Cybersecurity experts have identified a sophisticated new Android malware, dubbed RatHat, believed to be operated by threat actors based in China. This malware employs an advanced artificial intelligence (AI) system designed to navigate and control compromised devices with alarming efficiency.
Distribution and Infection Tactics
According to researchers from Zimperium, including Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega, RatHat is primarily disseminated through targeted smishing (SMS phishing) and malvertising campaigns that lead users to deceptive third-party download portals. The malware utilizes an automated, multi-stage infection pipeline to infiltrate devices.
Once installed, RatHat exploits Accessibility features in conjunction with an autonomous local ADB (Android Debug Bridge) self-pairing mechanism. This allows it to escape the confines of the standard Android application sandbox, creating independent native daemons that operate with shell-level privileges.
Stealthy Propagation Methods
RatHat’s propagation relies on misleading phishing sites promoted through malvertising, smishing campaigns, and various third-party forums. Unsuspecting users are tricked into downloading malware-laden APKs, which serve as droppers to initiate the main payload. These packages are fortified with multiple layers of anti-analysis and anti-debugging checks to evade detection.
The malware incorporates four notable anti-analysis techniques:
- Container tampering: This technique mislabels certain files as directories or sets the ZIP general-purpose encryption bit flag on specific files, causing them to be ignored by Android’s libziparchive library while remaining detectable by other tools.
- Manifest bomb: By inserting undocumented chunk headers into the “AndroidManifest.xml,” this tactic can cause automated analysis pipelines to crash or time out.
- DEX bytecode poisoning: This involves the use of pseudo-instructions with an invalid element_width attribute, leading to failures during the disassembly process.
- Dual string-encryption: Utilizing an encryption scheme known as StringCrypto: Base64, this method resists analysis efforts.
Malware Architecture and Functionality
The architecture of RatHat consists of three primary components: a malicious Android application, a Go agent, and an FRP reverse-proxy client. The Android application serves as a gateway to obtain critical system permissions, enabling it to launch subsequent phases of the attack. This includes gaining accessibility services permissions, unlocking Developer Options, enabling Wireless Debugging, and extracting the 6-digit ADB pairing code.
Once operational, the malware can overlay specific applications to capture credentials, record screens using Android’s MediaProjection API, intercept SMS messages, and even present a fake failure overlay that impersonates the Google Play Store during installation attempts.
Even if a victim successfully uninstalls the malware, the attacker retains shell access to the device. This allows them to check for the malware’s presence and reinstall it if necessary.
Remarkably, RatHat can serialize the device’s live Accessibility tree to XML and communicate with one of the world’s most popular Generative AI assistants. This AI is employed for benign tasks such as determining a target’s screen coordinates in JSON format for synthetic clicks and extracting on-screen text from the XML to facilitate automatic navigation commands.
Command-and-Control Capabilities
The Go Agent, executed by the APK, masquerades as a native library (“liblocal-service.so”) and exploits the shell access gained through the local ADB daemon to execute commands. This capability enables the malware to establish persistence and apply power management exemptions. The FRP client is responsible for creating a secure, reverse tunnel to a command-and-control (C2) server.
As the Go Agent retrieves the FRP tunnel configuration from the C2 server, it allows the FRP Client to maintain a persistent, active reverse tunnel to the operator. This connection provides attackers with access to the ADB daemon, serving as a versatile entry point into the device, independent of the malware’s inherent feature set.
The commands issued by the C2 server are extensive and feature-rich, enabling threat actors to collect SMS messages, credentials, files, lock screen PINs, patterns, or passwords, screen captures, keystrokes (including URLs entered in web browsers), and a list of installed applications. Additionally, RatHat includes a hardware-level keylogger executed by the Go Agent, capable of recording finger presses on the screen.
In summary, RatHat’s intricate architecture, reliance on out-of-lifecycle daemons, and incorporation of real-time GenAI decision loops underscore the inadequacy of traditional, signature-based mobile security measures in combating such advanced threats.
