GhostBat RAT: Inside The Resurgence Of RTO-Themed Android Malware

Cyble Research and Intelligence Labs (CRIL) observed a notable rise in Android malware campaigns masquerading as the Indian RTO (Regional Transport Office) applications and target Indian users to steal sensitive information.

The malware spreads mainly through WhatsApp messages and SMS containing shortened URLs that appear as the RTO app, mParivahan, which redirect to GitHub-hosted APKs, and via compromised websites.

Once installed, the malware uses phishing pages to capture banking credentials and UPI PINs, while also exfiltrating SMS messages containing banking-related keywords.

Certain variants of the malware include cryptocurrency mining capabilities. In addition, device registration is carried out through a Telegram bot named GhostBatRat_bot, linking the malware campaign to the “GhostBat RAT” moniker.

• The malware is distributed through WhatsApp, SMS with shortened URLs, GitHub-hosted APKs, and compromised websites, highlighting diverse infection vectors.
• It then implements multi-stage droppers, ZIP header manipulation, and heavy string obfuscation to bypass antivirus detection and reverse engineering.
• The campaign was observed using native libraries (.so) to dynamically resolve API calls and deploy payloads, including banking credential stealers and cryptocurrency miners.
• The malware deploys phishing pages mimicking the mParivahan app, prompting users for mobile numbers, vehicle details, and UPI payments.
• All SMS messages containing banking-related keywords are exfiltrated to Command and Control (C&C) servers, while incoming SMS messages may be forwarded or uploaded to attackers for OTP harvesting.
• Device registration is performed via a Telegram bot (GhostBatRat_bot), linking the malware campaign to the “GhostBat RAT” moniker.

In July 2024, CRIL published an analysis detailing Android malware that impersonates RTO applications designed to steal contacts and SMS messages from infected devices. As we continued to monitor these developments, we observed a resurgence of similar campaigns, again leveraging the RTO theme to distribute Android malware.

Once again, threat actors were propagating these malicious APKs mainly through WhatsApp (see Figure 1) or via SMS messages containing shortened URLs that redirect to GitHub-hosted links (see Figure 2).

Some of the examples of these distribution methods are shown below:

From September 2025 to the present, we have identified over 40 distinct Android malware samples. These applications employ various anti-analysis techniques, including ZIP header manipulation, custom packers, and anti-emulation mechanisms.

Despite differences in packing and obfuscation methods, all variants ultimately deliver the same malicious mParivahan application, whose dropper includes a cryptominer and an infostealer designed to exfiltrate banking information.

Once installed, the app prompts users to perform an “update,” which requests SMS-related permissions and triggers phishing activities targeting banking credentials (see Figure 3).

During our analysis of samples from this campaign, CRIL observed that most of them used the same Telegram bot, bot6751695148:AAHEYUWDN0BKvpvSycVHp_2kcXPhfeZk75o, for device registration.

This bot corresponds to the Telegram account GhostBatRat_bot, suggesting that the threat actor may be referring to the malware delivered via this campaign as “GhostBat RAT” (see Figure 4).

The implementation of multi-layered dropper mechanisms, combined with string obfuscation, significantly enhanced the malware’s ability to evade detection. At the time of analysis, several samples were detected by a few engines on VirusTotal (see Figure 5).

The Technical Analysis section provides a comprehensive breakdown of this malware and how it operates to compromise victims.

The GhostBat RAT samples included multi-stage dropper workflows, native binary packing, deliberate corruption/manipulation of ZIP headers, runtime anti-emulation checks, and heavy string obfuscation, complicating reverse engineering.

Zip Header Manipulation

A majority of samples associated with this campaign had deliberately manipulated ZIP headers to hinder reverse engineering tools (see Figure 6).

The threat actors modified the central directory and local file headers by altering the compression method value to “STORE”, resulting in failed APK decompilation attempts (see Figure 7).

Three-Stage Mining Dropper Execution

GhostBat RAT exhibited a consistent three-stage dropper across most samples. For this analysis, we examined the sample SHA‑256 98991cd9557116b7942925d9c96378b224ad12e2746ac383752b261c31e02a1f.

After installation, the initial dropper performs an anti-emulation check by validating the device’s architecture and manufacturer; if it detects x86 or x86_64, the malware terminates its process to avoid running in an emulated environment.

Additionally, the malware has also implemented heavy string obfuscations, where the strings are obfuscated into long numbers (See Figure 8).

