ACTAndroid C2 Tracker

43168978b5b88155ab86abbf…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

AtlasBridge Overlay RAT (provisional). Android overlay banker/RAT delivered inside an SVLT-XOR-v2 “vault” dropper (outer package com.system.loader.va363d031, a LaunchRouterActivity bootstrap). The dropper ships a vault-config.json that names the encrypted asset, its base64 key and the child package/hash, and a PayloadCipher that XOR-decrypts the asset (SVLT magic, embedded salt, plaintext = ct XOR salt XOR key) to a child.apk (com.atlasbridge.app). The child authenticates its C2 channel with SPAKE2 over a conscrypt TLS stack pinned by a custom x509TrustManager, carries per-device permission_profiles for overlay/accessibility abuse, and requests overlay, location and phone-state permissions. C2 recovered by a full static unpack of the vault; indicators binary-verified. Family label provisional; a single sample so far, so it is hash-attributed rather than decoder-ized. Indicators: https://ktx123.net, https://ktxapp.com.

Recovered configuration

child_package
com.atlasbridge.app
child_sha256
51eeb0b8e1754b912a2691b660b6502d547719ceb434c10c30afc75899ecd228
package
com.system.loader.va363d031
packer
SVLT-XOR-v2 vault dropper (com.system.loader.va363d031 -> child.apk)

Identification

SHA-256
43168978b5b88155ab86abbf426dec622d449ed931cc6efd07c61e84470a5b77
MD5
acbe734cfaf17cf8ddc7f281936d9854

Observed

Families
AtlasBridge Overlay RAT (provisional)
First seen
2026-10-08

APK metadata

Summary

Type
Android · APK
Package
com.system.loader.va363d031
Main activity
com.system.loader.va363d031.bootstrap.LaunchRouterActivity
Internal version
1710370
Displayed version
5.35.9
Min SDK
24
Target SDK
36

Signing certificate

Valid from
2026-07-03 03:33:41
Valid to
2053-11-18 03:33:41
Serial
ccd2872d669e1ab3
Thumbprint
74f89867da1a3812d79b8dcf758c9f424166727a
Subject
C:SG, CN:Nova Build 20260703113341, L:Singapore, O:Nova, ST:Singapore, OU:APK Factory
Issuer
C:SG, CN:Nova Build 20260703113341, L:Singapore, O:Nova, ST:Singapore, OU:APK Factory

Permissions (82)

