Android Intrusion Logs Reveal RatHat’s Wireless Debugging Attack Chain

Summary

Zimperium uses Android intrusion logs to reconstruct RatHat’s attack chain, including Wireless Debugging abuse, privileged shell staging, persistence, and C2 activity. The logs support user-controlled forensic sharing and enterprise analysis.

Key points

The article describes Android Intrusion Logging as an opt-in feature for supported devices, initially Pixel devices running Android 16 or later; encrypted logs are stored for 12 months and shared by the user.
Zimperium’s case study correlates process and network events with RatHat activity, including watchdog processes, key generation, and localhost probes for Frida on port 27042.
The described infection chain uses Wireless Debugging self-pairing to obtain a shell under UID 2000, then stages a Go agent and FRP client in /data/local/tmp.
Logged shell commands attempt to bypass Android background limits by changing battery-optimization, standby, network-policy, and app-operation settings.
The article reports local IPC at 127.0.0.1:7912 and recurring C2 connections to fegrs[.]adidasabc[.]com, resolving to 8.231.120.246:443.
Android Delegated Scope provides OS-level security and network logs to security apps on enterprise-managed devices; Intrusion Logging offers a user-controlled sharing path for supported personal devices.
The article says Intrusion Logging must be enabled before an incident to preserve relevant activity; Zimperium says its MTD product supports analysis through both logging models.

Article Details

Attack Vectors: RatHat is distributed through targeted lures, smishing, and malvertising, with aggressive social engineering.
The malware abuses Accessibility and autonomously pairs with Android Wireless Debugging to obtain a shell under UID 2000.
It stages Go and FRP daemons outside the normal application lifecycle, modifies background-execution settings, and maintains an external C2 connection.
Defensive Notes: Enable Intrusion Logging before an incident on supported devices so relevant security, DNS, and connection events are preserved.
Use Android Security Logs and Network Logging to correlate process starts, package-attributed DNS and connections, ADB shell commands, and staging activity.
Monitor for anomalous Accessibility use, local Wireless Debugging pairing, unexpected ADB shell commands, and executables staged under /data/local/tmp.
Zimperium MTD is described as detecting and blocking the malware, its C2 communications, and FRP reverse-proxy tunnels.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`fegrs[.]adidasabc[.]com`	RatHat C2 hostname resolved by the malware for its external heartbeat and command channel.
IPV4	`8[.]231[.]120[.]246`	External C2 server contacted by RatHat over HTTPS.
SHA256	`bdfccc6ab3e592f6cfc47f6deb910950666fa47b5f87c6a08af7096d90e59d0f`	SHA-256 hash of the malicious RatHat APK package observed in process-start logs.