YuanKong RAT

YuanKong RAT is a multi-tenant Android overlay / remote-control RAT. “YuanKong” (Chinese 远控, “remote control”) is the self-signed organization on the child’s APK signing certificate (O=YuanKong, CN="Remote Control", OU=Dev, C=CN, cert sha256 73cbe8e3...), shared byte-for-byte across every build - the strongest clustering pivot for the family. The child’s Android application class is com.remote.control.RemoteControlApp.

Delivery - “Nova” SVLT vault dropper

• The payload ships inside a builder-generated dropper (outer package com.system.loader.*, dropper APK signed O=Nova, CN="Nova Build <timestamp>", cert sha256 af92f7d6...).
• A plaintext assets/vault-config.json names the encrypted asset, a base64 key and an IV, and the expected child hash. The asset is an SVLT container: "SVLT"(4) | version(1) | ivlen(1) | iv(ivlen) | ciphertext, decrypted as plain[j] = ct[j] XOR key[j % keylen] XOR iv[j % ivlen] (SVLT-XOR-v2). The plaintext is a ZIP whose payload/child.apk is the real RAT, installed via REQUEST_INSTALL_PACKAGES.
• Decoded statically (no runtime) by tracker/decoders/android/yuankong.py; the recovered child hash is verified against vault-config.json’s original_hash on every sample.

Capabilities

• Command-and-control over an okhttp WebSocket relay, with device pairing via a SPAKE2 PAKE handshake on a conscrypt TLS stack.
• Overlay / black-screen remote control and Accessibility abuse; requests overlay, MANAGE_EXTERNAL_STORAGE, WRITE_SECURE_SETTINGS, location and phone-state permissions.

Multi-tenant operator model

• This is a builder platform rented to many operators. Each build’s obfuscated config class (k4.l3 / k4.i2) carries the operator binding that the malware itself reports to C2 as apkAccountId = e() (e.g. account_mszw1v45_a61972b00f41, or the literal default on an unbound template build) and apkAccountName = f() (a human handle), plus a 6-digit enrollment/group code (f5674g). These two fields are the operator identity.
• Tracked across 79 samples / 35 operator handles / 36 rotating build brands. Handles cluster into operator “teams” by prefix - e.g. xxy* (xxy001, xxy2-001, xxy3-001, xxy5-001), laizi*, lichunfeng*, lx*, wy*, dahai* - with pinyin nicknames (laizi, dashu, baofa, laiqian, lichunfeng) pointing to Chinese-speaking operators.
• A single apkAccountId is reused across multiple brands by the same operator, which ties brands together: xxy3-001 / account_mszw1v45... runs both echorelay and swiftlink; dahai4-001 / account_muxwiqpg... runs both atlasbridge and echonode; laizi001 / account_msr7dfm0... runs both deltalink and novawave; laiqian001 runs atlasstation and swiftviewer.
• Build brands are a builder-generated <theme><suffix> matrix (themes atlas/echo/flux/nova/orbit/ peak/prism/swift/zenith/delta, suffixes bridge/link/node/portal/station/wave/hub/player/relay/ viewer) - cosmetic only; all share one decoy portfolio and one C2 pool.

Device identity

• The config carries two seed lists used only to manufacture device identities: a fixed 15-entry package-name list (f5672e: com.netflixgratis.app, io.litetube.app, … org.protube.app) and a per-build source-tag list (f5671d: <brand>-device-v2, protube-device-v2). Method p() hashes source | packageName | serial | MANUFACTURER | BRAND | MODEL | DEVICE for every (packageName x source-tag) pair - including the app’s own package - producing a distinct stableFingerprint and synthetic deviceId (android_ + 24 chars). One physical device thus yields many candidate identities (ID enumeration / anti-dedup). The <brand>-device-v2 string tracks the campaign brand but its code role is a fingerprint salt, not an operator ID.

C2

• Single shared relay pool across all tenants: apppanda.xyz, ktxapp.com (+www), ktx123.net (+www), and hardcoded IP 206.82.1.14. Every indicator is recovered by full static unpack of the vault + child and binary-verified; no third-party reporting.

Notes

• Previously tracked as AtlasBridge Overlay RAT (provisional) and EchoRelay RAT (provisional) - both were single operator brands (atlasbridge / echorelay), not the family; consolidated here under the shared YuanKong codebase, Nova builder cert and C2 pool, confirmed via overlapping child hashes.