---
title: Hunt: Hirudo Android RAT swaps real banking apps for patched copies that fake Play Integrity | ctxsec
url: https://ctxsec.com/items/hunt-hirudo-android
description: ""
status: "hunt idea"
published: 2026-10-14
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-hirudo-android.md)

hunt idea

2026-10-14

### Hunt: Hirudo Android RAT swaps real banking apps for patched copies that fake Play Integrity

ThreatFabric's Hirudo writeup describes lure apps (shopping, adult video, short drama) that drop a separate RAT behind a fake in-app "update". The RAT then uninstalls 8 Indonesian banking apps (covering 7 banks) and installs test-key-signed replacements. A YAHFA/Dobby hooking engine inside each replacement spoofs the signing certificate, hides Accessibility services, strips `FLAG_SECURE`, re-signs attestation with a _publicly leaked_ keybox, and relays Play Integrity over plain HTTP to an operator server. Credential targeting also covers China, India, Mexico, Morocco and Thailand. **Server-side hunt ideas (banks/fintech):** check attestation chains against Google's revocation list, bind Integrity verdicts to the session and action, and flag sessions where behavioral telemetry suddenly drops out. **Network/MDM:** block the IOCs below. Lure packages: `com.agbbh.kjdrttt`, `com.onev.vip`, `com.koishort.app`, `com.zoyatv.app`. RAT: `com.zk7qpx.mv9wlt`, `com.r9nkvx.qw2mpl`.

```
// KQL sketch (proxy/DNS/MDM network logs) - adapt table names
let hirudo = dynamic(["helloharmonyos.com","jiekou.baojingtextile.cn",
  "d3s06yhcwfnwcx.cloudfront.net","d21gcldn8gp80l.cloudfront.net",
  "dydjjnnjg7jeb.cloudfront.net","d3q4tlm7pw29zr.cloudfront.net"]);
let hirudoIP = dynamic(["134.122.153.136","43.225.157.157","134.122.153.68",
  "134.122.153.92","18.139.79.161"]);
NetworkLogs
| where TimeGenerated > ago(30d)
| where DestinationHost has_any (hirudo) or DestinationIP in (hirudoIP)
| summarize hits=count(), first=min(TimeGenerated) by DeviceId, DestinationHost, DestinationIP
```

Sources: [ThreatFabric: Hirudo](https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps) · [The Hacker News](https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html)