3ee9ca066e5c26cab2d2dd12…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

RemoteControl SDK RAT. Android remote-control / screen-capture RAT distributed as dpt-shell-packed APKs (ProxyApplication loader, assets/d_shell_data_001, obfuscated org. package names, main tt.kk.uas.qaa.SplashActivity). The real payload lives under the asdf.ump.stdf namespace: a RemoteControlSdk with HTTP control plus multiple WebSocket channels (controlWsBaseUrl, captureWsBaseUrl, auditWsBaseUrl, realtimeWsBaseUrl) and an apkUploadBaseUrl, driven by a SERVER_BASE_URL config. Capabilities implied by the SDK: live screen capture, realtime remote control, activation/task management (HomeActivation*) and remote APK push. C2 base URLs were recovered from the intact dpt-shell dex string pool (method bytecode is XOR-encrypted but the string pool stays readable): HTTP C2 https://lfga.constapr.com, WebSocket C2 wss://xnko.constapr.com, plus 713c1.constapr.com and a908cccc.atrnu.top. Indicators: 713c1.constapr.com.

Recovered configuration

app_class

*.ProxyApplication (dpt-shell)

main

tt.kk.uas.qaa.SplashActivity

namespace

asdf.ump.stdf

native

librc_ka.so, libmmkv.so, libsentry

package

org.kvy5a410.vgqk24xi.r83uwd0i.idx77spo

Identification

SHA-256: 3ee9ca066e5c26cab2d2dd12863274f7eb9930b5ba5727e053f02783f4090c78
MD5: 4af20e0a4263ac5af5ac2bed4c9e3ee8

Observed

Families: RemoteControl SDK RAT
First seen: 2026-10-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
713c1.constapr.com	domain	-	-	RemoteControl SDK RAT	2026-10-13

Signing certificate

Subject CN: REcMc
Issuer CN: -
Fingerprint: bc5fda9b2fcf59e3ee05e0064c8c0733091d0330dd594ec5711eeab8bb645a3b

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About RemoteControl SDK RAT

Android remote-control / screen-capture RAT distributed as dpt-shell-packed APKs (ProxyApplication loader, assets/d_shell_data_001, obfuscated org.<random> package names, main tt.kk.uas.qaa.SplashActivity). The real payload lives under the asdf.ump.stdf namespace: a RemoteControlSdk with HTTP control plus multiple WebSocket channels (controlWsBaseUrl, captureWsBaseUrl, auditWsBaseUrl, realtimeWsBaseUrl) and an apkUploadBaseUrl, driven by a SERVER_BASE_URL config. Capabilities implied by the SDK: live screen capture, realtime remote control, activation/task management (HomeActivation*) and remote APK push. C2 base URLs were recovered from the intact dpt-shell dex string pool (method bytecode is XOR-encrypted but the string pool stays readable): HTTP C2 https://lfga.constapr.com, WebSocket C2 wss://xnko.constapr.com, plus 713c1.constapr.com and a908cccc.atrnu.top.