Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
RATHat Android Banking Trojan Uses Gemini AI and ADB Shell to Take Control of Devices
Threat Actors
Malware Families
Excerpt
RATHat is an Android banking trojan that abuses Accessibility permissions, wireless ADB debugging, and Gemini AI to gain deep control over infected phones. The malware escapes the normal Android app sandbox by pairing with the device’s local ADB service and deploying a separate Go-based service with shell-level access. RATHat is distributed through smishing messages, malicious advertisements, and fake Android app download pages. Victims are lured into installing APK files…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | admin.chunhuating.best | High | Score 58/100 | First seen |
| Domain | admin.xiongmaocs.pics | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…