ACTAndroid C2 Tracker

031cd615a4a88a0523f5c13a…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

YuanKong RAT. YuanKong RAT is a multi-tenant Android overlay / remote-control RAT. “YuanKong” (Chinese 远控, “remote control”) is the self-signed organization on the child’s APK signing certificate (O=YuanKong, CN="Remote Control", OU=Dev, C=CN, cert sha256 73cbe8e3...), shared byte-for-byte across every build - the strongest clustering pivot for the family. The child’s Android application class is com.remote.control.RemoteControlApp.

Delivery - “Nova” SVLT vault dropper

  • The payload ships inside a builder-generated dropper (outer package com.system.loader.*, dropper APK signed O=Nova, CN="Nova Build <timestamp>", cert sha256 af92f7d6...).

  • A plaintext assets/vault-config.json names the encrypted asset, a base64 key and an IV, and the expected child hash. The asset is an SVLT container: "SVLT"(4) | version(1) | ivlen(1) | iv(ivlen) | ciphertext, decrypted as plain[j] = ct[j] XOR key[j % keylen] XOR iv[j % ivlen] (SVLT-XOR-v2). The plaintext is a ZIP whose payload/child.apk is the real RAT, installed via REQUEST_INSTALL_PACKAGES.

  • Decoded statically (no runtime) by tracker/decoders/android/yuankong.py; the recovered child hash is verified against vault-config.json’s original_hash on every sample.

Capabilities

  • Command-and-control over an okhttp WebSocket relay, with device pairing via a SPAKE2 PAKE handshake on a conscrypt TLS stack.

  • Overlay / black-screen remote control and Accessibility abuse; requests overlay, MANAGE_EXTERNAL_STORAGE, WRITE_SECURE_SETTINGS, location and phone-state permissions.

Multi-tenant operator model

  • This is a builder platform rented to many operators. Each build’s obfuscated config class (k4.l3 / k4.i2) carries the operator binding that the malware itself reports to C2 as apkAccountId = e() (e.g. account_mszw1v45_a61972b00f41, or the literal default on an unbound template build) and apkAccountName = f() (a human handle), plus a 6-digit enrollment/group code (f5674g). These two fields are the operator identity.

  • Tracked across 79 samples / 35 operator handles / 36 rotating build brands. Handles cluster into operator “teams” by prefix - e.g. xxy* (xxy001, xxy2-001, xxy3-001, xxy5-001), laizi*, lichunfeng*, lx*, wy*, dahai* - with pinyin nicknames (laizi, dashu, baofa, laiqian, lichunfeng) pointing to Chinese-speaking operators.

  • A single apkAccountId is reused across multiple brands by the same operator, which ties brands together: xxy3-001 / account_mszw1v45... runs both echorelay and swiftlink; dahai4-001 / account_muxwiqpg... runs both atlasbridge and echonode; laizi001 / account_msr7dfm0... runs both deltalink and novawave; laiqian001 runs atlasstation and swiftviewer.

  • Build brands are a builder-generated <theme><suffix> matrix (themes atlas/echo/flux/nova/orbit/ peak/prism/swift/zenith/delta, suffixes bridge/link/node/portal/station/wave/hub/player/relay/ viewer) - cosmetic only; all share one decoy portfolio and one C2 pool.

Device identity

  • The config carries two seed lists used only to manufacture device identities: a fixed 15-entry package-name list (f5672e: com.netflixgratis.app, io.litetube.app, … org.protube.app) and a per-build source-tag list (f5671d: <brand>-device-v2, protube-device-v2). Method p() hashes source | packageName | serial | MANUFACTURER | BRAND | MODEL | DEVICE for every (packageName x source-tag) pair - including the app’s own package - producing a distinct stableFingerprint and synthetic deviceId (android_ + 24 chars). One physical device thus yields many candidate identities (ID enumeration / anti-dedup). The <brand>-device-v2 string tracks the campaign brand but its code role is a fingerprint salt, not an operator ID.

C2

  • Single shared relay pool across all tenants: apppanda.xyz, ktxapp.com (+www), ktx123.net (+www), and hardcoded IP 206.82.1.14. Every indicator is recovered by full static unpack of the vault + child and binary-verified; no third-party reporting.

Notes

  • Previously tracked as AtlasBridge Overlay RAT (provisional) and EchoRelay RAT (provisional) - both were single operator brands (atlasbridge / echorelay), not the family; consolidated here under the shared YuanKong codebase, Nova builder cert and C2 pool, confirmed via overlapping child hashes. Indicators: https://apppanda.xyz, https://ktxapp.com, https://ktx123.net, tcp://206.82.1.14.

Recovered configuration

apkaccountid
account_msfn5b26_94c57ff4f7e4
apkaccountname
wm2-001
auth
spake2 PAKE pairing
builder
Nova (dropper cert CN=Nova Build 20260703113341, O=Nova)
child_app_class
com.remote.control.RemoteControlApp
child_package
io.zenithwave.app
child_sha256
1daad315a7995dfdd1b994e9b22cd415c999f61f2ed2ce6809eac62c1bcd9ebe
child_sha256_expected
1daad315a7995dfdd1b994e9b22cd415c999f61f2ed2ce6809eac62c1bcd9ebe
enrollment_code
825287
fingerprint_source_tags
protube-device-v2, zenithwave-device-v2
loader_package
com.system.loader.va363d031
operator_org
YuanKong
packer
Nova SVLT-XOR-v2 vault dropper (config-asset)
rat_cert_sha256
73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387
transport
okhttp WebSocket relay
vault
SVLT-XOR-v2; key/iv in assets/vault-config.json
vault_variant
config-asset
www_aliases
www.ktxapp.com, www.ktx123.net