android.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.POST_NOTIFICATIONSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.WAKE_LOCKcom.shelldata.catalog.permission.feature.sync01com.shelldata.catalog.permission.feature.sync02com.shelldata.catalog.permission.feature.sync03com.shelldata.catalog.permission.feature.sync04com.shelldata.catalog.permission.feature.sync05com.shelldata.catalog.permission.feature.sync06com.shelldata.catalog.permission.feature.sync07com.shelldata.catalog.permission.feature.sync08com.shelldata.catalog.permission.feature.sync09com.shelldata.catalog.permission.feature.sync10com.shelldata.catalog.permission.feature.sync11com.shelldata.catalog.permission.feature.sync12com.shelldata.catalog.permission.feature.sync13com.shelldata.catalog.permission.feature.sync14com.shelldata.catalog.permission.feature.sync15com.shelldata.catalog.permission.feature.sync16com.shelldata.catalog.permission.feature.sync17com.shelldata.catalog.permission.feature.sync18com.shelldata.catalog.permission.feature.sync19com.shelldata.catalog.permission.feature.sync20com.shelldata.catalog.permission.feature.sync21com.shelldata.catalog.permission.feature.sync22com.shelldata.catalog.permission.feature.sync23com.shelldata.catalog.permission.feature.sync24com.shelldata.catalog.permission.feature.sync25com.shelldata.catalog.permission.feature.sync26com.shelldata.catalog.permission.feature.sync27com.shelldata.catalog.permission.feature.sync28com.shelldata.catalog.permission.feature.sync29com.shelldata.catalog.permission.feature.sync30com.shelldata.catalog.permission.feature.sync31com.shelldata.catalog.permission.feature.sync32com.shelldata.catalog.permission.feature.sync33com.shelldata.catalog.permission.feature.sync34com.shelldata.catalog.permission.feature.sync35com.shelldata.catalog.permission.feature.sync36com.shelldata.catalog.permission.feature.sync37com.shelldata.catalog.permission.feature.sync38com.shelldata.catalog.permission.feature.sync39com.shelldata.catalog.permission.feature.sync40com.shelldata.catalog.permission.feature.sync41com.shelldata.catalog.permission.feature.sync42com.shelldata.catalog.permission.feature.sync43com.shelldata.catalog.permission.feature.sync44com.shelldata.catalog.permission.feature.sync45com.shelldata.catalog.permission.feature.sync46com.shelldata.catalog.permission.feature.sync47com.shelldata.catalog.permission.feature.sync48com.shelldata.catalog.permission.feature.sync49com.shelldata.catalog.permission.feature.sync50com.shelldata.catalog.permission.feature.sync51com.shelldata.catalog.permission.feature.sync52com.shelldata.catalog.permission.feature.sync53com.shelldata.catalog.permission.feature.sync54com.shelldata.catalog.permission.feature.sync55com.shelldata.catalog.permission.feature.sync56com.shelldata.catalog.permission.feature.sync57com.shelldata.catalog.permission.feature.sync58com.shelldata.catalog.permission.feature.sync59com.shelldata.catalog.permission.feature.sync60com.shelldata.catalog.permission.feature.sync61com.shelldata.catalog.permission.feature.sync62com.shelldata.catalog.permission.feature.sync63com.shelldata.catalog.permission.feature.sync64com.shelldata.catalog.permission.feature.sync65com.shelldata.catalog.permission.feature.sync66com.shelldata.catalog.permission.feature.sync67com.shelldata.catalog.permission.feature.sync68com.shelldata.catalog.permission.feature.sync69com.shelldata.catalog.permission.feature.sync70com.shelldata.catalog.permission.feature.sync71com.shelldata.catalog.permission.feature.sync72com.shelldata.catalog.permission.feature.sync73com.shelldata.catalog.permission.feature.sync74com.shelldata.catalog.permission.feature.sync75com.shelldata.catalog.permission.feature.sync76com.system.loader.va363d031.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Activities (54)

