C2Tracker

f179f0a98187678897112bdd…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

RatHat. Launcher package org.stonesync23.metageare2 (132 permissions, 111 activities — manifest padding anti-analysis). Operator handle hx555. buildTime 2026-05-30T20:22:22+08:00. Config in assets/0.bt (ZM26 container). Decrypted config fields: serverUrl = https://www.cheng770.cyou/, webUrl = https://zq.hao18.top/0wh/ — both stored ENC:-wrapped and recovered through the g21 double-XOR layer. cheng770.cyou is in Zimperium’s published c2.csv; zq.hao18.top is not (github.com/Zimperium/IOC → 2026-09-RatHat/c2.csv, checked 2026-10-05).

Identification

SHA-256
f179f0a98187678897112bdd507c7eaef56cf25a420707989e29dd88e428789e
MD5
fa4b0d7ffa110a42298df57a2ea6fcd7

Observed

Families
RatHat
First seen
2026-06-01

APK metadata

Summary

Type
Android · APK
Package
org.stonesync23.metageare2
Main activity
org.stonesync23.metageare2.GlobalVideoBinderde3b7
Internal version
5036810
Displayed version
4.27.43.171
Min SDK
24
Target SDK
34

Signing certificate

Valid from
2023-11-01 01:04:00
Valid to
2054-01-05 01:04:00
Serial
da01ded0d1fcafb3
Thumbprint
d8469ba07bcc6aa498dacdb2e79e8db7e6df14ae
Subject
C:US, CN:Mobile Development Team, L:New York, O:GoldenGate Software, ST:New York, OU:Mobile Platform
Issuer
C:US, CN:Mobile Development Team, L:New York, O:GoldenGate Software, ST:New York, OU:Mobile Platform

