RatHat Go Agent Silent APK Reinstall After Uninstall

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects execution of malicious binaries ('liblocal-service.so', 'frpc', 'local-service.update') or suspicious shell commands on Android devices consistent with the RatHat malware family. The rule monitors for unauthorized APK installations, modification of accessibility service settings, and manipulation of system standby/doze modes via adb or local shell commands.