liblocal-service.so

Domain

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

September 17, 2026

Last Seen

September 18, 2026

API

IOC Validation

ThreatCluster AI

False Positive — False Positive confidence

Identified as a filename for a native binary used by the malware, not a domain.

This indicator was flagged as a false positive by AI analysis.

Pivot to external tools

Opens in new tab · no data sent to TC

Reputation · 2

Sandbox · 2

Infrastructure · 5

Malware trackers · 2

Web search · 2

Related Clusters (1)

RatHat Android Malware Exploits Accessibility for Deep Device Control

1d ago·8 sources

Related Entities

ToxicPanda Malware Phishing Trojan China RatHat RedHook T1071 - Application Layer Protocol T1056 - Input Capture T1566 - Phishing T1566.002 - Spearphishing Link T1055 - Process Injection

liblocal-service.so

IOC Validation

Pivot to external tools

Related Clusters (1)

RatHat Android Malware Exploits Accessibility for Deep Device Control

Related Articles (4)

RatHat malware lets AI drive Android phone

RatHat Turns Android Accessibility Into an Attack Weapon

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

New RatHat Android malware uses AI to automate device control

Related Entities