  • com.system.loader.va363d031.InstallResultActivity
  • com.system.loader.va363d031.MainActivity
  • com.system.loader.va363d031.bootstrap.LaunchRouterActivity
  • solutions.travelfamily31.localweather89.biz.checkout.FeedbackSubmitActivityV6
  • solutions.travelfamily31.localweather89.biz.growth.MerchantDashboardActivity94
  • solutions.travelfamily31.localweather89.biz.growth.OrderListActivity28
  • solutions.travelfamily31.localweather89.core.analytics.GiftCardActivity2020
  • solutions.travelfamily31.localweather89.core.cache.PointsMallActivity909
  • solutions.travelfamily31.localweather89.core.device.GiftCardActivityV7
  • solutions.travelfamily31.localweather89.core.location.FeedbackSubmitActivity49
  • solutions.travelfamily31.localweather89.core.location.ShippingTrackActivity2027
  • solutions.travelfamily31.localweather89.core.network.SearchSuggestActivityV4
  • solutions.travelfamily31.localweather89.data.remote.AfterSaleApplyActivityV4
  • solutions.travelfamily31.localweather89.data.repository.CommentReplyActivity2026
  • solutions.travelfamily31.localweather89.data.repository.CouponCenterActivity55
  • solutions.travelfamily31.localweather89.data.repository.CreatorStudioActivity32R
  • solutions.travelfamily31.localweather89.data.repository.ReferralInviteActivityV8
  • solutions.travelfamily31.localweather89.feature.mall.SearchHistoryActivity423
  • solutions.travelfamily31.localweather89.feature.member.MembershipRenewActivity67
  • solutions.travelfamily31.localweather89.feature.payment.CollectionDetailActivityV3
  • solutions.travelfamily31.localweather89.feature.payment.FollowListActivity268
  • solutions.travelfamily31.localweather89.feature.video.ArticleDetailActivity2023
  • solutions.travelfamily31.localweather89.feature.video.UserProfileActivityV8
  • solutions.travelfamily31.localweather89.manager.account.RewardCenterActivity09
  • solutions.travelfamily31.localweather89.manager.analytics.UserProfileActivity05
  • solutions.travelfamily31.localweather89.manager.notification.MerchantDashboardActivity24H
  • solutions.travelfamily31.localweather89.manager.order.BrowseHistoryActivity86F
  • solutions.travelfamily31.localweather89.manager.order.ReviewPostActivity78
  • solutions.travelfamily31.localweather89.manager.recommend.NotificationCenterActivity178
  • solutions.travelfamily31.localweather89.manager.recommend.TaskCenterActivityV3
  • solutions.travelfamily31.localweather89.manager.route.ReferralInviteActivityV3
  • solutions.travelfamily31.localweather89.manager.upload.WalletHomeActivity82
  • solutions.travelfamily31.localweather89.module.marketing.FollowListActivity29
  • solutions.travelfamily31.localweather89.module.trade.CheckoutConfirmActivity2023
  • solutions.travelfamily31.localweather89.module.trade.CommentReplyActivity2028
  • solutions.travelfamily31.localweather89.module.user.AddressManageActivity58N
  • solutions.travelfamily31.localweather89.service.background.FlashSaleActivity2025
  • solutions.travelfamily31.localweather89.service.member.ReviewPostActivity96
  • solutions.travelfamily31.localweather89.service.recommend.FollowListActivity2024
  • solutions.travelfamily31.localweather89.service.report.AfterSaleApplyActivity87X
  • solutions.travelfamily31.localweather89.service.sync.AddressManageActivity43P
  • solutions.travelfamily31.localweather89.service.wallet.AccountSettingsActivityV3
  • solutions.travelfamily31.localweather89.ui.address.CommentReplyActivity2028
  • solutions.travelfamily31.localweather89.ui.address.MemberBenefitsActivityV5
  • solutions.travelfamily31.localweather89.ui.checkout.CommentReplyActivity18
  • solutions.travelfamily31.localweather89.ui.checkout.CreatorStudioActivity20F
  • solutions.travelfamily31.localweather89.ui.community.AddressManageActivity71
  • solutions.travelfamily31.localweather89.ui.coupon.UserProfileActivity343
  • solutions.travelfamily31.localweather89.ui.feed.OrderListActivity201
  • solutions.travelfamily31.localweather89.ui.live.ArticleDetailActivity28
  • solutions.travelfamily31.localweather89.ui.member.FlashSaleActivity382
  • solutions.travelfamily31.localweather89.ui.profile.ArticleDetailActivity2022
  • solutions.travelfamily31.localweather89.ui.wallet.CampaignDetailActivity33
  • solutions.travelfamily31.localweather89.ui.wallet.PointsMallActivityV6

Services (63)

