RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices.

"Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to deceptive third-party download portals, RatHat uses an automated multi-stage infection pipeline," Zimperium researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega said .

"Once deployed, it pairs Accessibility abuse with autonomous local ADB (Android Debug Bridge) self-pairing to break out of the standard Android application sandbox, staging independent native daemons that execute with shell-level privileges."

RatHat is propagated via deceptive phishing sites via malvertising, smishing campaigns, and third-party forums that trick unsuspecting users into installing malware-laced APKs. These packages function as a dropper to launch the main payload, while incorporating layers of anti-analysis and anti-debug checks to sidestep detection.

The four anti-analysis techniques baked into the malware are listed below -

Container tampering, which declares certain files as directories in the package or sets the ZIP general-purpose encryption bit flag on some files so that they are ignored by Android's libziparchive library but not by other tools like unzip and apktool.

Container tampering, which declares certain files as directories in the package or sets the ZIP general-purpose encryption bit flag on some files so that they are ignored by Android's libziparchive library but not by other tools like unzip and apktool.

Manifest bomb, which causes automated analysis pipelines to crash or time out by placing undocumented 0x9999 chunk headers in "AndroidManifest.xml" that's skipped by Android native runtime.

Manifest bomb, which causes automated analysis pipelines to crash or time out by placing undocumented 0x9999 chunk headers in "AndroidManifest.xml" that's skipped by Android native runtime.

DEX bytecode poisoning, which includes pseudo-instructions configured with an invalid element_width attribute so as to cause the disassembly process to fail.

DEX bytecode poisoning, which includes pseudo-instructions configured with an invalid element_width attribute so as to cause the disassembly process to fail.

Dual string-encryption, which uses an encryption scheme called StringCrypto: Base64 to resist analysis.

Dual string-encryption, which uses an encryption scheme called StringCrypto: Base64 to resist analysis.

The Android malware's architecture consists of three main components: the malicious Android application, a Go Agent, and an FRP reverse-proxy client. The Android app acts as a conduit to acquire critical system permissions and launch the phase of the attack, allowing it to obtain accessibility services permissions and then abuse it to unlock Developer Options, enable Wireless Debugging, and extract the 6-digit ADB pairing code.

The malware is equipped to serve overlays atop specific apps to harvest credentials, record the screen using Android's MediaProjection API, intercept SMS messages, and override installation attempts by serving a fake failure overlay impersonating the Google Play Store.

However, even if the victim manages to uninstall it, the attacker still retains shell access on the device. The attacker can weaponize the local service to check if the malware is installed and re-install it if not found.

"The malware serializes the device's live Accessibility tree to XML and communicates with one of the world's most popular Generative AI assistants," Zimperium said. "This AI is used for non-malicious actions including: Resolving a named target's centre coordinates on the screen as JSON to direct synthetic clicks, resolving a target's actual on-screen text from the XML, [and] signaling automatic commands like SCROLL_DOWN."

The Go Agent executed by the APK masquerades as a native library ("liblocal-service.so") but leverages the shell access acquired via the local ADB daemon to execute commands, thereby allowing the malware to establish persistence and apply power management exemptions. The FRP client, for its part, is used to establish a secure, reverse tunnel to a command-and-control (C2) server.

"The Go Agent retrieves the FRP tunnel configuration from the C2 server, enabling the FRP Client to establish a persistent, active reverse tunnel to the operator," the researchers said. "This connection is used by attackers to have access to the ADB daemon: it's a general-purpose road into the device that carries whatever the operator wants, independent of the malware's own feature set."

The commands issued by the C2 server are varied as they are feature-rich, allowing the threat actors to collect SMS messages, credentials, files, lock screen PIN, pattern, or password, screen captures, keystrokes (including URLs entered in web browser address bars), and a list of installed applications. Also built into RatHat is a hardware-level keylogger that's executed by the Go Agent that's capable of recording finger presses on screen.

"RatHat's multi-tiered architecture, reliance on out-of-lifecycle daemons, and use of real-time GenAI decision loops illustrate why traditional, signature-based mobile security controls are insufficient," Zimperium said.