zq.hao18.top/0wh/
domain C2Tracked by C2 Tracker · Updated as of 2026-10-11 · Whois queried 2026-10-05T10:38:02
Registration
- Registrar
- -
- Registered
- -
- Expires
- -
DNS
- Resolves to
- 104.21.33.28, 172.67.140.187
- Nameservers
- -
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| RatHat | f179f0a98187… | C2 | 2026-06-01 |
About RatHat
AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (`Tether`, `ReelShort` lures). It serialises the live Accessibility tree to XML and queries Google **Gemini** to resolve on-screen targets and drive synthetic clicks - letting it read and operate banking and wallet apps on the victim's behalf without a human operator. Heavily hardened against analysis: a ~61 MB `AndroidManifest.xml` padded with `0x9999`-byte junk chunks, DEX poisoning (deliberately malformed bytecode that breaks naïve disassemblers), `StringFog`/`StringCrypto` string encryption and ZIP tampering. Configuration lives in a **ZM26 container** under `assets/` - RatHat's own encrypted-blob format: a 4-byte `ZM26` magic, an 8-byte salt, then the payload XOR'd with a repeating 24-byte key (the per-sample `xor_key` from `assets/zm26_meta.json`, concatenated with that salt). The C2 is the `serverUrl` field of `server_config.json` - recoverable in plaintext in some builds, `ZM26`-encrypted in others. The primary FRP tunnel C2 is not a static indicator: it is fetched at runtime by the bundled Go agent `liblocal-service.so`, while `libmedia_codec.so` masquerades as the `frpc` tunnel client.
Signing certificate
- Subject CN
- Mobile Development Team
- Issuer CN
- Mobile Development Team
- Valid
- 2023-11-01 → 2054-01-05
- Fingerprint
- 7c62fcb862fb296297074dd4ca550e3a87ce224c5b1ed62fed7ad6f66ac1e2be
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.