C2Tracker

6e562f3028b5c124bd487f90…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

CloudSettle Tunnel RAT (provisional). India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional. Indicators: wss://api.cloudsettle.org/ws/tunnel/.

Recovered configuration

aes_gcm_key
1efedd5c344e4d5c1b10c69556bc78b920db90bb6e1db404667dcf3b88d00617
c2_transport
WebSocket (wss)
delivers
CloudSettle Tunnel RAT
dropper_package
com.batch.deploy
lure
शुभ विवाहः
package
com.batch.deploy
packer
XOR16 + 4-pass-KSA RC4 + AES-256-GCM (key = two hardcoded arrays XORed) -> MSZ1/zlib -> MSP1 bundle

Identification

SHA-256
6e562f3028b5c124bd487f90dbb92634d6315148b647b8a42457657aa9fe2818
MD5
7c428b1aa7121e1ac56d71389c6f8426

Observed

Families
CloudSettle Tunnel RAT (provisional)
First seen
2026-10-04

APK metadata

Summary

Type
Android · APK
Package
com.batch.deploy
Main activity
com.batch.deploy.z
Internal version
499
Displayed version
3.9.24
Min SDK
24
Target SDK
37

Signing certificate

Valid from
2026-10-04 09:41:07
Valid to
2058-02-15 09:41:07
Serial
95abb3fee4f66d2a
Thumbprint
c490b7544333a84867ba59161a069e44af535286
Subject
C:IN, CN:DailyTools Software, L:Nagpur, O:Maple Labs, ST:Maharashtra
Issuer
C:IN, CN:DailyTools Software, L:Nagpur, O:Maple Labs, ST:Maharashtra

Permissions (11)

android.permission.ACCESS_NETWORK_STATEandroid.permission.CHANGE_NETWORK_STATEandroid.permission.CHANGE_WIFI_STATEandroid.permission.FLASHLIGHTandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.INTERNETandroid.permission.REORDER_TASKSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTIONandroid.permission.WAKE_LOCK

Activities (5)

  • com.batch.deploy.a
  • com.batch.deploy.fl
  • com.batch.deploy.ja
  • com.batch.deploy.l8
  • com.batch.deploy.z

Services (1)

  • com.batch.deploy.o

Receivers (1)

  • com.batch.deploy.f

Providers (1)

  • com.batch.deploy.ja9

Intent filters — actions

android.net.VpnService

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 — each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.cloudsettle.org/ws/tunnel/ domain — wss CloudSettle Tunnel RAT (provisional) 2026-10-04

Signing certificate

Subject CN
DailyTools Software
Issuer CN
DailyTools Software
Fingerprint
36d525cd961c4d0642650bb151b7e336e7666b3e165e56b55a4fd271d7b3d825

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About CloudSettle Tunnel RAT (provisional)

India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional.