784dadd0653a2816718cd300…
sampleTracked by C2 Tracker · indicators & metadata only, the APK itself is never published
Analyst notes
Tether, ReelShort lures). It serialises the live Accessibility tree to XML and queries Google Gemini to resolve on-screen targets and drive synthetic clicks - letting it read and operate banking and wallet apps on the victim’s behalf without a human operator. Heavily hardened against analysis: a ~61 MB AndroidManifest.xml padded with 0x9999-byte junk chunks, DEX poisoning (deliberately malformed bytecode that breaks naïve disassemblers), StringFog/StringCrypto string encryption and ZIP tampering. Configuration lives in a ZM26 container under assets/ - RatHat’s own encrypted-blob format: a 4-byte ZM26 magic, an 8-byte salt, then the payload XOR’d with a repeating 24-byte key (the per-sample xor_key from assets/zm26_meta.json, concatenated with that salt). The C2 is the serverUrl field of server_config.json - recoverable in plaintext in some builds, ZM26-encrypted in others. The primary FRP tunnel C2 is not a static indicator: it is fetched at runtime by the bundled Go agent liblocal-service.so, while libmedia_codec.so masquerades as the frpc tunnel client. Indicators: api.rathat.live, admin.rathat.live.Identification
- SHA-256
- 784dadd0653a2816718cd3002a7b032ad497316ab90e08f6d1b874be25b50019
- MD5
- f83357b2d47c7d38ee53943373961211
Observed
- Families
- RatHat
- First seen
- 2025-12-10
APK metadata
Summary
- Type
- Android · APK
- Package
- com.wallet.android
- Main activity
- com.guard.wallet.activity.MainActivity
- Internal version
- 2
- Displayed version
- 2.0
- Min SDK
- 24
- Target SDK
- 35
Signing certificate
- Valid from
- 2025-10-09 12:23:06
- Valid to
- 2107-11-29 12:23:06
- Serial
- 6a218595
- Thumbprint
- e70a984209a0889e0a66cff1786eacadd4c69f32
- Subject
- C:US, CN:com.wallet.android, L:HongKong, O:com.wallet.android, ST:HongKong, OU:com.wallet.android
- Issuer
- C:US, CN:com.wallet.android, L:HongKong, O:com.wallet.android, ST:HongKong, OU:com.wallet.android
Permissions (116)
Intent filters - actions
C2 configuration (2)
Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.
| Indicator | Type | Port | Scheme | Family | First seen |
|---|---|---|---|---|---|
| admin.rathat.live | domain | - | - | RatHat | 2025-12-10 |
| api.rathat.live | domain | - | - | RatHat | 2025-12-10 |
Signing certificate
- Subject CN
- com.wallet.android
- Issuer CN
- com.wallet.android
- Fingerprint
- c4d43b50b117983edee6dc72ce96117069bf7076e4e00a6f88a66ba3eb824944
Relationships
Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.
Click a node to inspect it.
About RatHat
AI-powered Android credential stealer / RAT (Zimperium, Sep 2026) posing as reward or finance apps (`Tether`, `ReelShort` lures). It serialises the live Accessibility tree to XML and queries Google **Gemini** to resolve on-screen targets and drive synthetic clicks - letting it read and operate banking and wallet apps on the victim's behalf without a human operator. Heavily hardened against analysis: a ~61 MB `AndroidManifest.xml` padded with `0x9999`-byte junk chunks, DEX poisoning (deliberately malformed bytecode that breaks naïve disassemblers), `StringFog`/`StringCrypto` string encryption and ZIP tampering. Configuration lives in a **ZM26 container** under `assets/` - RatHat's own encrypted-blob format: a 4-byte `ZM26` magic, an 8-byte salt, then the payload XOR'd with a repeating 24-byte key (the per-sample `xor_key` from `assets/zm26_meta.json`, concatenated with that salt). The C2 is the `serverUrl` field of `server_config.json` - recoverable in plaintext in some builds, `ZM26`-encrypted in others. The primary FRP tunnel C2 is not a static indicator: it is fetched at runtime by the bundled Go agent `liblocal-service.so`, while `libmedia_codec.so` masquerades as the `frpc` tunnel client.