# RatHat Android RAT: MaaS Consoles Add Gemini AI-Driven Victim Prioritization

> RatHat is an Android banking RAT sold via a malware-as-a-service web console (evolved through Fisher, BlackCat Remote Control Management, and Panda Workshop V5/V6) with nearly 100 documented deployments since April 2026. It abuses Accessibility services to silently enable ADB wireless debugging and drive minicap/minitouch screen control, rebuilds APKs hourly to defeat hash-based detection, and its latest console queries Google's Gemini AI to estimate victims' bank balances from intercepted banking communications and triage high-value targets.

- **Published:** 2026-09-28T00:00:00Z
- **Last reviewed:** 2026-09-29T14:48:07.880Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2743
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-rathat-android-banking-rat-tl-2026-2743.webp?v=22acf271 (Threadlinqs threat intel: RatHat Banking Trojan Leverages Gemini AI: Detection & IOCs (TL-2026-2743) — High severity, 32 IOCs, 9 detection rules.)
- **ID:** TL-2026-2743
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 32 (3 shown free below)

## Description

RatHat is distributed as a malware-as-a-service (MaaS) platform: operators rent access to a web console that builds Android banking-trojan APKs and manages infected devices. Cleafy Labs traced the console's lineage from Fisher (in operation December 2025-February 2026, C2 admin.rathat[.]live) through a rebuild branded BlackCat Remote Control Management in April 2026 (C2 IP 8.231.120[.]246), to Panda Workshop V5 in August 2026 (C2 admin.xiongmaocs[.]pics) and Panda Workshop V6 in September 2026 (C2 admin.chunhuating[.]best), documenting nearly 100 separate console deployments across that period consistent with a MaaS model where each customer runs an independent instance.

The malware's infection chain begins with Accessibility-service abuse: once a victim (via SMS smishing, malvertising, or a phishing/fake-app-store download page) grants Accessibility permissions, RatHat uses them to open Settings, enable Developer Options and Wireless Debugging without further prompts, read the six-digit ADB pairing code off the victim's own screen, and connect to the device's local ADB daemon over the loopback interface. This grants shell-level execution (UID 2000) without an attacker-controlled computer, bypassing normal Android runtime consent dialogs to silently grant permissions, disable background restrictions, and enforce persistence. This technique mirrors the wireless-ADB abuse recently documented in the ToxicPanda and RedHook Android RAT families.

The malware consists of three components: a Go-based agent (liblocal-service.so) that executes ADB shell commands, manages persistence, keylogs, and bypasses battery restrictions; an FRP-based reverse-proxy client (libmedia_codec.so) that opens a persistent tunnel back to operator infrastructure; and the main module handling credential theft, SMS interception, and UI automation via HTML overlays impersonating banking and cryptocurrency apps. For screen control, operators deploy a Go program that uses minicap and minitouch (on Android versions below 14) for undetected, permission-prompt-free screen streaming and synthetic taps, falling back to screencap at roughly five frames per second with a visible recording indicator on Android 14+ where minicap/minitouch no longer function without detection. Notably, the Go control program keeps running after the victim uninstalls the visible app, persisting until the device reboots; the two malicious components also mutually reinstall one another if either is removed, and the malware actively intercepts and blocks uninstall-confirmation dialogs.

To evade hash-based antivirus detection, the console can rebuild the distributed APK on a schedule (e.g., hourly), producing a new file hash from the same underlying malware each time. Anti-analysis measures include APK container tampering, an artificially bloated ~61MB AndroidManifest.xml, and invalid DEX pseudo-instructions intended to break static-analysis tooling.

