RatHat Go Agent Uninstall-Resistant Reinstall via ADB Shell

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•5

Detects the RatHat malware agent (liblocal-service.so) being staged in the Android /data/local/tmp directory and the subsequent execution of an ADB shell command to automatically re-install the malicious APK, ensuring persistence even after the application has been uninstalled.