Permissions (132)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_NOTIFICATION_POLICYandroid.permission.ACCESS_WIFI_STATEandroid.permission.BIND_DEVICE_ADMINandroid.permission.BROADCAST_STICKYandroid.permission.CAMERAandroid.permission.CHANGE_NETWORK_STATEandroid.permission.CHANGE_WIFI_MULTICAST_STATEandroid.permission.CHANGE_WIFI_STATEandroid.permission.DISABLE_KEYGUARDandroid.permission.EXPAND_STATUS_BARandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GET_INSTALLED_APPSandroid.permission.GET_PACKAGE_SIZEandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.MEDIA_PROJECTIONandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.QUICKBOOT_POWERONandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_AUDIOandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_MEDIA_VISUAL_USER_SELECTEDandroid.permission.READ_SMSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECORD_AUDIOandroid.permission.REORDER_TASKSandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.REQUEST_PASSWORD_COMPLEXITYandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.TURN_SCREEN_ONandroid.permission.USE_BIOMETRICandroid.permission.USE_EXACT_ALARMandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.VIBRATEandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SETTINGScom.grand.soft.rapid.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONcom.huawei.permission.external_app_settings.USE_COMPONENToppo.permission.OPPO_COMPONENT_SAFEorg.stonesync23.metageare2.permission.account.account.v5org.stonesync23.metageare2.permission.account.campaign.index06org.stonesync23.metageare2.permission.account.feed.observe04org.stonesync23.metageare2.permission.account.reward.v5org.stonesync23.metageare2.permission.address.campaign.sync94org.stonesync23.metageare2.permission.address.member.refresh77org.stonesync23.metageare2.permission.address.order.expose48org.stonesync23.metageare2.permission.address.payment.route88org.stonesync23.metageare2.permission.address.security.route16org.stonesync23.metageare2.permission.analytics.search.route28org.stonesync23.metageare2.permission.analytics.session.v3org.stonesync23.metageare2.permission.analytics.trade.v5org.stonesync23.metageare2.permission.article.article.dispatch98org.stonesync23.metageare2.permission.campaign.growth.manage79org.stonesync23.metageare2.permission.campaign.search.v7org.stonesync23.metageare2.permission.checkout.trade.dispatch85org.stonesync23.metageare2.permission.comment.growth.manage95org.stonesync23.metageare2.permission.comment.message.update64org.stonesync23.metageare2.permission.config.analytics.v4org.stonesync23.metageare2.permission.config.notification.collect52org.stonesync23.metageare2.permission.config.search.v6org.stonesync23.metageare2.permission.content.reward.refresh68org.stonesync23.metageare2.permission.content.session.route83org.stonesync23.metageare2.permission.content.upload.index13org.stonesync23.metageare2.permission.content.video.bridge45org.stonesync23.metageare2.permission.content.wallet.index61org.stonesync23.metageare2.permission.device.device.observe06org.stonesync23.metageare2.permission.device.message.v2org.stonesync23.metageare2.permission.device.payment.v2org.stonesync23.metageare2.permission.feed.feed.dispatch55org.stonesync23.metageare2.permission.feed.payment.query28org.stonesync23.metageare2.permission.feed.sync.route21org.stonesync23.metageare2.permission.feed.video.manage69org.stonesync23.metageare2.permission.growth.article.collect43org.stonesync23.metageare2.permission.growth.article.v3org.stonesync23.metageare2.permission.growth.security.bridge27org.stonesync23.metageare2.permission.member.account.query00org.stonesync23.metageare2.permission.member.campaign.bind26org.stonesync23.metageare2.permission.member.notification.refresh70org.stonesync23.metageare2.permission.member.reward.access51org.stonesync23.metageare2.permission.member.reward.v6org.stonesync23.metageare2.permission.member.search.access35org.stonesync23.metageare2.permission.member.security.sync98org.stonesync23.metageare2.permission.message.payment.observe11org.stonesync23.metageare2.permission.notification.address.route98org.stonesync23.metageare2.permission.notification.config.v2org.stonesync23.metageare2.permission.order.comment.query94org.stonesync23.metageare2.permission.order.growth.refresh41org.stonesync23.metageare2.permission.order.live.manage23org.stonesync23.metageare2.permission.payment.comment.observe59org.stonesync23.metageare2.permission.payment.comment.v4org.stonesync23.metageare2.permission.payment.reward.query34org.stonesync23.metageare2.permission.payment.search.bridge99org.stonesync23.metageare2.permission.payment.security.update29org.stonesync23.metageare2.permission.profile.profile.bind80org.stonesync23.metageare2.permission.profile.profile.index15org.stonesync23.metageare2.permission.profile.security.dispatch56org.stonesync23.metageare2.permission.reward.account.share06org.stonesync23.metageare2.permission.search.article.manage08org.stonesync23.metageare2.permission.search.growth.v4org.stonesync23.metageare2.permission.search.security.v5org.stonesync23.metageare2.permission.security.config.dispatch06org.stonesync23.metageare2.permission.security.feed.refresh13org.stonesync23.metageare2.permission.security.trade.manage37org.stonesync23.metageare2.permission.session.content.v7org.stonesync23.metageare2.permission.session.search.bridge84org.stonesync23.metageare2.permission.session.trade.sync57org.stonesync23.metageare2.permission.session.video.v2org.stonesync23.metageare2.permission.sync.message.collect10org.stonesync23.metageare2.permission.trade.article.sync98org.stonesync23.metageare2.permission.trade.config.v8org.stonesync23.metageare2.permission.upload.address.bridge01org.stonesync23.metageare2.permission.upload.device.refresh53org.stonesync23.metageare2.permission.upload.security.update49org.stonesync23.metageare2.permission.upload.session.v8org.stonesync23.metageare2.permission.upload.trade.update50org.stonesync23.metageare2.permission.video.growth.bind04org.stonesync23.metageare2.permission.wallet.address.bridge24org.stonesync23.metageare2.permission.wallet.campaign.dispatch46org.stonesync23.metageare2.permission.wallet.content.v4org.stonesync23.metageare2.permission.wallet.live.refresh72

Activities (111)