The newest capability, introduced with Panda Workshop V6 in September 2026, has the console call Google's Gemini AI model against the SMS text and fake-overlay-captured credentials harvested from each infected phone to estimate that victim's bank balance, sorting devices into high-value and mid-value buckets so operators can prioritize manual follow-on fraud on the phones most worth their time -- Gemini is used for victim triage, not for automating the theft itself. Separately, RatHat also calls Gemini directly from the infected device at runtime, serializing the live Android Accessibility tree to XML and sending it to the model to determine where to tap when hard-coded UI automation fails across different device manufacturers, OEM skins, and Android versions -- solely to keep the wireless-debugging setup functioning across device diversity. Zimperium's concurrent, overlapping analysis (published September 16, 2026 by researchers Gianluca Braga, Vishnu Pratapagiri, and Fernando Ortega) documents the same on-device technique in more general terms: RatHat serializes the Accessibility tree and asks an AI assistant for tap/scroll/read instructions rather than following a hardcoded script, and the researchers attribute the malware to China-nexus operators after finding LLM prompts written in simplified Chinese in the sample set. Zimperium also reports distribution via malvertising, SMS, and phishing sites hosting APKs outside Google Play.

This on-device LLM-driven UI automation technique was first documented in Android malware by ESET in February 2026 in a distinct but related family, PromptSpy (an evolution of VNCSpy, first seen on VirusTotal from Hong Kong on 2026-01-13), which used Gemini prompts plus an XML dump of on-screen UI elements to keep itself pinned in the recent-apps list for persistence, and which also carried simplified-Chinese debug strings and targeted Argentina via a dedicated distribution site (mgardownload[.]com) using a fake JPMorgan Chase ('MorganArg') dropper. Neither Cleafy nor Zimperium disclosed a specific victim count, named targeted banks, or a named threat-actor group for RatHat; the Chinese-language attribution is based on artifact language only.

## MITRE ATT&CK

- T1660 Phishing
- T1655 Masquerading
- T1626 Abuse Elevation Control Mechanism
- T1623.001 Unix Shell
- T1516 Input Injection
- T1629.001 Prevent Application Removal
- T1577 Compromise Application Executable
- T1541 Foreground Persistence
- T1633 Virtualization/Sandbox Evasion
- T1406 Obfuscated Files or Information
- T1417.002 GUI Input Capture
- T1417.001 Keylogging
- T1636.004 SMS Messages
- T1517 Access Notifications
- T1426 System Information Discovery
- T1663 Remote Access Software
- T1437.001 Web Protocols
- T1583.001 Acquire Infrastructure: Domains
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1453 Abuse Accessibility Features
- T1636.003 Protected User Data: Contact List
- T1513 Screen Capture
- T1429 Audio Capture
- T1512 Video Capture
- T1572 Protocol Tunneling
- T1544 Ingress Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RatHat/PromptSpy Malicious APK Distribution & C2 Domain Resolution (SPL)** (`TL-2026-2743-SPL-001`)

Detects DNS resolution or proxy/firewall connections to documented RatHat MaaS console C2 domains across its rebrand lineage (Fisher, BlackCat Remote Control Management, Panda Workshop V5/V6), the RatHat C2 IP, RatHat APK download/landing pages, and the related PromptSpy distribution domain masquerading as a JPMorgan Chase app.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1660, T1655
- **Data sources:** dns_logs, proxy_logs, firewall_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype=stream:dns OR sourcetype=pan:threat
| eval domain=coalesce(query, dest_hostname, url_domain)
| search domain IN ("admin.chunhuating.best","admin.xiongmaocs.pics","admin.rathat.live","dramaspoolcoa.com","rathat.me","mgardownload.com") OR dest_ip="8.231.120.246"
| stats count min(_time) as first_seen max(_time) as last_seen dc(src_ip) as distinct_hosts values(src_ip) as source_hosts by domain dest_ip
| where count > 0
| sort - count
```

### Microsoft KQL

```kql
let RatHatDomains = dynamic(["admin.chunhuating.best","admin.xiongmaocs.pics","admin.rathat.live","dramaspoolcoa.com","rathat.me","mgardownload.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (RatHatDomains) or RemoteIP == "8.231.120.246"
| project Timestamp, DeviceName, DeviceId, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count() by DeviceName, DeviceId, RemoteUrl, RemoteIP
| order by Count desc
```

### Sigma

