2927b3f980c78ff056cfc57a…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

CloudSettle Tunnel RAT (provisional). India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional. Indicators: wss://api.cloudsettle.org/ws/tunnel/device-b.

Recovered configuration

aes_gcm_key

74657178751967732145691afe7429f1ba7e13702d3b06446e4fe71c792953b5

delivers

CloudSettle Tunnel RAT

packer

XOR16 + 4-pass-KSA RC4 + AES-256-GCM -> MSZ1/zlib -> MSP1 bundle

Identification

SHA-256: 2927b3f980c78ff056cfc57a2e109e0c374fc074f0e2af99e7803af6a607abd0
MD5: f9dbb4c8260cb8f630aa4727fed92524

Observed

Families: CloudSettle Tunnel RAT (provisional)
First seen: 2026-10-10

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
api.cloudsettle.org/ws/tunnel/device-b	domain	-	wss	CloudSettle Tunnel RAT (provisional)	2026-10-10

Signing certificate

Subject CN: CrystalWave Tech
Issuer CN: CrystalWave Tech
Fingerprint: 7b9e2c0ce33d3d75085791996c9c90557c0ae91e767e229e581ca6a97ae58e2f

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About CloudSettle Tunnel RAT (provisional)

India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional.