An investigation into RatHat Android malware uncovered 33 network indicators of compromise, 240 client IP addresses communicating with suspicious domains and thousands of connected domains, revealing infrastructure associated with a smishing campaign.