  • com.system.loader.va363d031.ShellKeepAliveService
  • com.system.loader.va363d031.vpn.BlockingVpnService
  • solutions.travelfamily31.localweather89.biz.checkout.MembershipRefreshService48
  • solutions.travelfamily31.localweather89.biz.crm.CommentModerationService51
  • solutions.travelfamily31.localweather89.biz.crm.LiveHeartbeatService2025
  • solutions.travelfamily31.localweather89.biz.growth.MembershipRefreshService80V
  • solutions.travelfamily31.localweather89.core.analytics.BackupScheduleService2021
  • solutions.travelfamily31.localweather89.core.analytics.DeviceStateCollectService63
  • solutions.travelfamily31.localweather89.core.auth.PlayerWarmupService05
  • solutions.travelfamily31.localweather89.core.config.CommentModerationService2020
  • solutions.travelfamily31.localweather89.core.config.TaskQueueService52
  • solutions.travelfamily31.localweather89.core.device.MediaUploadService42
  • solutions.travelfamily31.localweather89.core.network.DeviceStateCollectServiceV2
  • solutions.travelfamily31.localweather89.core.network.RecommendationRefreshService37
  • solutions.travelfamily31.localweather89.core.session.MediaUploadService14B
  • solutions.travelfamily31.localweather89.core.storage.OrderDispatchSyncService488
  • solutions.travelfamily31.localweather89.core.storage.RecommendationRefreshService508
  • solutions.travelfamily31.localweather89.data.cache.BackupScheduleService48K
  • solutions.travelfamily31.localweather89.data.cache.RemoteConfigFetchServiceV3
  • solutions.travelfamily31.localweather89.data.remote.OrderDispatchSyncService16V
  • solutions.travelfamily31.localweather89.data.remote.RemoteConfigFetchService03
  • solutions.travelfamily31.localweather89.data.repository.CouponExpireCheckServiceV4
  • solutions.travelfamily31.localweather89.data.repository.NotificationDispatchServiceV4
  • solutions.travelfamily31.localweather89.data.repository.RemoteConfigFetchService75
  • solutions.travelfamily31.localweather89.feature.ad.PeerDiscoveryServiceV5
  • solutions.travelfamily31.localweather89.feature.content.CacheCleanupService360
  • solutions.travelfamily31.localweather89.feature.content.WalletStatementSyncService364
  • solutions.travelfamily31.localweather89.feature.live.CacheCleanupService99T
  • solutions.travelfamily31.localweather89.feature.live.WalletStatementSyncService648
  • solutions.travelfamily31.localweather89.feature.mall.CommentModerationServiceV7
  • solutions.travelfamily31.localweather89.feature.member.LocationUpdateService2021
  • solutions.travelfamily31.localweather89.feature.order.TaskQueueService125
