RatHat packed dropper APK (rebuilds hourly, hash rotates)
Detects RatHat Android dropper applications that utilize automated build rotation to bypass file hash-based detection. The rule identifies stable artifacts, such as specific native library names, string obfuscation indicators, and manifest structure anomalies, that persist across these regenerated builds.
YARA
