RatHat liblocal-service.so ADB Daemon Persistence and Silent Reinstall

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•4

Detects anomalous process activity associated with the RatHat Android malware, specifically the execution of 'liblocal-service.so' as a daemon and its use for silent APK reinstallation or monitoring of package paths (via 'pm' commands).