  • org.stonesync23.metageare2.AbstractBridge96718
  • org.stonesync23.metageare2.ApiInfo237f7
  • org.stonesync23.metageare2.BufferBinder1b76a
  • org.stonesync23.metageare2.CartModule4f8df
  • org.stonesync23.metageare2.DefaultPoolResultfe2f8
  • org.stonesync23.metageare2.DefaultVideoa28f2
  • org.stonesync23.metageare2.DispatcherInterceptoracdee
  • org.stonesync23.metageare2.GlobalWifiModuledf63a
  • org.stonesync23.metageare2.HttpInfocce95
  • org.stonesync23.metageare2.InternalDrawerInterceptorcb9f7
  • org.stonesync23.metageare2.InternalFiled36e1
  • org.stonesync23.metageare2.ListBinder50a32
  • org.stonesync23.metageare2.RemoteBufferInfob06c3
  • org.stonesync23.metageare2.RemoteLoggerConverter26da8
  • org.stonesync23.metageare2.StorageInterceptor70b22
  • org.stonesync23.metageare2.Videobe7d3
  • org.stonesync23.metageare2.core.auth.AccountSettingsActivity65J
  • org.stonesync23.metageare2.core.auth.CheckoutConfirmActivity99T
  • org.stonesync23.metageare2.core.auth.CommentReplyActivity858
  • org.stonesync23.metageare2.core.cache.AddressManageActivity54B
  • org.stonesync23.metageare2.core.cache.AfterSaleApplyActivity2024
  • org.stonesync23.metageare2.core.cache.ShippingTrackActivityV7
  • org.stonesync23.metageare2.core.config.RewardCenterActivity81
  • org.stonesync23.metageare2.core.device.MemberBenefitsActivityV8
  • org.stonesync23.metageare2.core.network.CouponCenterActivity58
  • org.stonesync23.metageare2.core.push.ReferralInviteActivityV8
  • org.stonesync23.metageare2.core.push.VideoFeedActivity772
  • org.stonesync23.metageare2.core.session.CampaignDetailActivity667
  • org.stonesync23.metageare2.core.storage.BrowseHistoryActivity495
  • org.stonesync23.metageare2.core.storage.CampaignDetailActivity47C
  • org.stonesync23.metageare2.core.storage.FlashSaleActivity2025
  • org.stonesync23.metageare2.core.storage.GroupBuyActivity836
  • org.stonesync23.metageare2.core.storage.ReviewPostActivityV5
  • org.stonesync23.metageare2.core.storage.TaskCenterActivity686
  • org.stonesync23.metageare2.data.local.MemberBenefitsActivity409
  • org.stonesync23.metageare2.data.remote.AccountSettingsActivity2023
  • org.stonesync23.metageare2.data.remote.BrowseHistoryActivity22
  • org.stonesync23.metageare2.feature.ad.PaymentResultActivity16L
  • org.stonesync23.metageare2.feature.chat.GiftCardActivity94
  • org.stonesync23.metageare2.feature.content.NotificationCenterActivity2023
  • org.stonesync23.metageare2.feature.explore.BrowseHistoryActivity78
  • org.stonesync23.metageare2.feature.explore.InvoiceManageActivity2021
  • org.stonesync23.metageare2.feature.explore.PaymentResultActivity65O
  • org.stonesync23.metageare2.feature.growth.MemberBenefitsActivity28W
  • org.stonesync23.metageare2.feature.live.GiftCardActivity753
  • org.stonesync23.metageare2.feature.mall.GroupBuyActivity45B
  • org.stonesync23.metageare2.feature.member.AfterSaleApplyActivityV5
  • org.stonesync23.metageare2.feature.member.CommentReplyActivity12
  • org.stonesync23.metageare2.feature.member.FlashSaleActivity198
  • org.stonesync23.metageare2.feature.order.ArticleDetailActivityV2
  • org.stonesync23.metageare2.feature.payment.ShippingTrackActivity55
  • org.stonesync23.metageare2.feature.search.OrderDetailActivityV5
  • org.stonesync23.metageare2.feature.video.AccountSettingsActivityV7
  • org.stonesync23.metageare2.manager.account.FollowListActivity69
  • org.stonesync23.metageare2.manager.account.LiveRoomActivityV7
  • org.stonesync23.metageare2.manager.account.NotificationCenterActivityV6
  • org.stonesync23.metageare2.manager.analytics.FeedbackSubmitActivityV2