  • solutions.travelfamily31.localweather89.feature.payment.BackupScheduleServiceV3
  • solutions.travelfamily31.localweather89.feature.reward.WalletStatementSyncService470
  • solutions.travelfamily31.localweather89.feature.social.NotificationDispatchServiceV5
  • solutions.travelfamily31.localweather89.manager.analytics.ContentPrefetchService2021
  • solutions.travelfamily31.localweather89.manager.download.MembershipRefreshService559
  • solutions.travelfamily31.localweather89.manager.download.PeerDiscoveryService840
  • solutions.travelfamily31.localweather89.manager.download.PlayerWarmupServiceV5
  • solutions.travelfamily31.localweather89.manager.order.CouponExpireCheckService32T
  • solutions.travelfamily31.localweather89.manager.recommend.FeedPreloadService126
  • solutions.travelfamily31.localweather89.manager.route.WalletStatementSyncService936
  • solutions.travelfamily31.localweather89.module.content.AnalyticsFlushService2027
  • solutions.travelfamily31.localweather89.module.content.CampaignScheduleService18
  • solutions.travelfamily31.localweather89.module.security.ContentPrefetchService52H
  • solutions.travelfamily31.localweather89.module.user.RemoteConfigFetchService69
  • solutions.travelfamily31.localweather89.service.location.CouponExpireCheckServiceV2
  • solutions.travelfamily31.localweather89.service.location.MessagePollingService29D
  • solutions.travelfamily31.localweather89.service.player.ContentPrefetchService26
  • solutions.travelfamily31.localweather89.service.recommend.CommentModerationService73W
  • solutions.travelfamily31.localweather89.service.report.CouponExpireCheckServiceV4
  • solutions.travelfamily31.localweather89.service.sync.DeviceStateCollectService27A
  • solutions.travelfamily31.localweather89.ui.address.TokenRefreshServiceV2
  • solutions.travelfamily31.localweather89.ui.comment.LiveHeartbeatServiceV2
  • solutions.travelfamily31.localweather89.ui.coupon.PlayerWarmupService2022
  • solutions.travelfamily31.localweather89.ui.coupon.PlayerWarmupServiceV7
  • solutions.travelfamily31.localweather89.ui.dashboard.NotificationDispatchService86N
  • solutions.travelfamily31.localweather89.ui.detail.DeviceStateCollectService2026
  • solutions.travelfamily31.localweather89.ui.live.SearchIndexSyncService2024
  • solutions.travelfamily31.localweather89.ui.member.BehaviorTrackUploadServiceV5
  • solutions.travelfamily31.localweather89.ui.search.RecommendationRefreshService2021
  • solutions.travelfamily31.localweather89.ui.settings.WalletStatementSyncService496
  • solutions.travelfamily31.localweather89.ui.shortvideo.LiveHeartbeatService72Y

