1d22514ace35b2d83dc3d172…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

AtlasBridge Overlay RAT (provisional). Android overlay banker/RAT delivered inside an SVLT-XOR-v2 “vault” dropper (outer package com.system.loader.va363d031, a LaunchRouterActivity bootstrap). The dropper ships a vault-config.json that names the encrypted asset, its base64 key and the child package/hash, and a PayloadCipher that XOR-decrypts the asset (SVLT magic, embedded salt, plaintext = ct XOR salt XOR key) to a child.apk (com.atlasbridge.app). The child authenticates its C2 channel with SPAKE2 over a conscrypt TLS stack pinned by a custom x509TrustManager, carries per-device permission_profiles for overlay/accessibility abuse, and requests overlay, location and phone-state permissions. C2 recovered by a full static unpack of the vault; indicators binary-verified. Family label provisional; now tracked across 25 samples and decoded automatically by the ShellTemplateVault decoder (outer loader com.system.loader.va363d031, child com.atlasbridge.app). Indicators: https://ktx123.net, https://ktxapp.com.

Recovered configuration

child_package

unknown

child_sha256_expected

57bd3f84a615b02b9b0e81fa5618aa6ba9602624dcd4ab6938c3ee0bc52c5303

packer

SVLT shelltemplate vault dropper (config-asset)

vault_variant

config-asset

Identification

SHA-256: 1d22514ace35b2d83dc3d1722b79ea0d9a4d8a18a489bfe7c0a02a7d3507677f
MD5: 1c2d547c7f51115c0ce65a897d4dc802

Observed

Families: AtlasBridge Overlay RAT (provisional)
First seen: 2026-10-07

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
ktx123.net	domain	-	https	AtlasBridge Overlay RAT (provisional)	2026-10-07
ktxapp.com	domain	-	https	AtlasBridge Overlay RAT (provisional)	2026-10-07

Signing certificate

Subject CN: Nova Build 20260703113341
Issuer CN: Nova Build 20260703113341
Fingerprint: af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About AtlasBridge Overlay RAT (provisional)

Android overlay banker/RAT delivered inside an SVLT-XOR-v2 "vault" dropper (outer package com.system.loader.va363d031, a LaunchRouterActivity bootstrap). The dropper ships a vault-config.json that names the encrypted asset, its base64 key and the child package/hash, and a PayloadCipher that XOR-decrypts the asset (SVLT magic, embedded salt, plaintext = ct XOR salt XOR key) to a child.apk (com.atlasbridge.app). The child authenticates its C2 channel with SPAKE2 over a conscrypt TLS stack pinned by a custom x509TrustManager, carries per-device permission_profiles for overlay/accessibility abuse, and requests overlay, location and phone-state permissions. C2 recovered by a full static unpack of the vault; indicators binary-verified. Family label provisional; now tracked across 25 samples and decoded automatically by the ShellTemplateVault decoder (outer loader com.system.loader.va363d031, child com.atlasbridge.app).