  • org.stonesync23.metageare2.manager.download.ShippingTrackActivity62J
  • org.stonesync23.metageare2.manager.download.VideoFeedActivity2027
  • org.stonesync23.metageare2.manager.order.FollowListActivity61Y
  • org.stonesync23.metageare2.manager.recommend.PaymentResultActivity27
  • org.stonesync23.metageare2.manager.upload.ShippingTrackActivityV7
  • org.stonesync23.metageare2.manager.upload.WalletHomeActivity2021
  • org.stonesync23.metageare2.module.marketing.FlashSaleActivity248
  • org.stonesync23.metageare2.module.marketing.PaymentResultActivity63
  • org.stonesync23.metageare2.module.security.AfterSaleApplyActivity420
  • org.stonesync23.metageare2.module.security.CampaignDetailActivityV7
  • org.stonesync23.metageare2.module.security.PointsMallActivity602
  • org.stonesync23.metageare2.module.trade.FeedbackSubmitActivityV3
  • org.stonesync23.metageare2.module.trade.PointsMallActivityV5
  • org.stonesync23.metageare2.service.background.TaskCenterActivity40
  • org.stonesync23.metageare2.service.location.BrowseHistoryActivityV4
  • org.stonesync23.metageare2.service.member.InvoiceManageActivityV4
  • org.stonesync23.metageare2.service.member.MemberBenefitsActivity00
  • org.stonesync23.metageare2.service.member.MembershipRenewActivity19C
  • org.stonesync23.metageare2.service.order.GiftCardActivity2021
  • org.stonesync23.metageare2.service.player.ArticleDetailActivity2023
  • org.stonesync23.metageare2.service.player.ShippingTrackActivity49C
  • org.stonesync23.metageare2.service.recommend.SearchHistoryActivity41
  • org.stonesync23.metageare2.service.report.CreatorStudioActivity76Y
  • org.stonesync23.metageare2.service.sync.FollowListActivityV2
  • org.stonesync23.metageare2.service.sync.ItemDetailActivityV2
  • org.stonesync23.metageare2.service.wallet.LiveRoomActivity89
  • org.stonesync23.metageare2.ui.address.ReferralInviteActivity2028
  • org.stonesync23.metageare2.ui.article.CollectionDetailActivity80N
  • org.stonesync23.metageare2.ui.article.FeedbackSubmitActivity2021
  • org.stonesync23.metageare2.ui.article.MerchantDashboardActivity2021
  • org.stonesync23.metageare2.ui.checkout.CreatorStudioActivity2020
  • org.stonesync23.metageare2.ui.checkout.FollowListActivity67D
  • org.stonesync23.metageare2.ui.comment.RewardCenterActivity603
  • org.stonesync23.metageare2.ui.coupon.ItemDetailActivity81
  • org.stonesync23.metageare2.ui.coupon.TaskCenterActivity2022
  • org.stonesync23.metageare2.ui.dashboard.CommentReplyActivity47
  • org.stonesync23.metageare2.ui.dashboard.ShippingTrackActivity31M
  • org.stonesync23.metageare2.ui.dashboard.StoreLocatorActivity10F
  • org.stonesync23.metageare2.ui.detail.BrandZoneActivity33W
  • org.stonesync23.metageare2.ui.feed.DeviceSecurityActivity2024
  • org.stonesync23.metageare2.ui.feed.StoreLocatorActivity82K
  • org.stonesync23.metageare2.ui.message.CheckoutConfirmActivity918
  • org.stonesync23.metageare2.ui.message.InvoiceManageActivity38
  • org.stonesync23.metageare2.ui.message.MemberBenefitsActivity300
  • org.stonesync23.metageare2.ui.message.NotificationCenterActivity44
  • org.stonesync23.metageare2.ui.notification.AddressManageActivity40
  • org.stonesync23.metageare2.ui.notification.ArticleDetailActivity2025
  • org.stonesync23.metageare2.ui.order.CheckoutConfirmActivity899
  • org.stonesync23.metageare2.ui.order.ItemDetailActivity56
  • org.stonesync23.metageare2.ui.search.ArticleDetailActivity753
  • org.stonesync23.metageare2.ui.search.ItemDetailActivityV2
  • org.stonesync23.metageare2.ui.wallet.BrandZoneActivity2024
  • org.stonesync23.metageare2.ui.wallet.BrandZoneActivityV8
  • org.stonesync23.metageare2.ui.wallet.ItemDetailActivity24S

