207.56.28.183:8889
ip C2Tracked by C2 Tracker · Updated as of 2026-10-11 · Whois queried 2026-10-05T10:38:01
Network
- Network
- NTTA-207-56
- CIDR
- 207.56.0.0/15
- Country
- US
Contact
- Handle
- NET-207-56-0-0-1
- Abuse
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| RatHat | cf6fab86b34e… | C2 | 2026-09-09 |
About RatHat
AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (`Tether`, `ReelShort` lures). It serialises the live Accessibility tree to XML and queries Google **Gemini** to resolve on-screen targets and drive synthetic clicks - letting it read and operate banking and wallet apps on the victim's behalf without a human operator. Heavily hardened against analysis: a ~61 MB `AndroidManifest.xml` padded with `0x9999`-byte junk chunks, DEX poisoning (deliberately malformed bytecode that breaks naïve disassemblers), `StringFog`/`StringCrypto` string encryption and ZIP tampering. Configuration lives in a **ZM26 container** under `assets/` - RatHat's own encrypted-blob format: a 4-byte `ZM26` magic, an 8-byte salt, then the payload XOR'd with a repeating 24-byte key (the per-sample `xor_key` from `assets/zm26_meta.json`, concatenated with that salt). The C2 is the `serverUrl` field of `server_config.json` - recoverable in plaintext in some builds, `ZM26`-encrypted in others. The primary FRP tunnel C2 is not a static indicator: it is fetched at runtime by the bundled Go agent `liblocal-service.so`, while `libmedia_codec.so` masquerades as the `frpc` tunnel client.
Signing certificate
- Subject CN
- Debug
- Issuer CN
- Debug
- Valid
- 2026-06-28 → 2053-11-13
- Fingerprint
- 8a9e2e175d2ea4a41bf013985c26265b0934c5ab10f575d5377db2998a6ec170
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.