Receivers (100)

  • solutions.travelfamily31.localweather89.biz.checkout.ScheduledTaskReceiverV7
  • solutions.travelfamily31.localweather89.biz.checkout.SyncRetryReceiverV8
  • solutions.travelfamily31.localweather89.core.analytics.StorageAlertReceiver45
  • solutions.travelfamily31.localweather89.core.cache.MessageReadReceiver2025
  • solutions.travelfamily31.localweather89.core.cache.TimeZoneChangeReceiver72D
  • solutions.travelfamily31.localweather89.core.database.PackageReplaceReceiver044
  • solutions.travelfamily31.localweather89.core.device.ChargeStateReceiver67
  • solutions.travelfamily31.localweather89.core.device.SyncRetryReceiver82
  • solutions.travelfamily31.localweather89.core.location.BatteryLevelReceiver87E
  • solutions.travelfamily31.localweather89.core.location.CampaignAlarmReceiver91
  • solutions.travelfamily31.localweather89.core.network.AppUpdateReceiverV6
  • solutions.travelfamily31.localweather89.core.network.ConnectivityChangeReceiver44P
  • solutions.travelfamily31.localweather89.core.network.PackageReplaceReceiver462
  • solutions.travelfamily31.localweather89.core.push.LocaleChangedReceiver850
  • solutions.travelfamily31.localweather89.core.session.AppUpdateReceiver61
  • solutions.travelfamily31.localweather89.core.session.TimeZoneChangeReceiver57
  • solutions.travelfamily31.localweather89.data.cache.BatteryLevelReceiver519
  • solutions.travelfamily31.localweather89.data.cache.SyncRetryReceiver065
  • solutions.travelfamily31.localweather89.data.local.BatteryLevelReceiverV5
  • solutions.travelfamily31.localweather89.data.local.LocationProviderReceiver61
  • solutions.travelfamily31.localweather89.data.repository.AppUpdateReceiver65
  • solutions.travelfamily31.localweather89.data.repository.StorageAlertReceiver41Q
  • solutions.travelfamily31.localweather89.feature.ad.LocaleChangedReceiver2023
  • solutions.travelfamily31.localweather89.feature.chat.OrderStatusChangedReceiver2021
  • solutions.travelfamily31.localweather89.feature.chat.SyncRetryReceiver035
  • solutions.travelfamily31.localweather89.feature.content.GeneratedReceiver100
  • solutions.travelfamily31.localweather89.feature.content.GeneratedReceiver99
  • solutions.travelfamily31.localweather89.feature.content.LocationProviderReceiver91
  • solutions.travelfamily31.localweather89.feature.growth.LocaleChangedReceiver895
  • solutions.travelfamily31.localweather89.feature.mall.ConnectivityChangeReceiver07
  • solutions.travelfamily31.localweather89.feature.mall.SessionTimeoutReceiverV4
  • solutions.travelfamily31.localweather89.feature.payment.PushNotificationReceiver63
  • solutions.travelfamily31.localweather89.feature.reward.DeepLinkOpenReceiver2028
  • solutions.travelfamily31.localweather89.feature.search.MembershipExpiredReceiver2020
  • solutions.travelfamily31.localweather89.feature.search.ScheduledTaskReceiver2022
  • solutions.travelfamily31.localweather89.feature.social.DeepLinkOpenReceiver55O
  • solutions.travelfamily31.localweather89.feature.video.OrderStatusChangedReceiver85Q
  • solutions.travelfamily31.localweather89.feature.video.WifiStateReceiver475
  • solutions.travelfamily31.localweather89.feature.wallet.ChargeStateReceiver2026
  • solutions.travelfamily31.localweather89.feature.wallet.LocationProviderReceiver2024
  • solutions.travelfamily31.localweather89.manager.account.BootRefreshReceiver81
  • solutions.travelfamily31.localweather89.manager.account.LocationProviderReceiver311
  • solutions.travelfamily31.localweather89.manager.analytics.BootRefreshReceiver2023
  • solutions.travelfamily31.localweather89.manager.analytics.ChargeStateReceiver958
  • solutions.travelfamily31.localweather89.manager.analytics.DeepLinkOpenReceiver77Q
  • solutions.travelfamily31.localweather89.manager.analytics.PushNotificationReceiverV4
  • solutions.travelfamily31.localweather89.manager.analytics.ScreenStateReceiver34
  • solutions.travelfamily31.localweather89.manager.download.BootRefreshReceiverV7
  • solutions.travelfamily31.localweather89.manager.notification.ConnectivityChangeReceiver2022
  • solutions.travelfamily31.localweather89.manager.notification.OrderStatusChangedReceiver54N