Once the malware verifies it is not running on any emulator, it reads an encrypted file from the app’s assets and decrypts it using the XOR algorithm.

The dropper then loads the decrypted component with DexClassLoader and runs a method from the second-stage payload (see Figures 9 and 10).

The second-stage payload reads an encrypted file from the app’s assets, derives an AES key from the SHA-1 hash of the encrypted file’s name (first 16 bytes), decrypts the file, and loads the resulting content into classes.zip, which contains the third-stage payload (See Figure 11).

The third-stage payload serves as the final payload of the initial dropper application. This stage includes an embedded mining module (See Figure 12) and implements a session-based mechanism to install the malicious APK file (See Figure 13).

Implementation of the Native packer

A few other malicious samples (d3bfcb0fc5cb22a4ba033a38d0cf402bf82bbbc2ab6c8c7481096edd0ccf1563), aside from the dropper described earlier, were observed using a native library to install the final payload.

The final stage follows the same multi-stage dropper pattern but relies on heavily obfuscated native code to deliver different payloads.

The samples load and execute a .so library that uses XOR-based decryption to construct various API call names. Those API names are built in memory and then resolved and invoked at runtime via JNI (for example, using FindClass and related methods). Figure 14 illustrates the decryption routine implemented inside the native library.

The first-stage .so library decrypts a file present in the APK’s assets — like the dropper described earlier — but instead of creating a DEX, it stores a native .so binary and loads it with the System.load function.

The second-stage native library uses the same XOR-based decryption to extract and load the final payload. This library is responsible for installing the primary malicious APK, which steals banking credentials and can also perform cryptocurrency mining.

mParivahan Malicious Application Installation

When the final dropper initiates installation of the mPairvahan malicious app, it presents a fake Google Play update page. If the user taps the update button, the malware opens a download page, prompts the user to enable installation from untrusted sources, and then installs the application once that permission is granted. (see Figure 15)

After installation, the malware requests SMS-related permissions and then displays a mParivahan phishing page asking users to enter their mobile number and vehicle details.

As the user interacts with the page and enables the permissions notifications, the malware also registers the device with a Telegram bot. (see Figures 16 and 17)

The app then displays a page asking the user to pay ₹1 to verify ownership. If the victim taps “Pay now,” the malware presents a fake UPI payment interface and subsequently a counterfeit UPI PIN entry page. This phishing flow tricks the victim into submitting their PIN, which the malware forwards to a Firebase endpoint. (see Figures 18 and 19)

Beyond phishing, the malware exfiltrates all SMS messages on the compromised device, filtering for bank-related keywords and sending matches to its C2 server.

It also monitors incoming SMS and, depending on their content, either uploads them to the server or forwards them to a phone number provided by the attacker.

These behaviors are used to harvest OTPs or to complete UPI device verification for unauthorized transactions (see Figure 20).

The GhostBat RAT campaign represents a sophisticated evolution of RTO-themed Android malware. It combines multi-stage dropper techniques, anti-analysis defenses, native code exploitation, and social engineering to compromise users.

By targeting both banking credentials and UPI authentication flows, the malware demonstrates an ability to extract financial information directly while evading traditional detection mechanisms.

Cyble’s Threat Intelligence Platforms continuously monitor emerging threats, infrastructure, and activity across the dark web, deep web, and open sources. This proactive intelligence empowers organizations with early detection, impersonation, infrastructure mapping, and attribution insights. Altogether, these capabilities provide a critical head start in mitigating and responding to evolving cyber threats.

We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:

• Install Apps Only from Trusted Sources:
  Download apps exclusively from official platforms like the Google Play Store. Avoid third-party app stores or links received via SMS, social media, or email.
• Be Cautious with Permissions and Installs:
  Never grant permissions and install an application unless you’re certain of an app’s legitimacy.
• Watch for Phishing Pages:
  Always verify the URL and avoid suspicious links and websites that ask for sensitive information.
• Enable Multi-Factor Authentication (MFA):
  Use MFA for banking and financial apps to add an extra layer of protection, even if credentials are compromised.
• Report Suspicious Activity:
  If you suspect you’ve been targeted or infected, report the incident to your bank and local authorities immediately. If necessary, reset your credentials and perform a factory reset.
• Use Mobile Security Solutions:
  Install a mobile security application that includes real-time scanning.
• Keep Your Device Updated:
   Ensure your Android OS and apps are updated regularly. Security patches often address vulnerabilities exploited by malware.