RatHat

AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (Tether, ReelShort lures). It serialises the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks - letting it read and operate banking and wallet apps on the victim’s behalf without a human operator. Heavily hardened against analysis: a ~61 MB AndroidManifest.xml padded with 0x9999-byte junk chunks, DEX poisoning (deliberately malformed bytecode that breaks naïve disassemblers), StringFog/StringCrypto string encryption and ZIP tampering. Configuration lives in a ZM26 container under assets/ - RatHat’s own encrypted-blob format: a 4-byte ZM26 magic, an 8-byte salt, then the payload XOR’d with a repeating 24-byte key (the per-sample xor_key from assets/zm26_meta.json, concatenated with that salt). The C2 is the serverUrl field of server_config.json - recoverable in plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is not a static indicator: it is fetched at runtime by the bundled Go agent liblocal-service.so, while libmedia_codec.so masquerades as the frpc tunnel client.