784dadd0653a2816718cd300…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Identification

SHA-256: 784dadd0653a2816718cd3002a7b032ad497316ab90e08f6d1b874be25b50019
MD5: f83357b2d47c7d38ee53943373961211

Observed

Families: RatHat
First seen: 2025-12-10

APK metadata

Summary

Type: Android · APK
Package: com.wallet.android
Main activity: com.guard.wallet.activity.MainActivity
Internal version: 2
Displayed version: 2.0
Min SDK: 24
Target SDK: 35

Signing certificate

Valid from: 2025-10-09 12:23:06
Valid to: 2107-11-29 12:23:06
Serial: 6a218595
Thumbprint: e70a984209a0889e0a66cff1786eacadd4c69f32
Subject: C:US, CN:com.wallet.android, L:HongKong, O:com.wallet.android, ST:HongKong, OU:com.wallet.android
Issuer: C:US, CN:com.wallet.android, L:HongKong, O:com.wallet.android, ST:HongKong, OU:com.wallet.android

Permissions (116)

android.permission.ACCEPT_HANDOVERandroid.permission.ACCESS_ADSERVICES_AD_IDandroid.permission.ACCESS_ADSERVICES_ATTRIBUTIONandroid.permission.ACCESS_BACKGROUND_LOCATIONandroid.permission.ACCESS_COARSE_LOCATIONandroid.permission.ACCESS_FINE_LOCATIONandroid.permission.ACCESS_LOCATION_EXTRA_COMMANDSandroid.permission.ACCESS_MEDIA_LOCATIONandroid.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_NOTIFICATION_POLICYandroid.permission.ACCESS_WIFI_STATEandroid.permission.ACCOUNT_MANAGERandroid.permission.ACTION_NOTIFICATION_LISTENER_SETTINGSandroid.permission.ACTIVITY_RECOGNITIONandroid.permission.ANSWER_PHONE_CALLSandroid.permission.AUTHENTICATE_ACCOUNTSandroid.permission.BIND_DEVICE_ADMINandroid.permission.BIND_DREAM_SERVICEandroid.permission.BLUETOOTHandroid.permission.BLUETOOTH_ADMINandroid.permission.BLUETOOTH_ADVERTISEandroid.permission.BLUETOOTH_CONNECTandroid.permission.BLUETOOTH_SCANandroid.permission.BODY_SENSORSandroid.permission.BROADCAST_STICKYandroid.permission.CALL_COMPANION_APPandroid.permission.CALL_PHONEandroid.permission.CAMERAandroid.permission.CAPTURE_AUDIO_OUTPUTandroid.permission.CHANGE_NETWORK_STATEandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.CHANGE_WIFI_STATEandroid.permission.DISABLE_KEYGUARDandroid.permission.EXPAND_STATUS_BARandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_LOCATIONandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.GET_ACCOUNTSandroid.permission.GET_INSTALLED_APPSandroid.permission.GET_PACKAGE_SIZEandroid.permission.HIDE_OVERLAY_WINDOWSandroid.permission.HIGH_SAMPLING_RATE_SENSORSandroid.permission.INSTALL_PACKAGESandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MANAGE_ACCOUNTSandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.MANAGE_OWN_CALLSandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.NEARBY_WIFI_DEVICESandroid.permission.NFCandroid.permission.NFC_PREFERRED_PAYMENT_INFOandroid.permission.NFC_TRANSACTION_EVENTandroid.permission.PACKAGE_USAGE_STATSandroid.permission.POST_NOTIFICATIONSandroid.permission.PROCESS_OUTGOING_CALLSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.READ_CALENDARandroid.permission.READ_CALL_LOGandroid.permission.READ_CELL_BROADCASTSandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_AUDIOandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_PHONE_NUMBERSandroid.permission.READ_PHONE_STATEandroid.permission.READ_PRIVILEGED_PHONE_STATEandroid.permission.READ_SMSandroid.permission.READ_SYNC_SETTINGSandroid.permission.READ_SYNC_STATSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_MMSandroid.permission.RECEIVE_SMSandroid.permission.RECEIVE_WAP_PUSHandroid.permission.RECORD_AUDIOandroid.permission.REORDER_TASKSandroid.permission.REQUEST_COMPANION_PROFILE_WATCHandroid.permission.REQUEST_COMPANION_RUN_IN_BACKGROUNDandroid.permission.REQUEST_COMPANION_START_FOREGROUND_SERVICES_FROM_BACKGROUNDandroid.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUNDandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.REQUEST_OBSERVE_COMPANION_DEVICE_PRESENCEandroid.permission.REQUEST_PASSWORD_COMPLEXITYandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SEND_SMSandroid.permission.SET_WALLPAPERandroid.permission.SET_WALLPAPER_HINTSandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.TRANSMIT_IRandroid.permission.TURN_SCREEN_ONandroid.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTIONandroid.permission.USE_BIOMETRICandroid.permission.USE_CREDENTIALSandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.USE_SIPandroid.permission.UWB_RANGINGandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_CALENDARandroid.permission.WRITE_CALL_LOGandroid.permission.WRITE_CONTACTSandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SECURE_SETTINGSandroid.permission.WRITE_SETTINGSandroid.permission.WRITE_SYNC_SETTINGScom.android.alarm.permission.SET_ALARMcom.android.launcher.permission.INSTALL_SHORTCUTcom.android.launcher.permission.UNINSTALL_SHORTCUTcom.huawei.permission.external_app_settings.USE_COMPONENTcom.sec.android.provider.badge.permission.READcom.sec.android.provider.badge.permission.WRITEcom.wallet.android.MANAGE_MEDIA_PROJECTIONoppo.permission.OPPO_COMPONENT_SAFE

Activities (5)

com.guard.wallet.LockActivity
com.guard.wallet.activity.ConfirmDeviceActivity
com.guard.wallet.activity.GuideActivity
com.guard.wallet.activity.MainActivity
com.guard.wallet.activity.NoDisplayActivity

Services (6)

com.guard.wallet.service.AccountAuthenticatorService
com.guard.wallet.service.CustomNotificationService
com.guard.wallet.service.MediaLiveService
com.guard.wallet.service.MyAccessibilityService
com.guard.wallet.service.WIFIBackgroundService
com.guard.wallet.sync.SyncService

Receivers (1)

com.guard.wallet.receiver.CustomAdminReceiver

Providers (1)

com.guard.wallet.sync.StubProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.accounts.AccountAuthenticatorandroid.app.action.ACTION_PASSWORD_CHANGEDandroid.app.action.ACTION_PASSWORD_EXPIRINGandroid.app.action.ACTION_PASSWORD_FAILEDandroid.app.action.ACTION_PASSWORD_SUCCEEDEDandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.content.SyncAdapterandroid.service.notification.NotificationListenerServicecom.guard.wallet.wifi.lock

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
admin.rathat.live	domain	—	—	RatHat	2025-12-10
api.rathat.live	domain	—	—	RatHat	2025-12-10

Signing certificate

Subject CN: com.wallet.android
Issuer CN: com.wallet.android
Fingerprint: c4d43b50b117983edee6dc72ce96117069bf7076e4e00a6f88a66ba3eb824944

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About RatHat

AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.

Zimperium: RatHat - AI-powered mobile threat targeting credentials & bank accounts Zimperium IOC repository: 2026-09-RatHat