RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts

MITRE Techniques

• [T1566.001 ] Spearphishing Attachment – Delivered through targeted smishing and deceptive phishing lures sent via SMS/text messages (‘distributed primarily via targeted smishing (SMS/text phishing)’)
• [T1189 ] Drive-by Compromise – Users are lured through malvertising to deceptive third-party download portals (‘malvertising campaigns leading to deceptive third-party download portals’)
• [T1204.002 ] Malicious File – Delivered via user-downloaded malicious APKs that appear legitimate (‘manually downloading malicious APKs that appear to be legitimate apps’)
• [T1620 ] Reflective Code Loading – Loads an in-memory DEX by reflection to unpack and install the payload (‘stage 2 is an in-memory DEX loaded by reflection’)
• [T1112 ] Modify Registry – Modifies Android settings to enable accessibility and debugging features (‘settings put secure enabled_accessibility_services’ and ‘settings put secure accessibility_enabled 1’)
• [T1548.001 ] Abuse Elevation Control Mechanism: Setuid and Setgid – Exploits SessionInstaller APIs and ADB pairing to bypass restricted settings and gain elevated execution (‘bypass Android’s restricted settings’ and ‘securing shell-level access’)
• [T1614 ] Hide Artifacts – Uses container tampering, manifest bombs, and poisoned DEX to break analysis tools (‘declaring some files as directories’, ‘AndroidManifest.xml file is of 61MB’, ‘DEX Bytecode Poisoning’)
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – Checks for emulator, root, Xposed, and debuggable properties (‘Xposed, root or emulator checks’ and ‘Properties check’)
• [T1622 ] Debugger Evasion – Uses JDWP, ptrace, Frida, and FLAG_DEBUGGABLE checks to avoid analysis (‘JDWP debugger check’, ‘Ptrace attach check’, ‘Frida Check’)
• [T1016 ] System Network Configuration Discovery – Collects wireless debugging port and ADB pairing details from the UI (‘scrape critical connection data’ and ‘the 6-digit ADB Pairing Code and the dynamic port’)
• [T1056.001 ] Input Capture: Keylogging – Reconstructs typed text from Accessibility events and raw input events (‘track beforeText, eventText…’ and ‘getevent’)
• [T1185 ] Browser Session Cookie / URL Harvesting – Reads browser address bars from multiple browsers to capture web activity (‘Reads address bars by resource ID’)
• [T1113 ] Screen Capture – Uses MediaProjection and screen-monitoring tooling to capture the screen (‘MediaProjection Screen streaming’ and ‘screen-capture tooling’)
• [T1056.003 ] Input Capture: Clipboard Data – Intercepts OTP/2FA and form data via notification/SMS collection and overlays (‘intercept 2FA/OTP codes’ and ‘overlay form submissions’)
• [T1543.003 ] Create or Modify System Process: Windows Service – Establishes hidden background services and native daemons that persist outside the app lifecycle (‘hidden background service’ and ‘staging independent native daemons’)
• [T1098 ] Account Manipulation – Requests Device Admin rights and grants itself permissions and persistence controls (‘request Device Admin rights’ and ‘grant the application persistent operation’)
• [T1090.001 ] Proxy: Internal Proxy – Uses FRP to expose loopback services and device interfaces through a reverse tunnel (‘establish a secure, persistent reverse tunnel back to the C2 server’)
• [T1071.001 ] Application Layer Protocol: Web Protocols – Communicates with C2 over HTTP, WebSocket, and local loopback HTTP services (‘registers over HTTP’, ‘holds a WebSocket open’, ‘HTTP server bound to 127.0.0.1:7910’)
• [T1105 ] Ingress Tool Transfer – Stages and launches additional components such as the Go agent and FRP client (‘stage and launch both the Go Agent and the FRP Client’)