RatHat Go Agent/frpc native daemons staged to /data/local/tmp

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects the presence of known RatHat Go-based command agents (liblocal-service.so) or frpc reverse-proxy clients (libmedia_codec.so) when staged within temporary directories such as /data/local/tmp on Android devices, often following manual ADB shell interaction.