ACTAndroid C2 Tracker

86b4dcd83121236a750c3599…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

CloudSettle Tunnel RAT (provisional). India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional. Indicators: wss://api.cloudsettle.org/ws/tunnel/.

Recovered configuration

aes_gcm_key
a7bc191749aa75c204cd7bddf435e531ff00d5f46b2c79818d64d66c39fe4825
delivers
CloudSettle Tunnel RAT
packer
XOR16 + 4-pass-KSA RC4 + AES-256-GCM -> MSZ1/zlib -> MSP1 bundle

Identification

SHA-256
86b4dcd83121236a750c3599f23004dcbc5a3c4b1b30fed7d40ad6da1464d9e7
MD5
08a0f17f687d68889a3bcbfad56a8624

Observed

Families
CloudSettle Tunnel RAT (provisional)
First seen
2026-10-08

APK metadata

Summary

Type
Android · APK
Package
com.batch.agent
Main activity
com.batch.agent.yp
Internal version
316
Displayed version
4.2.74
Min SDK
24
Target SDK
37

Signing certificate

Valid from
2026-10-08 06:32:13
Valid to
2054-05-02 06:32:13
Serial
8d71c9d15474c1ea
Thumbprint
bc63f7b2cbcbaf864ac0ec8bd210c3b73b0da7e0
Subject
C:IN, CN:Silverline Studios, L:Pune, O:DailyTools Software, ST:Maharashtra
Issuer
C:IN, CN:Silverline Studios, L:Pune, O:DailyTools Software, ST:Maharashtra

Permissions (11)

android.permission.ACCESS_NETWORK_STATEandroid.permission.ACCESS_WIFI_STATEandroid.permission.BLUETOOTH_ADMINandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.INTERNETandroid.permission.REORDER_TASKSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTIONandroid.permission.USE_BIOMETRICandroid.permission.WAKE_LOCK

Activities (5)

  • com.batch.agent.q
  • com.batch.agent.s
  • com.batch.agent.tq
  • com.batch.agent.wj
  • com.batch.agent.yp

Services (1)

  • com.batch.agent.qt

Receivers (1)

  • com.batch.agent.h

Providers (1)

  • com.batch.agent.d

Intent filters - actions

android.net.VpnService

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.cloudsettle.org/ws/tunnel/ domain - wss CloudSettle Tunnel RAT (provisional) 2026-10-08

Signing certificate

Subject CN
Silverline Studios
Issuer CN
Silverline Studios
Fingerprint
2d6e577e454bf5fe9a64a5b4bcd4d64293d8cc9f0fee5a443a69f08595e8c278

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About CloudSettle Tunnel RAT (provisional)

India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional.