5d57a09ee2782dd94a1b11ad…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
app.cooltools.hub (楽天ポイント); Java stub net.scout.smartapps.* with strings XOR-0xa5. Each blob = salt(16)∥nonce(12)∥GCM; key = HKDF-SHA256(salt, MASTER), AAD = salt∥kind; plaintext body is XOR-0x57 + nibble-swap + inflate. Asset deb4e823.idx → stage-1 dex → the 17.7 MB e49ca96a asset decrypts to a ZIP = the real RatHat APK.
Registration C2 http://177.4.12.41:8889 (ZM26 serverUrl; owner admin; buildTime 2026-05-29T16:45:55+08:00 — same build as cf6fab86…, port 8889). webUrl was the Rakuten lure (filtered). RatHat’s primary channel is a runtime-fetched FRP tunnel, not a static IOC.Identification
- SHA-256
- 5d57a09ee2782dd94a1b11adb0376041ba42faeb1a8bdbfeaabb83d93d9834b5
- MD5
- 11114051fec3203ee5f2ce82f6dad3e9
Observed
- Families
- RatHat
- First seen
- 2026-10-04
APK metadata
Summary
- Type
- Android · APK
- Package
- app.cooltools.hub
- Main activity
- app.cooltools.hub.dvmru
- Internal version
- —
- Displayed version
- —
- Min SDK
- 24
- Target SDK
- 34
Signing certificate
- Valid from
- 2008-02-29 01:33:46
- Valid to
- 2035-07-17 01:33:46
- Serial
- 936eacbe07f201df
- Thumbprint
- 61ed377e85d386a8dfee6b864bd85b0bfaa5af81
- Subject
- C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
- Subject email
- android@android.com
- Issuer
- C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Permissions (7)
Intent filters — actions
Unpacked payload
The real payload hidden inside the packer, recovered by unwrapping the sample (AES-GCM 2-stage packer). This is the actual capability set the malware runs with — the APK metadata above is only the decoy loader shell.
Summary
- Package
- com.tool.move.good
- Main activity
- —
- Internal version
- 50807
- Displayed version
- 5.8.7
- Min SDK
- 24
- Target SDK
- 34
Signing certificate
- Valid from
- 2008-02-29 01:33:46
- Valid to
- 2035-07-17 01:33:46
- Serial
- 936eacbe07f201df
- Thumbprint
- 61ed377e85d386a8dfee6b864bd85b0bfaa5af81
- Subject
- C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
- Subject email
- android@android.com
- Issuer
- C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Permissions (47)
Intent filters — actions
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| 177.4.12.41 | ip | 8889 | http | RatHat | 2026-10-04 |
Signing certificate
- Subject CN
- Android
- Issuer CN
- Android
- Fingerprint
- a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About RatHat
AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.