cocoacider.cc/
domain C2Tracked by C2 Tracker · Updated as of 2026-10-11 · Whois queried 2026-10-05T10:38:01
Registration
- Registrar
- Gname.com Pte. Ltd.
- Registered
- 2026-08-21T03:07:19Z
- Expires
- 2027-08-21T03:07:19Z
DNS
- Resolves to
- 156.234.67.20, 156.234.67.21, 156.234.84.143, 156.234.84.144, 156.234.84.147, 156.234.84.148, 156.234.84.149, 172.247.99.130, 172.247.99.131, 172.247.99.132, 172.247.99.133, 172.247.99.134, 23.225.249.20, 23.225.249.21, 23.225.249.22, 23.248.229.201, 23.248.229.202, 23.248.229.203
- Nameservers
- DEREK.NS.CLOUDFLARE.COM, HEATHER.NS.CLOUDFLARE.COM
- Status
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| RatHat | cf6fab86b34e… | C2 | 2026-09-09 |
About RatHat
AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (`Tether`, `ReelShort` lures). It serialises the live Accessibility tree to XML and queries Google **Gemini** to resolve on-screen targets and drive synthetic clicks - letting it read and operate banking and wallet apps on the victim's behalf without a human operator. Heavily hardened against analysis: a ~61 MB `AndroidManifest.xml` padded with `0x9999`-byte junk chunks, DEX poisoning (deliberately malformed bytecode that breaks naïve disassemblers), `StringFog`/`StringCrypto` string encryption and ZIP tampering. Configuration lives in a **ZM26 container** under `assets/` - RatHat's own encrypted-blob format: a 4-byte `ZM26` magic, an 8-byte salt, then the payload XOR'd with a repeating 24-byte key (the per-sample `xor_key` from `assets/zm26_meta.json`, concatenated with that salt). The C2 is the `serverUrl` field of `server_config.json` - recoverable in plaintext in some builds, `ZM26`-encrypted in others. The primary FRP tunnel C2 is not a static indicator: it is fetched at runtime by the bundled Go agent `liblocal-service.so`, while `libmedia_codec.so` masquerades as the `frpc` tunnel client.
Signing certificate
- Subject CN
- Debug
- Issuer CN
- Debug
- Valid
- 2026-06-28 → 2053-11-13
- Fingerprint
- 8a9e2e175d2ea4a41bf013985c26265b0934c5ab10f575d5377db2998a6ec170
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.