Services (71)

  • androidx.room.MultiInstanceInvalidationService
  • androidx.work.impl.background.systemalarm.SystemAlarmService
  • androidx.work.impl.background.systemjob.SystemJobService
  • androidx.work.impl.foreground.SystemForegroundService
  • org.stonesync23.metageare2.AdapterInfo387eb
  • org.stonesync23.metageare2.ControllerExt05d35
  • org.stonesync23.metageare2.FragmentHolder7db5f
  • org.stonesync23.metageare2.InternalLayoutExt4a4ad
  • org.stonesync23.metageare2.RichBadgeScope33602
  • org.stonesync23.metageare2.RichThread956b3
  • org.stonesync23.metageare2.biz.checkout.CouponExpireCheckService403
  • org.stonesync23.metageare2.biz.crm.AnalyticsFlushService924
  • org.stonesync23.metageare2.biz.growth.AnalyticsFlushServiceV6
  • org.stonesync23.metageare2.biz.growth.CommentModerationService13C
  • org.stonesync23.metageare2.core.cache.OfflineDataSyncService220
  • org.stonesync23.metageare2.core.database.BackupScheduleService561
  • org.stonesync23.metageare2.core.database.NotificationDispatchService308
  • org.stonesync23.metageare2.core.push.CommentModerationService893
  • org.stonesync23.metageare2.core.push.OfflineDataSyncService2024
  • org.stonesync23.metageare2.core.session.AfterSaleSyncService51
  • org.stonesync23.metageare2.core.storage.OfflineDataSyncServiceV8
  • org.stonesync23.metageare2.data.repository.LocationUpdateServiceV7
  • org.stonesync23.metageare2.feature.ad.RemoteConfigFetchServiceV4
  • org.stonesync23.metageare2.feature.chat.CacheCleanupService828
  • org.stonesync23.metageare2.feature.explore.PlayerWarmupService579
  • org.stonesync23.metageare2.feature.live.CouponExpireCheckService77
  • org.stonesync23.metageare2.feature.live.LiveHeartbeatServiceV3
  • org.stonesync23.metageare2.feature.live.PlayerWarmupService90X
  • org.stonesync23.metageare2.feature.mall.RecommendationRefreshServiceV8
  • org.stonesync23.metageare2.feature.member.MediaUploadService94X
  • org.stonesync23.metageare2.feature.payment.MessagePollingService61B
  • org.stonesync23.metageare2.feature.payment.NotificationDispatchService78Y
  • org.stonesync23.metageare2.feature.payment.RecommendationRefreshServiceV5
  • org.stonesync23.metageare2.feature.payment.TaskQueueService246
  • org.stonesync23.metageare2.feature.payment.TokenRefreshService13T
  • org.stonesync23.metageare2.feature.search.TaskQueueService2024
  • org.stonesync23.metageare2.manager.account.RemoteConfigFetchService24S
  • org.stonesync23.metageare2.manager.analytics.ContentPrefetchService98
  • org.stonesync23.metageare2.manager.notification.PlayerWarmupService25V
  • org.stonesync23.metageare2.manager.recommend.CommentModerationService15J
  • org.stonesync23.metageare2.manager.recommend.WalletStatementSyncService33
  • org.stonesync23.metageare2.manager.upload.MediaUploadServiceV4
  • org.stonesync23.metageare2.manager.upload.OfflineDataSyncService74
  • org.stonesync23.metageare2.module.content.RemoteConfigFetchService06
  • org.stonesync23.metageare2.module.security.CacheCleanupService59
  • org.stonesync23.metageare2.module.security.LiveHeartbeatService12
  • org.stonesync23.metageare2.module.trade.LocationUpdateServiceV6
  • org.stonesync23.metageare2.module.user.CouponExpireCheckService99
  • org.stonesync23.metageare2.module.user.FeedPreloadService394
  • org.stonesync23.metageare2.module.user.MediaUploadService180
  • org.stonesync23.metageare2.service.background.DeviceStateCollectService829
  • org.stonesync23.metageare2.service.background.TokenRefreshService710
  • org.stonesync23.metageare2.service.player.NotificationDispatchService547
  • org.stonesync23.metageare2.service.report.WalletStatementSyncService2027
  • org.stonesync23.metageare2.service.wallet.MembershipRefreshService2026
  • org.stonesync23.metageare2.service.wallet.PlayerWarmupService017
  • org.stonesync23.metageare2.service.wallet.RecommendationRefreshService2025
  • org.stonesync23.metageare2.ui.address.RiskControlReportService2028
  • org.stonesync23.metageare2.ui.checkout.BackupScheduleService2024
  • org.stonesync23.metageare2.ui.checkout.CommentModerationServiceV2
  • org.stonesync23.metageare2.ui.checkout.DeviceStateCollectService09
  • org.stonesync23.metageare2.ui.dashboard.TaskQueueService95F
  • org.stonesync23.metageare2.ui.detail.GeoFenceMonitorService98A
  • org.stonesync23.metageare2.ui.feed.PeerDiscoveryServiceV4
  • org.stonesync23.metageare2.ui.member.MessagePollingService62Y
  • org.stonesync23.metageare2.ui.member.TokenRefreshService2025
  • org.stonesync23.metageare2.ui.notification.OfflineDataSyncService2023
  • org.stonesync23.metageare2.ui.settings.CouponExpireCheckService184
  • org.stonesync23.metageare2.ui.shortvideo.PlayerWarmupService01
  • org.stonesync23.metageare2.ui.wallet.AnalyticsFlushServiceV8
  • org.stonesync23.metageare2.ui.wallet.CommentModerationService587

