C2Tracker

6d0282f31c8a521ef4c1db4e…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

CloudSettle Tunnel RAT (provisional). India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional. Indicators: wss://api.cloudsettle.org/ws/tunnel/.

Recovered configuration

aes_gcm_key
5f3f105094eba583b55cdbc489c09fbb660e7c2cc270b1c7abc585ae31ab6737
c2_transport
WebSocket (wss)
delivers
CloudSettle Tunnel RAT
dropper_package
com.batch.client
lure
Vivah Utsav
package
com.batch.client
packer
XOR16 + 4-pass-KSA RC4 + AES-256-GCM (key = two hardcoded arrays XORed) -> MSZ1/zlib -> MSP1 bundle

Identification

SHA-256
6d0282f31c8a521ef4c1db4e5a254243e6a8fd8b1170f32d3dc4af2bf4cb75d9
MD5
72612b7c94d3de8ea515b4a09e0fd356

Observed

Families
CloudSettle Tunnel RAT (provisional)
First seen
2026-09-20

APK metadata

Summary

Type
Android · APK
Package
com.batch.client
Main activity
com.batch.client.f
Internal version
448
Displayed version
4.4.44
Min SDK
24
Target SDK
37

Signing certificate

Valid from
2026-09-20 11:58:13
Valid to
2042-03-12 11:58:13
Serial
9e790f52fb17a243
Thumbprint
58c65048e92f580b0adf972e1fdc75bf44653526
Subject
C:DE, CN:MetroSoft Solutions, L:Berlin, O:UrbanCraft Apps, ST:Berlin
Issuer
C:DE, CN:MetroSoft Solutions, L:Berlin, O:UrbanCraft Apps, ST:Berlin

Permissions (13)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.BLUETOOTH_ADMINandroid.permission.FLASHLIGHTandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.INTERNETandroid.permission.REORDER_TASKSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTIONandroid.permission.USE_FINGERPRINTandroid.permission.VIBRATEandroid.permission.WAKE_LOCK

Activities (4)

  • com.batch.client.dch
  • com.batch.client.f
  • com.batch.client.o
  • com.batch.client.xe

Services (1)

  • com.batch.client.yq

Receivers (1)

  • com.batch.client.b

Providers (1)

  • com.batch.client.on

Intent filters — actions

android.net.VpnService

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.cloudsettle.org/ws/tunnel/ domain — wss CloudSettle Tunnel RAT (provisional) 2026-09-20

Signing certificate

Subject CN
MetroSoft Solutions
Issuer CN
MetroSoft Solutions
Fingerprint
f25215878df45fe6e1ff0ca5f565c6a4ad2cc8a7256b6d5d132e50b5119e1083

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About CloudSettle Tunnel RAT (provisional)

India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional.