Malware

RatHat

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.008MalvertisingEvidence1

RatHat is primarily distributed through deceptive phishing sites promoted via malvertising.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, smishing campaigns, and third-party forums.

Persistence

2 techniques

T1546Event Triggered ExecutionEvidence1

The malware monitors the foreground application and, upon detecting a targeted package, triggers the corresponding HTML injection mechanism.

T1547Boot or Logon Autostart ExecutionEvidence1

The local-service is running outside the package lifecycle... if the app is not confirmed, then the app is reinstalled... granting every runtime permission automatically and re-granting Accessibility.

Privilege Escalation

4 techniques

T1546Event Triggered ExecutionEvidence1

The malware monitors the foreground application and, upon detecting a targeted package, triggers the corresponding HTML injection mechanism.

T1547Boot or Logon Autostart ExecutionEvidence1

T1548.002Bypass User Account ControlEvidence1

Once the service is granted, SystemHelperService becomes the engine for every automated system change... Unlock Developer Options... Enable Wireless Debugging... scrape the 6-digit ADB Pairing Code and dynamic port.

T1548.004Elevated Execution with PromptEvidence1

The app can request Device Admin rights, which grants it the capability to wipe the device if an uninstall attempt is made.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

The dropper carries its payload in two encrypted assets... Stage 2 is an in-memory DEX loaded by reflection. General strings use StringFog... and the malware uses a StringCrypto scheme.

T1027.002Software PackingEvidence1

The container tampering layer consists of declaring some files as directories in the zip, or setting the ZIP general-purpose encryption bit on some files. These modifications are ignored by Android libziparchive but not by unzip, apktool and other tools.

T1036MasqueradingEvidence1

The APK poses as a well known streaming app, hiding behind that app's icon and label; configuration can enable an activity alias labeled 'Chrome.'

T1497Virtualization/Sandbox EvasionEvidence1

Xposed, root or emulator checks: 20 root paths and packages, three Xposed manager packages... Build fingerprint and QEMU device nodes.

T1622Debugger EvasionEvidence1

The malware contains six runtime checks for avoiding debugging: JDWP debugger check, ptrace attach check, FLAG_DEBUGGABLE, properties check, and Frida check.

Credential Access

3 techniques

T1056.001KeyloggingEvidence1

UniversalInputMonitor consumes accessibility text-change events and reconstructs what was typed... the Go Agent uses getevent to read raw device input and reconstruct PINs and unlock patterns from touch coordinates.

T1056.003Web Portal CaptureEvidence1

The malicious HTML content is supplied by the attacker and is associated with the targeted application, allowing the malware to present a deceptive interface over the legitimate application to capture sensitive banking credentials.

T1552.001Credentials In FilesEvidence1

An SMS receiver and notification listener work in tandem to intercept 2FA/OTP codes... /api/data/messages [carries] SMS bodies.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

Xposed, root or emulator checks: 20 root paths and packages, three Xposed manager packages... Build fingerprint and QEMU device nodes.

T1622Debugger EvasionEvidence1

The malware contains six runtime checks for avoiding debugging: JDWP debugger check, ptrace attach check, FLAG_DEBUGGABLE, properties check, and Frida check.

Collection

3 techniques

T1056.001KeyloggingEvidence1

T1056.003Web Portal CaptureEvidence1

T1113Screen CaptureEvidence1

Screen and Input Capture: A combination of MediaProjection Screen streaming and a Lock-screen credential capture mechanism... /api/v2/dev/data/screen-monitor [provides] shell-level screen monitoring.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

The Android App registers over HTTP, then holds a WebSocket open with heartbeats... The Go Agent spins up an HTTP server bound to 127.0.0.1:7910.

T1090ProxyEvidence1

The FRP Client establishes a secure, persistent reverse tunnel back to the C2 server... to expose the internal loopback server and local device interfaces to the internet, bypassing NAT and firewall restrictions.