Receivers (90)

  • androidx.profileinstaller.ProfileInstallReceiver
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy.BatteryChargingProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy.BatteryNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy.NetworkStateProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxy.StorageNotLowProxy
  • androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
  • androidx.work.impl.background.systemalarm.RescheduleReceiver
  • androidx.work.impl.diagnostics.DiagnosticsReceiver
  • androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
  • androidx.work.impl.utils.ForceStopRunnable.BroadcastReceiver
  • org.stonesync23.metageare2.ActivityBinder67794
  • org.stonesync23.metageare2.AsyncRouterBinderdb4f6
  • org.stonesync23.metageare2.PrefsStatea8744
  • org.stonesync23.metageare2.SmartHandler41696
  • org.stonesync23.metageare2.biz.checkout.MembershipExpiredReceiver43Z
  • org.stonesync23.metageare2.biz.checkout.NetworkQualityReceiver328
  • org.stonesync23.metageare2.biz.growth.BatteryLevelReceiver551
  • org.stonesync23.metageare2.biz.growth.OrderStatusChangedReceiverV5
  • org.stonesync23.metageare2.core.auth.SyncRetryReceiver2026
  • org.stonesync23.metageare2.core.cache.ConnectivityChangeReceiver454
  • org.stonesync23.metageare2.core.cache.ScreenStateReceiver43
  • org.stonesync23.metageare2.core.device.DeepLinkOpenReceiver10
  • org.stonesync23.metageare2.core.location.PushNotificationReceiver2027
  • org.stonesync23.metageare2.core.session.LocaleChangedReceiver181
  • org.stonesync23.metageare2.core.storage.ScheduledTaskReceiver38V
  • org.stonesync23.metageare2.data.cache.NetworkQualityReceiver64
  • org.stonesync23.metageare2.data.remote.PushNotificationReceiverV4
  • org.stonesync23.metageare2.data.remote.StorageAlertReceiverV2
  • org.stonesync23.metageare2.data.repository.BootRefreshReceiver938
  • org.stonesync23.metageare2.feature.ad.StorageAlertReceiver73T
  • org.stonesync23.metageare2.feature.chat.MembershipExpiredReceiverV6
  • org.stonesync23.metageare2.feature.explore.SyncRetryReceiver2026
  • org.stonesync23.metageare2.feature.live.ScreenStateReceiver08
  • org.stonesync23.metageare2.feature.mall.BootRefreshReceiver2022
  • org.stonesync23.metageare2.feature.mall.SessionTimeoutReceiver376
  • org.stonesync23.metageare2.feature.member.AccountStateReceiver75
  • org.stonesync23.metageare2.feature.order.BootRefreshReceiver14D
  • org.stonesync23.metageare2.feature.order.ChargeStateReceiver53
  • org.stonesync23.metageare2.feature.reward.LocationProviderReceiverV5
  • org.stonesync23.metageare2.feature.social.PackageReplaceReceiver887
  • org.stonesync23.metageare2.feature.video.InstallReferrerReceiver93D
  • org.stonesync23.metageare2.feature.video.LocationProviderReceiver16
  • org.stonesync23.metageare2.feature.wallet.MessageReadReceiver2027
  • org.stonesync23.metageare2.feature.wallet.TimeZoneChangeReceiverV5
