RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Zimperium researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega disclosed RatHat, a new Android malware attributed to China-based threat actors that uses an AI-powered system to navigate and control compromised devices. Distributed via smishing, malvertising, and third-party download portals, RatHat abuses Accessibility services and autonomous local ADB self-pairing to break out of the Android application sandbox and stage native daemons with shell-level privileges, retaining shell access and reinstalling itself even after the victim uninstalls the app. The malware serializes the device's live Accessibility tree to XML and communicates with a popular Generative AI assistant to resolve target coordinates and on-screen text for synthetic clicks and automatic navigation commands such as SCROLL_DOWN.

Cybersecurity researchers have flagged a new Android malware called RatHat that’s assessed to be operated by China-based threat actors and features an artificial intelligence AI -powered system to navigate and control compromised devices. “Distributed primarily via targeted smishing SMS/text phishing and malvertising campaigns leading to deceptive third-party download portals, RatHat uses an automated multi-stage infection pipeline,” Zimperium researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega said https://zimperium.com/blog/rathat-ai-powered-mobile-threat-is-here-for-your-credentials-bank-accounts . “Once deployed, it pairs Accessibility abuse with autonomous local ADB Android Debug Bridge self-pairing to break out of the standard Android application sandbox, staging independent native daemons that execute with shell-level privileges.” RatHat is propagated via deceptive phishing sites promoted via malvertising, smishing campaigns, and third-party forums that trick unsuspecting users into installing malware-laced APKs. These packages function as a dropper to launch the main payload, while incorporating layers of anti-analysis and anti-debug checks to sidestep detection. The four anti-analysis techniques baked into the malware are listed below – - Container tampering, which declares certain files as directories in the package or sets the ZIP general-purpose encryption bit <https://en.wikipedia.org/wiki/ZIP file format File headers flag on some files so that they are ignored by Android’s libziparchive library but not by other tools like unzip and apktool. - Manifest bomb, which causes automated analysis pipelines to crash or time out by placing undocumented 0x9999 chunk headers in “AndroidManifest.xml” that’s skipped by Android native runtime. - DEX bytecode poisoning, which includes pseudo-instructions configured with an invalid element width attribute so as to cause the disassembly process to fail. - Dual string-encryption, which uses an encryption scheme called StringCrypto: Base64 to resist analysis. The Android malware’s architecture consists of three main components: the malicious Android application, a Go Agent, and an FRP https://github.com/fatedier/frp reverse-proxy client. The Android app acts as a conduit to acquire critical system permissions and launch the next phase of the attack, allowing it to obtain accessibility services permissions and then abuse it to unlock Developer Options, enable Wireless Debugging, and extract the 6-digit ADB pairing code. | Go Agent keylogging | The malware is equipped to serve overlays atop specific apps to harvest credentials, record the screen using Android’s MediaProjection API, intercept SMS messages, and override installation attempts by serving a fake failure overlay impersonating the Google Play Store. However, even if the victim manages to uninstall it, the attacker still retains shell access on the device. The attacker can weaponize the local service to check if the malware is installed and re-install it if not found. “The malware serializes the device’s live Accessibility tree to XML and communicates with one of the world’s most popular Generative AI assistants,” Zimperium said. “This AI is used for non-malicious actions including: Resolving a named target’s centre coordinates on the screen as JSON to direct synthetic clicks, resolving a target’s actual on-screen text from the XML, and signaling automatic navigation commands like SCROLL DOWN.” The Go Agent executed by the APK masquerades as a native library “liblocal-service.so” but leverages the shell access acquired via the local ADB daemon to execute commands, thereby allowing the malware to establish persistence and apply power management exemptions. The FRP client, for its part, is used to establish a secure, reverse tunnel to a command-and-control C2 server. “The Go Agent retrieves the FRP tunnel configuration from the C2 server, enabling the FRP Client to establish a persistent, active reverse tunnel to the operator,” the researchers said. “This connection is used by attackers to have access to the ADB daemon: it’s a general-purpose road into the device that carries whatever the operator wants, independent of the malware’s own feature set.” The commands issued by the C2 server are varied as they are feature-rich, allowing the threat actors to collect SMS messages, credentials, files, lock screen PIN, pattern, or password, screen captures, keystrokes including URLs entered in web browser address bars , and a list of installed applications. Also built into RatHat is a hardware-level keylogger that’s executed by the Go Agent that’s capable of recording finger presses on screen. “RatHat’s multi-tiered architecture, reliance on out-of-lifecycle daemons, and use of real-time GenAI decision loops illustrate why traditional, signature-based mobile security controls are insufficient,” Zimperium said.