C2Tracker

48bf67f14bd62bfcd2455455…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

CloudSettle Tunnel RAT (provisional) — an Android remote-access trojan (RAT), distributed as com.batch.helper.main, self-signed as “Moonlight Studios”. It installs further packages. Communicates with 1 operator endpoint. India-targeted Android device-tunnel RAT delivered by a heavily layered native dropper, disguised as a wedding-invitation / guest-registration app (app label “Wedding-Ceremoney”, app_type “weddingv2luxsuper”, a Rs 1 “Guest Registration Fee” payment lure). The loader (package com.batch.helper.main) hands assets/xdmktnrc to the native method ndsSV in lib/*/libnetbridge.so, which decrypts it in five stages, all reversed statically: (1) body XOR a 16-byte header (asset[0:16]); (2) RC4 with a non-standard 4-pass key schedule (key = asset[16:32]); (3) AES-256-GCM with a fixed key formed by XORing two hardcoded 32-byte arrays (b758c31fdfc974c214ea35d8b65a7e576f900bc76738aa6915f658f66bcd0226), GCM tag verified; (4) a zlib-wrapped “MSZ1” container; (5) an “MSP1” bundle holding base.apk. The native lib separately computes SHA-256 of the signing certificate purely as a tamper check. The recovered base.apk connects to a WebSocket device tunnel at wss://api.cloudsettle.org/ws/tunnel/device- with an HTTPS API at https://api.cloudsettle.org, and targets Indian banking (Federal Bank, federalbank.org). All C2 indicators binary-verified by full static unpack of all five layers (AES-GCM MAC validated). Family label provisional. Indicators: wss://api.cloudsettle.org/ws/tunnel/.

Recovered configuration

anti_tamper
SHA-256 of signing certificate
https_api
https://api.cloudsettle.org
lure
wedding invitation / guest registration (Rs 1 fee)
package
com.batch.helper.main
packer
5-layer native (XOR+RC4-4pass+AES-GCM+zlib MSZ1+MSP1 bundle, key from libnetbridge.so)
targets
Indian banking (Federal Bank)
websocket_c2
wss://api.cloudsettle.org/ws/tunnel/device-<id>

Identification

SHA-256
48bf67f14bd62bfcd2455455a84e458ff6460db8d03cae3cc80d18be910fdb3c
MD5
6a45249b3ef638e5855f5706ce319fa9

Observed

Families
CloudSettle Tunnel RAT (provisional)
First seen
2026-10-05

APK metadata

Summary

Type
Android · APK
Package
com.batch.helper.main
Main activity
com.batch.helper.main.s2
Internal version
454
Displayed version
4.2.77
Min SDK
24
Target SDK
37

Signing certificate

Valid from
2026-10-04 23:54:52
Valid to
2057-09-13 23:54:52
Serial
efead0514414daa4
Thumbprint
9e067a70cc81012d2896bd1d8658efd443c5a9de
Subject
C:IN, CN:HappyByte Labs, L:Vadodara, O:Moonlight Studios, ST:Gujarat
Issuer
C:IN, CN:HappyByte Labs, L:Vadodara, O:Moonlight Studios, ST:Gujarat

Permissions (11)

android.permission.ACCESS_NETWORK_STATEandroid.permission.CHANGE_WIFI_STATEandroid.permission.FLASHLIGHTandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.INTERNETandroid.permission.REORDER_TASKSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTIONandroid.permission.USE_FINGERPRINTandroid.permission.WAKE_LOCK

Activities (5)

  • com.batch.helper.main.e
  • com.batch.helper.main.l
  • com.batch.helper.main.s2
  • com.batch.helper.main.sw
  • com.batch.helper.main.zw5

Services (1)

  • com.batch.helper.main.y1

Receivers (1)

  • com.batch.helper.main.s

Providers (1)

  • com.batch.helper.main.z

Intent filters — actions

android.net.VpnService

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.cloudsettle.org/ws/tunnel/ domain — wss CloudSettle Tunnel RAT (provisional) 2026-10-05

Signing certificate

Subject CN
HappyByte Labs
Issuer CN
HappyByte Labs
Fingerprint
23a9ed597362579e8258f031fa5afaa759e5e8f866ef7a80d1b4e393a662e8d1

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.