Full Report
Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses
Analysis Summary
# Tool/Technique: RatHat
## Overview
RatHat is a sophisticated Android malware family, assessed to be operated by China-based threat actors. It is notable for its use of an AI-powered system to navigate compromised devices and its ability to abuse local Android Debug Bridge (ADB) pairing to maintain persistent shell access, even if the primary application is uninstalled.
## Technical Details
- **Type:** Malware family (Android Trojan/RAT)
- **Platform:** Android
- **Capabilities:** AI-driven UI navigation, ADB self-pairing, persistence via native daemons, credential harvesting (overlays), screen recording, SMS interception, and hardware-level keylogging.
- **First Seen:** September 2026 (Reported)
## MITRE ATT&CK Mapping
- **TA0031 - Initial Access**
- T1516 - Ad Injection (Malvertising)
- T1636.004 - SMS Phishing (Smishing)
- **TA0032 - Persistence**
- T1626 - Abuse Accessibility Services
- T1544 - External Debugging (ADB Abuse)
- **TA0034 - Defense Evasion**
- T1406 - Obfuscated Files or Information
- T1622 - Software Discovery (Anti-analysis/Anti-debug)
- **TA0035 - Detection Evasion**
- T1624 - Event Triggered Execution
- **TA0037 - Command and Control**
- T1090 - Proxy (FRP Reverse Tunnel)
- **TA0030 - Exfiltration**
- T1643 - Screen Capture
- T1639 - SMS Interception
## Functionality
### Core Capabilities
- **ADB Self-Pairing:** Automates the extraction of the 6-digit ADB pairing code and enables Wireless Debugging to break out of the Android app sandbox.
- **Persistence:** Deploys independent native daemons (Go-based) that remain on the device after the APK is uninstalled.
- **Credential Theft:** Uses overlay attacks to steal banking and app credentials.
- **Information Stealing:** Intercepts SMS (for 2FA bypass), records screens via MediaProjection API, and logs keystrokes.
- **Reverse Tunneling:** Integrates a Fast Reverse Proxy (FRP) client to establish a secure C2 connection that bypasses firewalls.
### Advanced Features
- **AI-Powered Navigation:** Communicates with a popular Generative AI assistant to analyze the device's Accessibility tree (XML). The AI identifies screen coordinates for synthetic clicks and directs automated navigation (e.g., scrolling).
- **Multi-Stage Anti-Analysis:**
- **Manifest Bomb:** Uses undocumented 0x9999 chunk headers to crash analysis tools.
- **Container Tampering:** Sets ZIP encryption flags to hide files from Android's library while remaining accessible to the malware.
- **DEX Bytecode Poisoning:** Includes invalid pseudo-instructions to break disassemblers.
- **Dual Encryption:** Employs "StringCrypto" (Base64-based) to hide strings from static analysis.
## Indicators of Compromise
- **File Names:** `liblocal-service.so` (The Go agent masquerading as a library).
- **Network Indicators:** Uses FRP (Fast Reverse Proxy) protocols to communicate with C2 servers (specific IPs/domains not provided in the source; should be monitored for unusual outbound traffic on non-standard ports).
- **Behavioral Indicators:**
- Unauthorized enabling of "Developer Options" and "Wireless Debugging."
- Spontaneous execution of `adb` commands from local processes.
- Excessive Accessibility Service requests.
## Associated Threat Actors
- China-based threat actors (unnamed specific group).
## Detection Methods
- **Signature-based:** Detection of the `StringCrypto` encryption patterns and the specific FRP client configuration.
- **Behavioral detection:** Monitoring for the "Manifest bomb" chunk header (0x9999) in APKs and detecting unauthorized ADB pairing attempts from local applications.
- **Heuristic:** Identifying APKs that declare directories as files or use invalid `element_width` attributes in DEX bytecode.
## Mitigation Strategies
- **Prevention:** Disable "Developer Options" and "USB/Wireless Debugging" unless actively needed for development.
- **User Training:** Avoid sideloading APKs from third-party forums, smishing links, or malvertising pop-ups.
- **Policy:** Use Mobile Device Management (MDM) to restrict Accessibility Service permissions for non-whitelisted apps.
## Related Tools/Techniques
- **FRP (Fast Reverse Proxy):** A legitimate tool frequently repurposed by attackers for C2 tunneling.
- **GhostCtrl / AhMyth:** Other Android RATs that leverage similar information-stealing capabilities.
- **Accessibility Logging:** Common technique used by "TeaBot" or "Anatsa" for overlay attacks.