fd4e0923ac2d4efdb7a2070f…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

RatHat. Launcher package dev.griffincore7805.hydra. Operator handle sanjin. C2 https://andxxxo.com/ (plaintext assets/server_config.json). buildTime 2026-08-05T09:02:30Z. Distributed under an adult-content lure. No ZM26/ENC: layer on this build — the config ships in cleartext.

Identification

SHA-256: fd4e0923ac2d4efdb7a2070f0c9687c0fc0d4bb831fb0470e20c81764909392c
MD5: 228a4624b9b9731f4fbe537125321d53

Observed

Families: RatHat
First seen: 2026-08-05

APK metadata

Summary

Type: Android · APK
Package: dev.griffincore7805.hydra
Main activity: com.hikoncont.DefaultLauncherAlias
Internal version: 30805
Displayed version: 3.8.5
Min SDK: 24
Target SDK: 34

Signing certificate

Valid from: 2008-02-29 01:33:46
Valid to: 2035-07-17 01:33:46
Serial: 936eacbe07f201df
Thumbprint: 61ed377e85d386a8dfee6b864bd85b0bfaa5af81
Subject: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com
Subject email: android@android.com
Issuer: C:US, CN:Android, L:Mountain View, O:Android, ST:California, OU:Android, email:android@android.com

Permissions (75)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.AUTHENTICATE_ACCOUNTSandroid.permission.CAMERAandroid.permission.CHANGE_WIFI_STATEandroid.permission.DISABLE_KEYGUARDandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.FOREGROUND_SERVICE_MEDIA_PROJECTIONandroid.permission.FOREGROUND_SERVICE_SPECIAL_USEandroid.permission.GET_ACCOUNTSandroid.permission.GET_INSTALLED_APPSandroid.permission.INTERNETandroid.permission.KILL_BACKGROUND_PROCESSESandroid.permission.MANAGE_EXTERNAL_STORAGEandroid.permission.MEDIA_PROJECTIONandroid.permission.MODIFY_AUDIO_SETTINGSandroid.permission.POST_NOTIFICATIONSandroid.permission.QUERY_ALL_PACKAGESandroid.permission.QUICKBOOT_POWERONandroid.permission.READ_CONTACTSandroid.permission.READ_EXTERNAL_STORAGEandroid.permission.READ_MEDIA_AUDIOandroid.permission.READ_MEDIA_IMAGESandroid.permission.READ_MEDIA_VIDEOandroid.permission.READ_MEDIA_VISUAL_USER_SELECTEDandroid.permission.READ_PHONE_STATEandroid.permission.READ_SMSandroid.permission.READ_SYNC_SETTINGSandroid.permission.RECEIVE_BOOT_COMPLETEDandroid.permission.RECEIVE_SMSandroid.permission.RECORD_AUDIOandroid.permission.REORDER_TASKSandroid.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONSandroid.permission.SCHEDULE_EXACT_ALARMandroid.permission.SYSTEM_ALERT_WINDOWandroid.permission.TURN_SCREEN_ONandroid.permission.USE_BIOMETRICandroid.permission.USE_EXACT_ALARMandroid.permission.USE_FULL_SCREEN_INTENTandroid.permission.WAKE_LOCKandroid.permission.WRITE_EXTERNAL_STORAGEandroid.permission.WRITE_SECURE_SETTINGSandroid.permission.WRITE_SETTINGSandroid.permission.WRITE_SYNC_SETTINGScom.asus.mobilemanager.autostart.permission.ACCESScom.asus.mobilemanager.permission.ACCESScom.coloros.permission.SAFE_COMPONENTcom.google.android.c2dm.permission.RECEIVEcom.google.android.gms.permission.ACTIVITY_RECOGNITIONcom.heytap.permission.SAFE_COMPONENTcom.hihonor.permission.MANAGE_BACKGROUND_ACTIVITYcom.hikoncont.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONcom.huawei.android.launcher.permission.CHANGE_BADGEcom.huawei.permission.external_app_settings.USE_COMPONENTcom.infinix.permission.BACKGROUND_START_ACTIVITYcom.itel.permission.BACKGROUND_START_ACTIVITYcom.letv.android.permission.BACKGROUND_START_ACTIVITYcom.miui.permission.START_IN_BACKGROUNDcom.motorola.permission.BACKGROUND_START_ACTIVITYcom.nokia.permission.KEEP_ALIVEcom.realme.permission.SAFE_COMPONENTcom.samsung.android.app.routine.EXECUTEcom.samsung.android.permission.BACKGROUND_START_ACTIVITYcom.samsung.android.permission.MANAGE_ACTIVITY_PROTECTIONcom.samsung.android.sm.permission.KEEP_ALIVEcom.sec.android.provider.badge.permission.READcom.sec.android.provider.badge.permission.WRITEcom.tecno.permission.BACKGROUND_START_ACTIVITYcom.transsion.permission.AUTOSTARTcom.transsion.permission.MANAGE_BACKGROUNDcom.vivo.abe.permission.CLEAN_NOTIFICATIONcom.vivo.permission.manage.permission.ACCESScom.xiaomi.permission.BACKGROUND_START_ACTIVITYoppo.permission.OPPO_COMPONENT_SAFE