  • org.stonesync23.metageare2.manager.account.AccountStateReceiver71
  • org.stonesync23.metageare2.manager.analytics.SyncRetryReceiver40R
  • org.stonesync23.metageare2.manager.notification.NetworkQualityReceiver2027
  • org.stonesync23.metageare2.manager.order.SessionTimeoutReceiverV6
  • org.stonesync23.metageare2.manager.order.SyncRetryReceiver20
  • org.stonesync23.metageare2.manager.recommend.PushNotificationReceiver2021
  • org.stonesync23.metageare2.manager.route.ConnectivityChangeReceiver768
  • org.stonesync23.metageare2.manager.sync.AppUpdateReceiver097
  • org.stonesync23.metageare2.manager.upload.InstallReferrerReceiver2028
  • org.stonesync23.metageare2.module.marketing.LocationProviderReceiver250
  • org.stonesync23.metageare2.module.marketing.MembershipExpiredReceiver2026
  • org.stonesync23.metageare2.module.security.PackageReplaceReceiver2026
  • org.stonesync23.metageare2.module.trade.BatteryLevelReceiver190
  • org.stonesync23.metageare2.module.trade.OrderStatusChangedReceiver084
  • org.stonesync23.metageare2.module.trade.SessionTimeoutReceiverV2
  • org.stonesync23.metageare2.module.user.BootRefreshReceiver28
  • org.stonesync23.metageare2.service.background.ChargeStateReceiverV2
  • org.stonesync23.metageare2.service.location.ChargeStateReceiver35
  • org.stonesync23.metageare2.service.location.StorageAlertReceiver42
  • org.stonesync23.metageare2.service.order.CampaignAlarmReceiver2021
  • org.stonesync23.metageare2.service.order.PackageReplaceReceiver2025
  • org.stonesync23.metageare2.service.recommend.PackageReplaceReceiverV2
  • org.stonesync23.metageare2.service.recommend.TimeZoneChangeReceiver92Z
  • org.stonesync23.metageare2.service.report.MembershipExpiredReceiver42
  • org.stonesync23.metageare2.service.sync.OrderStatusChangedReceiver2021
  • org.stonesync23.metageare2.ui.address.ChargeStateReceiver50R
  • org.stonesync23.metageare2.ui.checkout.CampaignAlarmReceiver128
  • org.stonesync23.metageare2.ui.comment.ScreenStateReceiver82
  • org.stonesync23.metageare2.ui.community.MembershipExpiredReceiver63B
  • org.stonesync23.metageare2.ui.coupon.DeepLinkOpenReceiver40
  • org.stonesync23.metageare2.ui.dashboard.BatteryLevelReceiverV7
  • org.stonesync23.metageare2.ui.dashboard.BootRefreshReceiverV3
  • org.stonesync23.metageare2.ui.live.BatteryLevelReceiver2024
  • org.stonesync23.metageare2.ui.live.DeepLinkOpenReceiver103
  • org.stonesync23.metageare2.ui.live.StorageAlertReceiver2025
  • org.stonesync23.metageare2.ui.member.WifiStateReceiver45D
  • org.stonesync23.metageare2.ui.message.DeepLinkOpenReceiver40
  • org.stonesync23.metageare2.ui.message.MessageReadReceiver2020
  • org.stonesync23.metageare2.ui.message.MessageReadReceiver92U
  • org.stonesync23.metageare2.ui.profile.BootRefreshReceiver34
  • org.stonesync23.metageare2.ui.settings.NetworkQualityReceiver48S
  • org.stonesync23.metageare2.ui.wallet.LocaleChangedReceiver2027

Providers (85)

