A new Android malware, dubbed RatHat, has been identified by Zimperium zLabs researchers, featuring an AI-powered subsystem designed to automate remote control of compromised devices. The researchers suggest a potential link to Chinese threat actors, citing the presence of Large Language Model (LLM) prompts written in Chinese within the malware.
RatHat is reportedly distributed through various channels, including malvertising, SMS messages, and phishing websites that encourage users to download APK files from sources other than the official Google Play Store. Like many Android malware families, RatHat leverages Android's Accessibility permissions to execute highly privileged actions on infected devices.
A key capability of RatHat involves enabling Developer Options and Wireless Debugging, which grants it a local shell-level execution context without requiring a physical connection to an external computer. This mechanism is similar to those observed in the ToxicPanda and RedHook Android malware families. Access via Android Debug Bridge (ADB) allows RatHat to install a Go-based agent, identified as `liblocal-service.so`. This agent is capable of running commands with ADB shell privileges, bypassing battery restrictions, and maintaining persistence. It also acts as a mutual backup, restoring the main malware if it's removed and being restored by the malware if it's deleted. The Go agent also performs keylogging.
Additionally, a second agent, `libmedia_codec.so`, functions as an FRP reverse-proxy client, establishing a persistent tunnel for the attackers. The malware is designed to display HTML overlays on top of legitimate banking and cryptocurrency applications to steal account credentials. It can also intercept SMS messages and notifications, including one-time passwords, record text-change events, extract URLs from browser address bars, and capture lock-screen PINs, passwords, and unlock patterns.
Zimperium's analysis highlights RatHat's AI-powered user interface-automation engine. This engine serializes the live Android Accessibility tree into XML format and transmits it to an unnamed popular AI assistant. The AI assistant is then tasked with identifying the center coordinates of specific interface elements, determining their on-screen text, and generating navigation instructions such as 'SCROLL_DOWN'. This AI-driven approach makes RatHat's interface automation more adaptable and less reliant on fixed scripts, enabling remote navigation without continuous real-time input from operators.
The malware also incorporates anti-removal mechanisms. It can intercept the uninstall confirmation screen, cancel the uninstallation process, and display a fake Google Play overlay with a bogus error message to deter users from removing it. Furthermore, RatHat employs several anti-analysis techniques, including APK container tampering, an unusually large (61MB) Android manifest file, and invalid DEX pseudo instructions, all intended to complicate or break analysis tools.
Users are advised to avoid downloading APK files from untrusted sources outside of Google Play, exercise caution when granting Accessibility permissions to applications, and regularly scan their devices using Google Play Protect.