```yaml
title: RatHat Android MaaS RAT DNS/Proxy Resolution to Known C2 or Distribution Infrastructure
id: 3f6a1d2c-8b4e-4a1f-9d3c-7e2b5f8a01aa
status: experimental
description: Detects DNS resolution or proxy/firewall connections to known RatHat Android banking-trojan console C2 domains, the related PromptSpy distribution domain, or the documented C2 IP, indicating a RatHat/PromptSpy phishing-download or MaaS console beacon.
references:
    - https://thehackernews.com/2026/09/rathat-android-malware-console-uses.html
    - https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/
author: Threadlinqs Team
date: 2026-09-28
tags:
    - attack.initial-access
    - attack.t1660
    - attack.defense-evasion
    - attack.t1655
    - attack.tool.rathat
    - attack.tool.promptspy
logsource:
    category: dns_query
detection:
    selection_domain:
        query|contains:
            - 'admin.chunhuating.best'
            - 'admin.xiongmaocs.pics'
            - 'admin.rathat.live'
            - 'dramaspoolcoa.com'
            - 'rathat.me'
            - 'mgardownload.com'
    condition: selection_domain
falsepositives:
    - None known — these are single-purpose attacker-registered domains with no legitimate use
level: high
```

**Known false positives:**

- None expected — these are single-purpose attacker-registered domains/IP with no legitimate business use; verify a threat-intel feed or DNS sinkhole isn't the source of the resolution before escalating

**Tuning notes:** Add newly observed RatHat/PromptSpy console rebrand domains as the MaaS operators rotate infrastructure (Fisher -> BlackCat -> Panda Workshop V5/V6 shows a roughly monthly rebrand cadence); pivot on AS4907 (Singapore) hosting to catch related un-flagged IPs, and treat any hit as high-priority since these domains have no legitimate use.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RatHat/PromptSpy Malicious APK Distribution & C2 Domain Resolution (KQL) (locked: unlock with TL Creds)
- Accessibility-Service Abuse Chained to Wireless ADB Enablement & Uninstall Resistance (KQL) (locked: unlock with TL Creds)
- RatHat FRP C2 Beacon & Anomalous On-Device Gemini API Calls (KQL) (locked: unlock with TL Creds)
- RatHat/PromptSpy Malicious APK Distribution & C2 Domain Resolution (Sigma) (locked: unlock with TL Creds)
- Accessibility-Service Abuse Chained to Wireless ADB Enablement & Uninstall Resistance (Sigma) (locked: unlock with TL Creds)
- RatHat FRP C2 Beacon & Anomalous On-Device Gemini API Calls (Sigma) (locked: unlock with TL Creds)
- Accessibility-Service Abuse Chained to Wireless ADB Enablement & Uninstall Resistance (SPL) (locked: unlock with TL Creds)
- RatHat FRP C2 Beacon & Anomalous On-Device Gemini API Calls (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 32)

Defanged, TLP:CLEAR.

- IP address: `8.231.120[.]246`
- Domain: `admin[.]chunhuating[.]best`
- File hash: `116346cace7f00ba557034b534d40791`

Full set of 32 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [RatHat Android Malware Console Uses Gemini AI to Identify High-Value Victims](https://thehackernews.com/2026/09/rathat-android-malware-console-uses.html)
- [New RatHat Android malware uses AI to automate device control](https://www.bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control/)
- [New Android malware uses AI to steal bank logins and PINs](https://www.malwarebytes.com/blog/news/2026/09/new-android-malware-uses-ai-to-steal-bank-logins-and-pins)
- [RatHat Android Trojan Uses AI for Automation](https://www.securityweek.com/rathat-android-trojan-uses-ai-for-automation/)
- [New 'RatHat' Android Malware Leverages AI to Steal Financial Data](https://www.infosecurity-magazine.com/news/rathat-android-malware-ai-steal/)
- [PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence](https://thehackernews.com/2026/02/promptspy-android-malware-abuses-google.html)
- [PromptSpy ushers in the era of Android threats using GenAI](https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genai/)
- [ESET Research discovers PromptSpy, the first Android threat to use generative AI](https://www.eset.com/us/about/newsroom/research/eset-research-discovers-promptspy-first-android-threat-using-genai/)
- [RedHook Android malware now uses Wireless ADB for shell access](https://www.bleepingcomputer.com/news/security/redhook-android-malware-now-uses-wireless-adb-for-shell-access/)
- [ToxicPanda Android malware uses VPN permissions to block Google Play](https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2743