.dgpvxqyd
  • com.node.quick.pure.ui.dgpvxqyd
  • com.node.quick.pure.ui.ghuyzyeob

Services (19)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
  • com.google.firebase.components.ComponentDiscoveryService
  • com.google.firebase.messaging.FirebaseMessagingService
  • com.node.quick.pure.activity.Corepvmzdkweek
  • com.node.quick.pure.keepalive.guard.ubjlhxanr1
  • com.node.quick.pure.keepalive.guard.ubjlhxanr2
  • com.node.quick.pure.service.AppCoreService
  • com.node.quick.pure.service.InitWorkerService
  • com.node.quick.pure.service.MediaDisplayService
  • com.node.quick.pure.service.account.Accountpvmzdkweek
  • com.node.quick.pure.service.account.aaydwede
  • com.node.quick.pure.service.agaehbabxbul
  • com.node.quick.pure.service.bvommhng
  • com.node.quick.pure.service.inyosokjjkx

Receivers (21)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy.BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy.BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy.NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy.StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • androidx.work.impl.utils.ForceStopRunnable.BroadcastReceiver
  • com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
  • com.google.firebase.iid.FirebaseInstanceIdReceiver
  • com.node.quick.pure.receiver.azmgiqch
  • com.node.quick.pure.receiver.nabgzdojak
  • com.node.quick.pure.receiver.wvqavxhl
  • com.node.quick.pure.service.cbnvthpllaks
  • com.node.quick.pure.service.eaebaxvdhn

Providers (4)

  • androidx.startup.InitializationProvider
  • com.google.firebase.provider.FirebaseInitProvider
  • com.node.quick.pure.provider.EarlyInitProvider
  • com.node.quick.pure.service.account.StubContentProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.accounts.AccountAuthenticatorandroid.app.action.ACTION_PASSWORD_CHANGEDandroid.app.action.ACTION_PASSWORD_EXPIRINGandroid.app.action.ACTION_PASSWORD_FAILEDandroid.app.action.ACTION_PASSWORD_SUCCEEDEDandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.content.SyncAdapterandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.ACTION_SHUTDOWNandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_CHANGEDandroid.intent.action.PACKAGE_REMOVEDandroid.intent.action.PACKAGE_REPLACEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.SCREEN_ONandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_PRESENTandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_DELIVERandroid.provider.Telephony.SMS_RECEIVEDandroid.service.notification.NotificationListenerServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENTcom.htc.intent.action.QUICKBOOT_POWERONcom.node.quick.pure.action.BACKUP_SYNCcom.node.quick.pure.action.HEALTH_CHECKcom.node.quick.pure.action.QUICK_SYNC

Intent filters — categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
www.heilongyk.top/ domain — wss RatHat 2026-09-07

Signing certificate

Subject CN
Android
Issuer CN
Android
Fingerprint
a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About RatHat

AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.

Zimperium: RatHat - AI-powered mobile threat targeting credentials & bank accountsZimperium IOC repository: 2026-09-RatHat