9efccdb69b61a3de5b7dd2e4…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Identification
- SHA-256
- 9efccdb69b61a3de5b7dd2e4560657bf9fea46ca92caed54f6a24180f57a8850
- MD5
- 8fdc21e25097a46528211274e54330e1
Observed
- Families
- RatHat
- First seen
- 2026-02-04
APK metadata
Summary
- Type
- Android · APK
- Package
- guide.com.sensitiveusername.insexualawakening
- Main activity
- app.guide.wallet.android.activity.MainActivity
- Internal version
- 1
- Displayed version
- 1.0
- Min SDK
- 24
- Target SDK
- 34
Signing certificate
- Valid from
- 2026-02-02 14:50:13
- Valid to
- 2108-03-24 14:50:13
- Serial
- 41c70aec
- Thumbprint
- 0fb5233e66716c93fc1beeaca12d3295c3abff77
- Subject
- C:CN, CN:guide.com.sensitiveusername.insexualawakening, L:HongKong, O:guide.com.sensitiveusername.insexualawakening, ST:HongKong, OU:guide.com.sensitiveusername.insexualawakening
- Issuer
- C:CN, CN:guide.com.sensitiveusername.insexualawakening, L:HongKong, O:guide.com.sensitiveusername.insexualawakening, ST:HongKong, OU:guide.com.sensitiveusername.insexualawakening
Permissions (4)
Intent filters — actions
C2 configuration (1)
Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| admin.rathat.live | domain | — | — | RatHat | 2026-02-04 |
Signing certificate
- Subject CN
- guide.com.sensitiveusername.insexualawakening
- Issuer CN
- guide.com.sensitiveusername.insexualawakening
- Fingerprint
- 8a3b866490248a5137f709ef5aac2785d72a847269a65bb622be597094e589d2
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About RatHat
AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.