RemoteControl SDK RAT

Android remote-control / screen-capture RAT distributed as dpt-shell-packed APKs (ProxyApplication loader, assets/d_shell_data_001, obfuscated org. package names, main tt.kk.uas.qaa.SplashActivity). The real payload lives under the asdf.ump.stdf namespace: a RemoteControlSdk with HTTP control plus multiple WebSocket channels (controlWsBaseUrl, captureWsBaseUrl, auditWsBaseUrl, realtimeWsBaseUrl) and an apkUploadBaseUrl, driven by a SERVER_BASE_URL config. Capabilities implied by the SDK: live screen capture, realtime remote control, activation/task management (HomeActivation*) and remote APK push. C2 base URLs were recovered from the intact dpt-shell dex string pool (method bytecode is XOR-encrypted but the string pool stays readable): HTTP C2 https://lfga.constapr.com, WebSocket C2 wss://xnko.constapr.com, plus 713c1.constapr.com and a908cccc.atrnu.top.