GhostBat RAT
GhostBat RAT is an Android remote access trojan observed in campaigns targeting users across India. It has been distributed via malicious APK files delivered through hacked websites, WhatsApp, and SMS messages, with the apps masquerading as Indian Regional Transport Office applications, including a counterfeit mParivahan app. Reported capabilities include theft of sensitive data from compromised devices, exfiltration of UPI PINs, and harvesting of SMS messages containing banking-related keywords. Infected devices are registered through a Telegram bot identified as "GhostBatRat_bot." Reported evasion and anti-analysis techniques include ZIP header manipulation, extensive string obfuscation, native code execution, and anti-emulation. Researchers also identified more advanced variants that execute encrypted payloads using a native C/C++-based packer. Cyble and iVerify described GhostBat RAT as one of two Android malware families capable of stealing sensitive data from compromised devices.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
Stealth
4 techniques
Stealth
Credential Access
1 technique
Credential Access
Discovery
1 technique
Discovery
Collection
2 techniques
Collection
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android remote access trojan delivered via malicious APKs masquerading as Indian RTO apps (e.g., mParivahan). It exfiltrates UPI PINs and SMS messages containing banking-related keywords, registers infected devices via a Telegram bot, and uses evasion/packing techniques (string obfuscation, anti-emulation, native code execution, ZIP header manipulation, and a native C/C++ packer enabling encrypted payload execution).
Android RAT targeting Indian users, distributed via bogus apps and phishing, capable of stealing banking credentials, UPI PINs, SMS, and can mine cryptocurrency.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.