Activities (19)

com.google.android.gms.common.api.GoogleApiActivity
com.hikoncont.MainActivity
com.hikoncont.activity.AlipayPasswordActivity
com.hikoncont.activity.BackgroundTaskActivity
com.hikoncont.activity.CompatSetupActivity
com.hikoncont.activity.ConfigMaskActivity
com.hikoncont.activity.ConfirmDeviceActivity
com.hikoncont.activity.ContactsPermissionActivity
com.hikoncont.activity.PackageVerifyActivity
com.hikoncont.activity.ServiceConfigActivity
com.hikoncont.activity.SimplePermissionActivity
com.hikoncont.activity.StoragePermissionActivity
com.hikoncont.activity.TransparentHelperActivity
com.hikoncont.activity.WechatPasswordActivity
com.hikoncont.activity.WelcomeActivity
com.hikoncont.inject.HtmlInjectionActivity
com.hikoncont.service.modules.yw5xud.PermissionRequestActivity
com.hikoncont.ui.BlackScreenActivity
com.hikoncont.ui.PermissionRequestActivity

Services (19)

androidx.room.MultiInstanceInvalidationService
androidx.work.impl.background.systemalarm.SystemAlarmService
androidx.work.impl.background.systemjob.SystemJobService
androidx.work.impl.foreground.SystemForegroundService
com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
com.google.firebase.components.ComponentDiscoveryService
com.google.firebase.messaging.FirebaseMessagingService
com.hikoncont.activity.CoreSyncService
com.hikoncont.keepalive.guard.GuardService1
com.hikoncont.keepalive.guard.GuardService2
com.hikoncont.service.AppCoreService
com.hikoncont.service.InitWorkerService
com.hikoncont.service.MediaDisplayService
com.hikoncont.service.NotificationMonitorService
com.hikoncont.service.ServiceRestartJobService
com.hikoncont.service.SystemHelperService
com.hikoncont.service.account.AccountAuthenticatorService
com.hikoncont.service.account.AccountSyncService

Receivers (20)

androidx.profileinstaller.ProfileInstallReceiver
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy.BatteryChargingProxy
androidx.work.impl.background.systemalarm.ConstraintProxy.BatteryNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxy.NetworkStateProxy
androidx.work.impl.background.systemalarm.ConstraintProxy.StorageNotLowProxy
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.background.systemalarm.RescheduleReceiver
androidx.work.impl.diagnostics.DiagnosticsReceiver
androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
androidx.work.impl.utils.ForceStopRunnable.BroadcastReceiver
com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
com.google.firebase.iid.FirebaseInstanceIdReceiver
com.hikoncont.receiver.SmsReceiver
com.hikoncont.receiver.SystemStateReceiver
com.hikoncont.service.AlarmRestartReceiver
com.hikoncont.service.EnhancedPackagesReceiver

Providers (4)

androidx.startup.InitializationProvider
com.google.firebase.provider.FirebaseInitProvider
com.hikoncont.provider.EarlyInitProvider
com.hikoncont.service.account.StubContentProvider

Intent filters — actions

android.accessibilityservice.AccessibilityServiceandroid.accounts.AccountAuthenticatorandroid.content.SyncAdapterandroid.intent.action.ACTION_POWER_CONNECTEDandroid.intent.action.ACTION_POWER_DISCONNECTEDandroid.intent.action.ACTION_SHUTDOWNandroid.intent.action.BATTERY_LOWandroid.intent.action.BATTERY_OKAYandroid.intent.action.BOOT_COMPLETEDandroid.intent.action.DEVICE_STORAGE_LOWandroid.intent.action.DEVICE_STORAGE_OKandroid.intent.action.LOCKED_BOOT_COMPLETEDandroid.intent.action.MY_PACKAGE_REPLACEDandroid.intent.action.PACKAGE_ADDEDandroid.intent.action.PACKAGE_CHANGEDandroid.intent.action.PACKAGE_REMOVEDandroid.intent.action.PACKAGE_REPLACEDandroid.intent.action.QUICKBOOT_POWERONandroid.intent.action.SCREEN_ONandroid.intent.action.TIMEZONE_CHANGEDandroid.intent.action.TIME_SETandroid.intent.action.USER_PRESENTandroid.net.conn.CONNECTIVITY_CHANGEandroid.provider.Telephony.SMS_DELIVERandroid.provider.Telephony.SMS_RECEIVEDandroid.service.notification.NotificationListenerServiceandroidx.profileinstaller.action.BENCHMARK_OPERATIONandroidx.profileinstaller.action.INSTALL_PROFILEandroidx.profileinstaller.action.SAVE_PROFILEandroidx.profileinstaller.action.SKIP_FILEandroidx.work.diagnostics.REQUEST_DIAGNOSTICSandroidx.work.impl.background.systemalarm.UpdateProxiescom.google.android.c2dm.intent.RECEIVEcom.google.firebase.MESSAGING_EVENTcom.hikoncont.action.BACKUP_SYNCcom.hikoncont.action.HEALTH_CHECKcom.hikoncont.action.QUICK_SYNCcom.htc.intent.action.QUICKBOOT_POWERON

Intent filters — categories

android.intent.category.DEFAULT

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
andxxxo.com/	domain	—	https	RatHat	2026-08-05

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About RatHat

AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). Serializes the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks. Heavy anti-analysis: a ~61 MB manifest padded with 0x9999 chunks, DEX poisoning, StringFog/StringCrypto, ZIP tampering. Config lives in a ZM26 container under assets/ (zm26_meta.json + .bt files); the C2 is the serverUrl field of server_config.json - plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is fetched at runtime by the Go agent liblocal-service.so, with libmedia_codec.so masquerading the frpc client.

Zimperium: RatHat - AI-powered mobile threat targeting credentials & bank accounts Zimperium IOC repository: 2026-09-RatHat