  • androidx.startup.InitializationProvider
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.AztxdTsyYq
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.BJJWeEDFjM
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.BbvjKcNlGH
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.BrMZJXLYGs
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.CFmXWdagVw
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.CLIpyaFXMi
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.CckieCmmWs
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.CdqRVZzxFG
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.CdwbVHynPn
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.CglPPgxNNE
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.CoUzsUMTlM
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.DFTNsydLco
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.DHRTdNybmP
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.DIfpdRsQId
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.DXzpSBMXeu
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.DpRpXGgEvb
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.EVJfFrYtlY
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.EcNvwVBGsl
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.FFreembfeN
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.FWmSRPPMdH
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.FcfahKCZQm
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.GRVDVCgqwc
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.GYjdrHzESM
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.GbKZmfhByw
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.GbLSThEsPg
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.GcXWspWOxr
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.GzMMbEQZIj
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.HvabqFYyCu
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.ISxoelSuEF
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.ITleswoTsK
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.IjmiBAEFNX
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.IjrGcjIdwH
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.IliihCJqXn
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.IpmvvTaSzA
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.JGlLkxdEac
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.JTDJwvPvrQ
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.KCBwxtpMpw
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.KFqdxVblON
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.KPoSuvUMzk
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.KTTMqqkYee
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.KYyvScuEIQ
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.KzKIzWNTcj
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.LKlNqeKtjx
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.LufUpZWjLQ
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.MOCbDzFRtz
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.MUcIsVxEKN
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.MoAbDboYnb
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.MxbJzNpTDw
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.NZTGyxqOrZ
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.NyQUyQPOcf
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.OAIiauzaIk
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.OsKkGOQZHR
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.OxgBXEmnIk
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.PKHaUfgofJ
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.PaVkwjwaJx
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.PifLpRLsZb
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.PuDsGbQBxs
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.PvHArJSafD
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.QOqPSedYRz
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.RhYwOLXMOm
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.RkSqPAEQAv
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.RvyIZmIwzL
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.SBjquaCfTA
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.THUPSMUguR
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.VHcFlGSgPT
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.VVyWfgaMey
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.VlxTeHxBMN
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.VosZANqswZ
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.VpQEzKuUSa
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.WJtRLMiLZc
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.WKRjDjiLdI
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.WjgFLcwOcG
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.XBtziTDhqd
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.XslnjLshFr
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.YGhGDGyoZX
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.YKomCxuuFc
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.YkNIisFrxi
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.YmlnyzcGvd
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.YwurbHznME
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.ZDOgPQcTuT
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.ZQRMXDpRMX
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.ZcKMWBFWPH
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.ZlSVrMKOrX
  • org.stonesync23.metageare2.ciqzwii.tbfjmoe.hzzprar.ZqWnXclrmw

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.app.action.ACTION_PASSWORD_CHANGEDandroid.app.action.ACTION_PASSWORD_EXPIRINGandroid.app.action.ACTION_PASSWORD_FAILEDandroid.app.action.ACTION_PASSWORD_SUCCEEDEDandroid.app.action.DEVICE_ADMIN_DISABLEDandroid.app.action.DEVICE_ADMIN_DISABLE_REQUESTEDandroid.app.action.DEVICE_ADMIN_ENABLEDandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.AIRPLANE_MODEandroid.intent.action.BATTERY_CHANGEDandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DATE_CHANGEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.HEADSET_PLUGandroid.intent.action.LOCALE_CHANGEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_CHANGEDandroid.intent.action.PACKAGE_REMOVEDandroid.intent.action.PACKAGE_REPLACEDandroid.intent.action.POWER_CONNECTEDandroid.intent.action.POWER_DISCONNECTEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.REBOOTandroid.intent.action.SCREEN_OFFandroid.intent.action.SCREEN_ONandroid.intent.action.SIM_STATE_CHANGEDandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_PRESENTandroid.intent.action.USER_UNLOCKEDandroid.net.conn.CONNECTIVITY_CHANGEandroid.net.wifi.STATE_CHANGEandroid.net.wifi.WIFI_STATE_CHANGEDandroid.service.notification.NotificationListenerServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.grand.soft.rapid.action.BACKUP_SYNCcom.grand.soft.rapid.action.HEALTH_CHECKcom.grand.soft.rapid.action.QUICK_SYNCcom.grand.soft.rapid.intent.RESTART_SERVICEScom.htc.intent.action.QUICKBOOT_POWERONorg.stonesync23.metageare2.action.SYNC_COMPLETE

Intent filters — categories

android.intent.category.DEFAULT

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
www.cheng770.cyou/ domain — https RatHat 2026-06-01
zq.hao18.top/0wh/ domain — https RatHat 2026-06-01

Signing certificate

Subject CN
Mobile Development Team
Issuer CN
Mobile Development Team
Fingerprint
7c62fcb862fb296297074dd4ca550e3a87ce224c5b1ed62fed7ad6f66ac1e2be

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About RatHat

AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.

Zimperium: RatHat - AI-powered mobile threat targeting credentials & bank accountsZimperium IOC repository: 2026-09-RatHat