Identification

SHA-256
031cd615a4a88a0523f5c13af288b35e47b27e931fb17a8c3fac19207920f411
MD5
5fcc62963b02ff472d4c14068ef23b0a

Observed

Families
YuanKong RAT
First seen
2026-10-12

C2 configuration (4)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
apppanda.xyz domain - https YuanKong RAT 2026-10-12
ktx123.net domain - https YuanKong RAT 2026-10-12
ktxapp.com domain - https YuanKong RAT 2026-10-12
206.82.1.14 ip - tcp YuanKong RAT 2026-10-12

Signing certificate

Subject CN
Nova Build 20260703113341
Issuer CN
Nova Build 20260703113341
Fingerprint
af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About YuanKong RAT

**YuanKong RAT** is a multi-tenant Android overlay / remote-control RAT. "YuanKong" (Chinese 远控, "remote control") is the self-signed organization on the child's APK signing certificate (`O=YuanKong, CN="Remote Control", OU=Dev, C=CN`, cert sha256 `73cbe8e3...`), shared byte-for-byte across every build - the strongest clustering pivot for the family. The child's Android application class is `com.remote.control.RemoteControlApp`. **Delivery - "Nova" SVLT vault dropper** - The payload ships inside a builder-generated dropper (outer package `com.system.loader.*`, dropper APK signed `O=Nova, CN="Nova Build <timestamp>"`, cert sha256 `af92f7d6...`). - A plaintext `assets/vault-config.json` names the encrypted asset, a base64 key and an IV, and the expected child hash. The asset is an SVLT container: `"SVLT"(4) | version(1) | ivlen(1) | iv(ivlen) | ciphertext`, decrypted as `plain[j] = ct[j] XOR key[j % keylen] XOR iv[j % ivlen]` (SVLT-XOR-v2). The plaintext is a ZIP whose `payload/child.apk` is the real RAT, installed via `REQUEST_INSTALL_PACKAGES`. - Decoded statically (no runtime) by `tracker/decoders/android/yuankong.py`; the recovered child hash is verified against `vault-config.json`'s `original_hash` on every sample. **Capabilities** - Command-and-control over an **okhttp WebSocket relay**, with device pairing via a **SPAKE2 PAKE** handshake on a conscrypt TLS stack. - Overlay / black-screen remote control and Accessibility abuse; requests overlay, `MANAGE_EXTERNAL_STORAGE`, `WRITE_SECURE_SETTINGS`, location and phone-state permissions. **Multi-tenant operator model** - This is a **builder platform rented to many operators**. Each build's obfuscated config class (`k4.l3` / `k4.i2`) carries the operator binding that the malware itself reports to C2 as `apkAccountId` = `e()` (e.g. `account_mszw1v45_a61972b00f41`, or the literal `default` on an unbound template build) and `apkAccountName` = `f()` (a human handle), plus a 6-digit enrollment/group code (`f5674g`). **These two fields are the operator identity.** - Tracked across **79 samples / 35 operator handles / 36 rotating build brands**. Handles cluster into operator "teams" by prefix - e.g. `xxy*` (`xxy001`, `xxy2-001`, `xxy3-001`, `xxy5-001`), `laizi*`, `lichunfeng*`, `lx*`, `wy*`, `dahai*` - with pinyin nicknames (`laizi`, `dashu`, `baofa`, `laiqian`, `lichunfeng`) pointing to Chinese-speaking operators. - A single `apkAccountId` is reused across multiple brands by the same operator, which ties brands together: `xxy3-001` / `account_mszw1v45...` runs both `echorelay` and `swiftlink`; `dahai4-001` / `account_muxwiqpg...` runs both `atlasbridge` and `echonode`; `laizi001` / `account_msr7dfm0...` runs both `deltalink` and `novawave`; `laiqian001` runs `atlasstation` and `swiftviewer`. - Build brands are a builder-generated `<theme><suffix>` matrix (themes `atlas/echo/flux/nova/orbit/` `peak/prism/swift/zenith/delta`, suffixes `bridge/link/node/portal/station/wave/hub/player/relay/` `viewer`) - cosmetic only; all share one decoy portfolio and one C2 pool. **Device identity** - The config carries two seed lists used only to manufacture device identities: a fixed 15-entry package-name list (`f5672e`: `com.netflixgratis.app`, `io.litetube.app`, ... `org.protube.app`) and a per-build source-tag list (`f5671d`: `<brand>-device-v2`, `protube-device-v2`). Method `p()` hashes `source | packageName | serial | MANUFACTURER | BRAND | MODEL | DEVICE` for every (packageName x source-tag) pair - including the app's own package - producing a distinct `stableFingerprint` and synthetic `deviceId` (`android_` + 24 chars). One physical device thus yields many candidate identities (ID enumeration / anti-dedup). The `<brand>-device-v2` string tracks the campaign brand but its code role is a fingerprint salt, **not** an operator ID. **C2** - Single shared relay pool across all tenants: `apppanda.xyz`, `ktxapp.com` (+`www`), `ktx123.net` (+`www`), and hardcoded IP `206.82.1.14`. Every indicator is recovered by full static unpack of the vault + child and binary-verified; no third-party reporting. **Notes** - Previously tracked as *AtlasBridge Overlay RAT (provisional)* and *EchoRelay RAT (provisional)* - both were single operator brands (`atlasbridge` / `echorelay`), not the family; consolidated here under the shared YuanKong codebase, Nova builder cert and C2 pool, confirmed via overlapping child hashes.