RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
RatHat is a new Android malware operated by China-based threat actors that uses a sophisticated multi-stage infection pipeline and AI to maintain persistent shell access on compromised devices, even after uninstall attempts. The malware leverages Accessibility abuse and ADB self-pairing to bypass security measures and steal sensitive data like SMS messages, credentials, and keystrokes. It utilizes a Go agent and an FRP reverse-proxy client to establish a persistent connection to a command-and-control server, enabling extensive data collection and control over the device.
Researchers at Zimperium have identified a new Android malware, RatHat, operated by China-based threat actors. The malware utilizes a complex, multi-stage infection pipeline and AI to maintain persistent shell access on compromised devices, even after users attempt to uninstall it.
RatHat is primarily propagated through deceptive phishing sites promoted via malvertising and smishing campaigns, leading users to install malware-laced APKs. These packages function as droppers, launching the main payload while incorporating layers of anti-analysis and anti-debug checks to evade detection.
The malware employs Accessibility abuse, combined with ADB self-pairing, to break out of the standard Android application sandbox and establish independent native daemons with shell-level privileges. It also leverages a Go agent, masquerading as a native library, to execute commands and maintain persistence.
Key anti-analysis techniques include container tampering (modifying package files to confuse analysis tools), manifest bombing (injecting invalid data into the AndroidManifest.xml to crash analysis pipelines), DEX bytecode poisoning (introducing invalid instructions to disrupt disassembly), and dual string-encryption (using StringCrypto: Base64 to resist analysis).
The malware can serve overlays atop specific apps to harvest credentials, record the screen using Android's MediaProjection API, intercept SMS messages, and override installation attempts by impersonating the Google Play Store. It also includes a hardware-level keylogger executed by the Go Agent that records finger presses on screen.
Even if a user uninstalls RatHat, the attacker retains shell access, utilizing a local service to check for the malware's presence and reinstall it if necessary. The Go Agent retrieves FRP tunnel configuration from a C2 server, enabling the FRP Client to establish a persistent, active reverse tunnel to the operator, providing a general-purpose road into the device. The C2 server issues a variety of commands, including collecting SMS messages, credentials, files, lock screen PIN, pattern, or password, screen captures, keystrokes (including URLs entered in web browser address bars), and a list of installed applications.
Zimperium highlighted that RatHat's multi-tiered architecture and reliance on out-of-lifecycle daemons, combined with the use of real-time GenAI decision loops, demonstrate why traditional, signature-based mobile security controls are insufficient.