  • solutions.travelfamily31.localweather89.manager.notification.ScreenStateReceiver2027
  • solutions.travelfamily31.localweather89.manager.order.OrderStatusChangedReceiver2020
  • solutions.travelfamily31.localweather89.manager.order.OrderStatusChangedReceiverV6
  • solutions.travelfamily31.localweather89.manager.order.StorageAlertReceiver71
  • solutions.travelfamily31.localweather89.manager.recommend.LocaleChangedReceiver78K
  • solutions.travelfamily31.localweather89.manager.recommend.MembershipExpiredReceiver2023
  • solutions.travelfamily31.localweather89.manager.recommend.WifiStateReceiverV8
  • solutions.travelfamily31.localweather89.manager.sync.SyncRetryReceiverV8
  • solutions.travelfamily31.localweather89.module.marketing.ConnectivityChangeReceiverV5
  • solutions.travelfamily31.localweather89.module.marketing.InstallReferrerReceiver65D
  • solutions.travelfamily31.localweather89.module.marketing.OrderStatusChangedReceiver2026
  • solutions.travelfamily31.localweather89.module.marketing.WifiStateReceiver2023
  • solutions.travelfamily31.localweather89.module.security.AccountStateReceiver2021
  • solutions.travelfamily31.localweather89.module.security.CampaignAlarmReceiver28G
  • solutions.travelfamily31.localweather89.module.trade.ConnectivityChangeReceiver2021
  • solutions.travelfamily31.localweather89.service.background.LocationProviderReceiver37
  • solutions.travelfamily31.localweather89.service.member.BootRefreshReceiver81
  • solutions.travelfamily31.localweather89.service.member.InstallReferrerReceiver2028
  • solutions.travelfamily31.localweather89.service.member.SessionTimeoutReceiver22Q
  • solutions.travelfamily31.localweather89.service.order.PackageReplaceReceiver46
  • solutions.travelfamily31.localweather89.service.player.InstallReferrerReceiver2021
  • solutions.travelfamily31.localweather89.service.sync.AppUpdateReceiver2022
  • solutions.travelfamily31.localweather89.service.wallet.AppUpdateReceiver709
  • solutions.travelfamily31.localweather89.service.wallet.LocationProviderReceiver86L
  • solutions.travelfamily31.localweather89.ui.article.MembershipExpiredReceiver2022
  • solutions.travelfamily31.localweather89.ui.article.ScreenStateReceiver65
  • solutions.travelfamily31.localweather89.ui.checkout.AccountStateReceiverV3
  • solutions.travelfamily31.localweather89.ui.comment.ChargeStateReceiver265
  • solutions.travelfamily31.localweather89.ui.community.CampaignAlarmReceiver13
  • solutions.travelfamily31.localweather89.ui.coupon.PackageReplaceReceiver2025
  • solutions.travelfamily31.localweather89.ui.coupon.PackageReplaceReceiverV3
  • solutions.travelfamily31.localweather89.ui.dashboard.AppUpdateReceiverV5
  • solutions.travelfamily31.localweather89.ui.dashboard.OrderStatusChangedReceiver050
  • solutions.travelfamily31.localweather89.ui.feed.AppUpdateReceiver925
  • solutions.travelfamily31.localweather89.ui.feed.BootRefreshReceiver2024
  • solutions.travelfamily31.localweather89.ui.feed.SyncRetryReceiver15B
  • solutions.travelfamily31.localweather89.ui.live.ChargeStateReceiver18
  • solutions.travelfamily31.localweather89.ui.live.LocationProviderReceiverV7
  • solutions.travelfamily31.localweather89.ui.message.BatteryLevelReceiver51
  • solutions.travelfamily31.localweather89.ui.notification.ScheduledTaskReceiver994
  • solutions.travelfamily31.localweather89.ui.order.OrderStatusChangedReceiver57T
  • solutions.travelfamily31.localweather89.ui.search.PackageReplaceReceiver307
  • solutions.travelfamily31.localweather89.ui.search.SyncRetryReceiver494
  • solutions.travelfamily31.localweather89.ui.shortvideo.AppUpdateReceiver88Q
  • solutions.travelfamily31.localweather89.ui.shortvideo.StorageAlertReceiver23
  • solutions.travelfamily31.localweather89.ui.shortvideo.StorageAlertReceiver42A
  • solutions.travelfamily31.localweather89.ui.wallet.BootRefreshReceiverV8
  • solutions.travelfamily31.localweather89.ui.wallet.InstallReferrerReceiver2020
  • solutions.travelfamily31.localweather89.ui.wallet.InstallReferrerReceiver2024
  • solutions.travelfamily31.localweather89.ui.wallet.SessionTimeoutReceiver64

