apppanda.xyz

About YuanKong RAT

**YuanKong RAT** is a multi-tenant Android overlay / remote-control RAT. "YuanKong" (Chinese 远控, "remote control") is the self-signed organization on the child's APK signing certificate (`O=YuanKong, CN="Remote Control", OU=Dev, C=CN`, cert sha256 `73cbe8e3...`), shared byte-for-byte across every build - the strongest clustering pivot for the family. The child's Android application class is `com.remote.control.RemoteControlApp`. **Delivery - "Nova" SVLT vault dropper** - The payload ships inside a builder-generated dropper (outer package `com.system.loader.*`, dropper APK signed `O=Nova, CN="Nova Build <timestamp>"`, cert sha256 `af92f7d6...`). - A plaintext `assets/vault-config.json` names the encrypted asset, a base64 key and an IV, and the expected child hash. The asset is an SVLT container: `"SVLT"(4) | version(1) | ivlen(1) | iv(ivlen) | ciphertext`, decrypted as `plain[j] = ct[j] XOR key[j % keylen] XOR iv[j % ivlen]` (SVLT-XOR-v2). The plaintext is a ZIP whose `payload/child.apk` is the real RAT, installed via `REQUEST_INSTALL_PACKAGES`. - Decoded statically (no runtime) by `tracker/decoders/android/yuankong.py`; the recovered child hash is verified against `vault-config.json`'s `original_hash` on every sample. **Capabilities** - Command-and-control over an **okhttp WebSocket relay**, with device pairing via a **SPAKE2 PAKE** handshake on a conscrypt TLS stack. - Overlay / black-screen remote control and Accessibility abuse; requests overlay, `MANAGE_EXTERNAL_STORAGE`, `WRITE_SECURE_SETTINGS`, location and phone-state permissions. **Multi-tenant operator model** - This is a **builder platform rented to many operators**. Each build's obfuscated config class (`k4.l3` / `k4.i2`) carries the operator binding that the malware itself reports to C2 as `apkAccountId` = `e()` (e.g. `account_mszw1v45_a61972b00f41`, or the literal `default` on an unbound template build) and `apkAccountName` = `f()` (a human handle), plus a 6-digit enrollment/group code (`f5674g`). **These two fields are the operator identity.** - Tracked across **79 samples / 35 operator handles / 36 rotating build brands**. Handles cluster into operator "teams" by prefix - e.g. `xxy*` (`xxy001`, `xxy2-001`, `xxy3-001`, `xxy5-001`), `laizi*`, `lichunfeng*`, `lx*`, `wy*`, `dahai*` - with pinyin nicknames (`laizi`, `dashu`, `baofa`, `laiqian`, `lichunfeng`) pointing to Chinese-speaking operators. - A single `apkAccountId` is reused across multiple brands by the same operator, which ties brands together: `xxy3-001` / `account_mszw1v45...` runs both `echorelay` and `swiftlink`; `dahai4-001` / `account_muxwiqpg...` runs both `atlasbridge` and `echonode`; `laizi001` / `account_msr7dfm0...` runs both `deltalink` and `novawave`; `laiqian001` runs `atlasstation` and `swiftviewer`. - Build brands are a builder-generated `<theme><suffix>` matrix (themes `atlas/echo/flux/nova/orbit/` `peak/prism/swift/zenith/delta`, suffixes `bridge/link/node/portal/station/wave/hub/player/relay/` `viewer`) - cosmetic only; all share one decoy portfolio and one C2 pool. **Device identity** - The config carries two seed lists used only to manufacture device identities: a fixed 15-entry package-name list (`f5672e`: `com.netflixgratis.app`, `io.litetube.app`, ... `org.protube.app`) and a per-build source-tag list (`f5671d`: `<brand>-device-v2`, `protube-device-v2`). Method `p()` hashes `source | packageName | serial | MANUFACTURER | BRAND | MODEL | DEVICE` for every (packageName x source-tag) pair - including the app's own package - producing a distinct `stableFingerprint` and synthetic `deviceId` (`android_` + 24 chars). One physical device thus yields many candidate identities (ID enumeration / anti-dedup). The `<brand>-device-v2` string tracks the campaign brand but its code role is a fingerprint salt, **not** an operator ID. **C2** - Single shared relay pool across all tenants: `apppanda.xyz`, `ktxapp.com` (+`www`), `ktx123.net` (+`www`), and hardcoded IP `206.82.1.14`. Every indicator is recovered by full static unpack of the vault + child and binary-verified; no third-party reporting. **Notes** - Previously tracked as *AtlasBridge Overlay RAT (provisional)* and *EchoRelay RAT (provisional)* - both were single operator brands (`atlasbridge` / `echorelay`), not the family; consolidated here under the shared YuanKong codebase, Nova builder cert and C2 pool, confirmed via overlapping child hashes.

Signing certificate

Subject CN

Nova Build 20260703113341

Issuer CN

-

Valid

→

Fingerprint

af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9

Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.