RatHat Android malware preserves ADB shell access after removal

Zimperium researchers have identified RatHat, an Android malware family assessed to be operated by China-based threat actors. The malware is distributed through targeted smishing, malvertising and deceptive third-party download portals, where victims are persuaded to install malicious APK files.

Its defining capability is persistence beyond application removal. RatHat abuses Android Accessibility services to unlock Developer Options, enable Wireless Debugging and extract the six-digit Android Debug Bridge pairing code. It then self-pairs with a local ADB daemon and stages independent native components with shell-level privileges.

Persistence outside the application lifecycle

The malicious APK acts as a dropper for a broader architecture comprising the Android app, a Go agent and an FRP reverse-proxy client. The Go agent masquerades as a native library named liblocal-service.so, but uses the shell access obtained through local ADB to run commands, establish persistence and apply power-management exemptions.

That design means uninstalling the visible Android application does not necessarily remove the attacker’s access. The local service can check whether the malware is present and reinstall it when it is missing. Zimperium described the ADB daemon as a general-purpose route into the device, independent of RatHat’s own feature set.

The FRP client establishes a secure reverse tunnel to a command-and-control server. The Go agent retrieves tunnel configuration from that server, enabling the client to maintain an active connection through which an operator can access the ADB daemon.

Data collection and interface automation

RatHat can place overlays over selected applications to collect credentials, record screens through Android’s MediaProjection API, intercept SMS messages and display a fake Google Play Store failure overlay to override installation attempts. Commands can also collect files, installed-app lists, lock-screen PINs, patterns or passwords, screen captures and keystrokes, including URLs typed into browser address bars.

The Go agent includes a hardware-level keylogger capable of recording finger presses on the screen. RatHat also serializes the live Accessibility tree into XML and sends it to a generative AI assistant for non-malicious interface tasks cited by Zimperium, including locating a named target’s screen coordinates, resolving displayed text and issuing navigation commands such as scrolling down.

Analysis evasion complicates detection

The APK packages incorporate four anti-analysis techniques: container tampering, a manifest bomb using undocumented 0x9999 chunk headers, DEX bytecode poisoning and dual string encryption using StringCrypto: Base64. These measures are intended to cause tools to ignore content, crash or time out, or fail during disassembly.

For businesses, RatHat makes application removal an insufficient containment assumption. Mobile incident procedures should treat suspicious APK installation, unexpected Accessibility permissions and enabled Wireless Debugging as indicators that require inspection of ADB pairing and device-level persistence, not just deletion of the visible app.