Security experts have identified a new Android threat known as RatHat, believed to be operated by threat actors from China. This malware employs artificial intelligence to navigate and manipulate compromised devices, posing significant risks to users.
Distribution Methods and Infection Process
RatHat spreads primarily through targeted smishing and malvertising tactics, leading users to deceptive download portals. According to Zimperium researchers, this malware uses a multi-stage infection process, starting with accessibility abuse and ADB self-pairing to break out of Android’s application sandbox, executing commands with shell-level privileges.
The malware is delivered via phishing sites promoted through malicious ads and smishing. These sites trick users into downloading APK files that serve as droppers for the main payload, incorporating anti-analysis and anti-debugging techniques to evade detection.
Anti-Analysis Techniques Used by RatHat
RatHat employs several techniques to avoid detection. These include container tampering, which manipulates file directories, and a manifest bomb that disrupts automated analysis by altering the AndroidManifest.xml file. Additionally, DEX bytecode poisoning corrupts disassembly processes, while dual string-encryption protects against analysis.
The malware architecture comprises an Android app, a Go agent, and an FRP reverse-proxy client. The app seeks system permissions to facilitate the attack’s progression, including unlocking developer options and enabling wireless debugging.
Capabilities and Persistence
Even after uninstallation, RatHat retains control over the device using shell access. It can re-install itself by checking for its presence and exploiting local services. The malware can overlay apps to steal credentials, record screens, intercept messages, and manipulate installation attempts by mimicking the Google Play Store.
RatHat’s components enable it to communicate with an AI assistant for non-malicious tasks such as interpreting screen coordinates and directing navigation commands. The Go agent masquerades as a native library, maintaining persistence and managing power exemptions, while the FRP client establishes a secure tunnel to a command server.
The malware is capable of executing a variety of commands, facilitating data collection like SMS messages, credentials, keystrokes, and more. Additionally, a hardware-level keylogger records on-screen actions.
The sophistication of RatHat’s architecture and its use of real-time AI decision loops highlight the inadequacy of traditional mobile security measures in combating such advanced threats.
