RATHat Android Banking Trojan: From BlackCat Panel to Panda Workshop — ADB Exploitation C2 Detection Pack

---
title: RATHat / Panda Workshop C2 Panel Domain Resolution
id: 7f3a2c1e-9b4d-4e6a-8c1f-2d5b7a9e0011
status: experimental
description: Detects DNS resolution of known RATHat / Panda Workshop MaaS panel and distribution domains associated with the Android banking trojan campaign.
author: Security Arsenal Threat Intelligence
references:
    - https://www.cleafy.com/cleafy-labs/from-blackcat-to-panda-workshop-inside-the-evolving-c2-panel-behind-rathat
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'admin.chunhuating.best'
            - 'admin.xiongmaocs.pics'
            - 'admin.rathat.live'
            - 'rathat.me'
            - 'dramaspoolcoa.com'
    condition: selection
falsepositives:
    - Threat intelligence research or sandbox detonation of samples
level: high
tags:
    - attack.command_and_control
    - attack.t1071
date: 2026/09/29
---
title: Suspicious ADB Wireless Debugging and Shell Execution Activity
id: 8a4b3d2f-1c5e-4f7b-9d2a-3e6c8b0f0022
status: experimental
description: Detects ADB daemon invocation patterns consistent with RATHat's self-pairing wireless debugging abuse, including ADB spawning shell processes or pushing/executing native binaries.
author: Security Arsenal Threat Intelligence
references:
    - https://www.cleafy.com/cleafy-labs/from-blackcat-to-panda-workshop-inside-the-evolving-c2-panel-behind-rathat
logsource:
    category: process_creation
    product: windows
detection:
    selection_adb_exec:
        Image|endswith: '\adb.exe'
        CommandLine|contains:
            - 'connect'
            - 'pair'
            - 'push'
            - 'shell'
    selection_shell_payload:
        ParentImage|endswith:
            - '\adb.exe'
            - 'adbd'
        CommandLine|contains:
            - 'chmod 755'
            - '/data/local/tmp'
            - 'nohup'
    condition: 1 of selection_*
falsepositives:
    - Legitimate Android development and QA activity
    - MDM provisioning tooling
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.command_and_control
    - attack.t1572
date: 2026/09/29
---
title: Native Go Payload Execution from Android Writable Directories
id: 9c5d4e3a-2d6f-4a8c-0e3b-4f7d9c1a0033
status: experimental
description: Detects execution of unsigned binaries from world-writable Android staging directories (e.g., /data/local/tmp), the deployment pattern used by RATHat's native Go service after ADB pairing.
author: Security Arsenal Threat Intelligence
references:
    - https://www.cleafy.com/cleafy-labs/from-blackcat-to-panda-workshop-inside-the-evolving-c2-panel-behind-rathat
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        CommandLine|contains:
            - '/data/local/tmp/'
            - '/sdcard/Download/'
    filter_known_tools:
        CommandLine|contains:
            - 'frida'
            - 'magisk'
    condition: selection and not filter_known_tools
falsepositives:
    - Mobile security research tooling
    - Custom enterprise Android instrumentation
level: medium
tags:
    - attack.execution
    - attack.t1059
    - attack.defense_evasion
    - attack.t1222
date: 2026/09/29

// RATHat / Panda Workshop — IOC and behavioral hunt for Microsoft Sentinel
// Hunts network indicators and ADB-adjacent process behavior across managed endpoints.
let RATHatDomains = dynamic(["admin.chunhuating.best", "admin.xiongmaocs.pics", "admin.rathat.live", "rathat.me", "dramaspoolcoa.com"]);
let RATHatHashes = dynamic(["116346cace7f00ba557034b534d40791", "8fdc21e25097a46528211274e54330e1", "f83357b2d47c7d38ee53943373961211"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (RATHatDomains)
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, IndicatorType="C2/Panel DNS"
    ),
    (DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where MD5 in (RATHatHashes)
    | project TimeGenerated, DeviceName, FolderPath, FileName, MD5, InitiatingProcessFileName, IndicatorType="Known RATHat Sample Hash"
    ),
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where (FileName =~ "adb.exe" and ProcessCommandLine has_any ("pair", "connect", "push", "shell"))
       or (InitiatingProcessFileName =~ "adb.exe" and ProcessCommandLine has_any ("/data/local/tmp", "chmod", "nohup"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName, IndicatorType="ADB Abuse Pattern"
    )
| order by TimeGenerated desc

# RATHat / Panda Workshop IOC Hunt — Security Arsenal
# Checks endpoint DNS cache, established connections, and proxy-visible artifacts
# for RATHat panel/distribution infrastructure. Run elevated; suitable for fleet-wide
# execution via RMM/Intune/EDR live response.

$panelDomains = @(
    'admin.chunhuating.best',
    'admin.xiongmaocs.pics',
    'admin.rathat.live',
    'rathat.me',
    'dramaspoolcoa.com'
)
$knownHashes = @(
    '116346cace7f00ba557034b534d40791',
    '8fdc21e25097a46528211274e54330e1',
    'f83357b2d47c7d38ee53943373961211'
)

Write-Output "=== RATHat IOC Hunt — $(Get-Date -Format 'yyyy-MM-dd HH:mm') ==="

# 1) DNS cache hits for panel/distribution domains
Write-Output "`n[1] DNS Cache Check"
$dnsHits = Get-DnsClientCache -ErrorAction SilentlyContinue |
    Where-Object { $d = $_.Entry; $panelDomains | Where-Object { $d -like "*$_*" } }
if ($dnsHits) { $dnsHits | Format-Table Entry, Data, Status -AutoSize } else { Write-Output "No panel domains in DNS cache." }

# 2) Active connections to resolved panel infrastructure
Write-Output "`n[2] Active Network Connections"
$resolved = foreach ($dom in $panelDomains) {
    try { (Resolve-DnsName $dom -ErrorAction Stop).IPAddress } catch { $null }
}
if ($resolved) {
    Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
        Where-Object { $resolved -contains $_.RemoteAddress } |
        ForEach-Object {
            $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            [PSCustomObject]@{ RemoteIP=$_.RemoteAddress; Port=$_.RemotePort; Process=$proc.ProcessName; PID=$_.OwningProcess }
        } | Format-Table -AutoSize
} else { Write-Output "Panel domains did not resolve locally (may already be sinkholed)." }

# 3) ADB presence and suspicious ADB usage on workstation fleets (dev/QA risk surface)
Write-Output "`n[3] ADB Process / Staging Artifacts"
$adb = Get-Process -Name 'adb' -ErrorAction SilentlyContinue
if ($adb) {
    $adb | ForEach-Object { Write-Output "ADB RUNNING: PID $($_.Id) Path $($_.Path)" }
} else { Write-Output "No adb.exe processes running." }

# 4) File hash sweep of common download/drop locations
Write-Output "`n[4] Hash Sweep — Downloads/Desktop/Temp"
$paths = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", $env:TEMP)
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -File -Include *.apk,*.exe,*.bin -ErrorAction SilentlyContinue |
            ForEach-Object {
                $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
                if ($knownHashes -contains $h.ToLower()) {
                    Write-Output "MATCH: $($_.FullName) — MD5 $h"
                }
            }
    }
}

Write-Output "`n=== Hunt complete. Escalate any hits to IR per playbook. ==="