T1219Remote Access ToolsEvidence1

The application authenticates against the local device's ADB daemon, thereby securing shell-level access... staging and launching both the Go Agent and the FRP Client.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Endpoints carry overlay-harvested credentials, lock-screen credential sync, SMS bodies, installed-application inventory, files, ADB certificates, logs, screen-monitoring data, and chunked video uploads.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

pm disable-user --user 0 %s allows the operator to disable arbitrary packages on the system; pm uninstall -k --user 0 %s allows full uninstallation of security or other packages.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

zimperium blogNews

Sep 16, 2026

RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts

Android financial spyware and remote-access malware that uses Accessibility abuse and autonomous wireless-ADB pairing to escape normal application-sandbox restrictions and execute shell-level daemons. It steals banking, payment, lock-screen, and browser credentials through overlays, SMS/notification interception, Accessibility keylogging, screen capture, and raw touch-coordinate capture from /dev/input. It persists through an out-of-package Go service that can reinstall the APK and uses an FRP reverse tunnel for durable operator access. The malware also uses generative-AI-assisted UI automation.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

RatHat

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.008MalvertisingEvidence1

RatHat is primarily distributed through deceptive phishing sites promoted via malvertising.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

RatHat is primarily distributed through deceptive phishing sites promoted via malvertising, smishing campaigns, and third-party forums.

Persistence

2 techniques

T1546Event Triggered ExecutionEvidence1

The malware monitors the foreground application and, upon detecting a targeted package, triggers the corresponding HTML injection mechanism.

T1547Boot or Logon Autostart ExecutionEvidence1

Privilege Escalation

4 techniques

T1546Event Triggered ExecutionEvidence1

The malware monitors the foreground application and, upon detecting a targeted package, triggers the corresponding HTML injection mechanism.

T1547Boot or Logon Autostart ExecutionEvidence1

T1548.002Bypass User Account ControlEvidence1

T1548.004Elevated Execution with PromptEvidence1

The app can request Device Admin rights, which grants it the capability to wipe the device if an uninstall attempt is made.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

The dropper carries its payload in two encrypted assets... Stage 2 is an in-memory DEX loaded by reflection. General strings use StringFog... and the malware uses a StringCrypto scheme.

T1027.002Software PackingEvidence1

T1036MasqueradingEvidence1

The APK poses as a well known streaming app, hiding behind that app's icon and label; configuration can enable an activity alias labeled 'Chrome.'

T1497Virtualization/Sandbox EvasionEvidence1

Xposed, root or emulator checks: 20 root paths and packages, three Xposed manager packages... Build fingerprint and QEMU device nodes.

T1622Debugger EvasionEvidence1

The malware contains six runtime checks for avoiding debugging: JDWP debugger check, ptrace attach check, FLAG_DEBUGGABLE, properties check, and Frida check.

Credential Access

3 techniques

T1056.001KeyloggingEvidence1

T1056.003Web Portal CaptureEvidence1

T1552.001Credentials In FilesEvidence1

An SMS receiver and notification listener work in tandem to intercept 2FA/OTP codes... /api/data/messages [carries] SMS bodies.

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

Xposed, root or emulator checks: 20 root paths and packages, three Xposed manager packages... Build fingerprint and QEMU device nodes.

T1622Debugger EvasionEvidence1

The malware contains six runtime checks for avoiding debugging: JDWP debugger check, ptrace attach check, FLAG_DEBUGGABLE, properties check, and Frida check.

Collection

3 techniques

T1056.001KeyloggingEvidence1

T1056.003Web Portal CaptureEvidence1

T1113Screen CaptureEvidence1

Screen and Input Capture: A combination of MediaProjection Screen streaming and a Lock-screen credential capture mechanism... /api/v2/dev/data/screen-monitor [provides] shell-level screen monitoring.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

The Android App registers over HTTP, then holds a WebSocket open with heartbeats... The Go Agent spins up an HTTP server bound to 127.0.0.1:7910.

T1090ProxyEvidence1

T1219Remote Access ToolsEvidence1

The application authenticates against the local device's ADB daemon, thereby securing shell-level access... staging and launching both the Go Agent and the FRP Client.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

pm disable-user --user 0 %s allows the operator to disable arbitrary packages on the system; pm uninstall -k --user 0 %s allows full uninstallation of security or other packages.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

zimperium blogNews

Sep 16, 2026

RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.