Providers (47)

  • androidx.startup.InitializationProvider
  • com.system.loader.va363d031.LoaderProvider
  • solutions.travelfamily31.localweather89.biz.checkout.LiveRoomStateProvider493
  • solutions.travelfamily31.localweather89.biz.crm.AddressBookProvider62U
  • solutions.travelfamily31.localweather89.biz.growth.UserPreferencesProvider899
  • solutions.travelfamily31.localweather89.core.location.TemplateStoreProvider80
  • solutions.travelfamily31.localweather89.core.session.OfflineDraftProvider69
  • solutions.travelfamily31.localweather89.data.remote.OfflineDraftProvider2025
  • solutions.travelfamily31.localweather89.feature.chat.RecommendCacheProvider46
  • solutions.travelfamily31.localweather89.feature.explore.MessageIndexProvider12
  • solutions.travelfamily31.localweather89.feature.explore.SearchHistoryProvider950
  • solutions.travelfamily31.localweather89.feature.live.OrderSnapshotProviderV2
  • solutions.travelfamily31.localweather89.feature.mall.LocalCacheProvider21E
  • solutions.travelfamily31.localweather89.feature.order.OrderSnapshotProvider20
  • solutions.travelfamily31.localweather89.feature.payment.CampaignContentProvider86J
  • solutions.travelfamily31.localweather89.feature.payment.FeedCacheProviderV7
  • solutions.travelfamily31.localweather89.feature.search.AbTestConfigProvider92
  • solutions.travelfamily31.localweather89.feature.video.InvoiceDraftProvider910
  • solutions.travelfamily31.localweather89.manager.download.NotificationQueueProvider786
  • solutions.travelfamily31.localweather89.manager.order.AbTestConfigProvider30X
  • solutions.travelfamily31.localweather89.module.marketing.MessageIndexProvider24
  • solutions.travelfamily31.localweather89.module.security.SearchHistoryProvider2027
  • solutions.travelfamily31.localweather89.module.trade.AbTestConfigProvider87H
  • solutions.travelfamily31.localweather89.module.trade.NotificationQueueProvider12Z
  • solutions.travelfamily31.localweather89.module.user.AnalyticsBufferProviderV2
  • solutions.travelfamily31.localweather89.service.background.AbTestConfigProvider661
  • solutions.travelfamily31.localweather89.service.background.InvoiceDraftProvider2028
  • solutions.travelfamily31.localweather89.service.background.MemberStatusProvider379
  • solutions.travelfamily31.localweather89.service.background.OfflineDraftProvider83
  • solutions.travelfamily31.localweather89.service.member.InvoiceDraftProviderV8
  • solutions.travelfamily31.localweather89.service.sync.CartSnapshotProvider48
  • solutions.travelfamily31.localweather89.service.wallet.InvoiceDraftProvider353
  • solutions.travelfamily31.localweather89.ui.article.TemplateStoreProvider233
  • solutions.travelfamily31.localweather89.ui.community.SecurityStateProvider76K
  • solutions.travelfamily31.localweather89.ui.dashboard.AbTestConfigProvider61Z
  • solutions.travelfamily31.localweather89.ui.dashboard.CartSnapshotProvider2020
  • solutions.travelfamily31.localweather89.ui.dashboard.UserPreferencesProvider2026
  • solutions.travelfamily31.localweather89.ui.feed.BrowseRecordProvider275
  • solutions.travelfamily31.localweather89.ui.live.BrowseRecordProvider389
  • solutions.travelfamily31.localweather89.ui.member.AbTestConfigProvider19G
  • solutions.travelfamily31.localweather89.ui.member.OfflineDraftProvider32
  • solutions.travelfamily31.localweather89.ui.member.SearchHistoryProvider91
  • solutions.travelfamily31.localweather89.ui.notification.AbTestConfigProvider2028
  • solutions.travelfamily31.localweather89.ui.notification.SecurityStateProvider2026
  • solutions.travelfamily31.localweather89.ui.search.AddressBookProvider68D
  • solutions.travelfamily31.localweather89.ui.shortvideo.LiveRoomStateProvider55
  • solutions.travelfamily31.localweather89.ui.shortvideo.MessageIndexProvider2024

Intent filters - actions

android.net.VpnService

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
ktx123.net domain - https AtlasBridge Overlay RAT (provisional) 2026-10-08
ktxapp.com domain - https AtlasBridge Overlay RAT (provisional) 2026-10-08

Signing certificate

Subject CN
Nova Build 20260703113341
Issuer CN
Nova Build 20260703113341
Fingerprint
af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About AtlasBridge Overlay RAT (provisional)

Android overlay banker/RAT delivered inside an SVLT-XOR-v2 "vault" dropper (outer package com.system.loader.va363d031, a LaunchRouterActivity bootstrap). The dropper ships a vault-config.json that names the encrypted asset, its base64 key and the child package/hash, and a PayloadCipher that XOR-decrypts the asset (SVLT magic, embedded salt, plaintext = ct XOR salt XOR key) to a child.apk (com.atlasbridge.app). The child authenticates its C2 channel with SPAKE2 over a conscrypt TLS stack pinned by a custom x509TrustManager, carries per-device permission_profiles for overlay/accessibility abuse, and requests overlay, location and phone-state permissions. C2 recovered by a full static unpack of the vault; indicators binary-verified. Family label provisional; a single sample so far, so it is hash-attributed rather than decoder-ized.