bf005cdc3a127ca240d0c12c…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

RemoteControl SDK RAT. Android remote-control / screen-capture RAT distributed as dpt-shell-packed APKs (ProxyApplication loader, assets/d_shell_data_001, obfuscated org. package names, main tt.kk.uas.qaa.SplashActivity). The real payload lives under the asdf.ump.stdf namespace: a RemoteControlSdk with HTTP control plus multiple WebSocket channels (controlWsBaseUrl, captureWsBaseUrl, auditWsBaseUrl, realtimeWsBaseUrl) and an apkUploadBaseUrl, driven by a SERVER_BASE_URL config. Capabilities implied by the SDK: live screen capture, realtime remote control, activation/task management (HomeActivation*) and remote APK push. C2 base URLs were recovered from the intact dpt-shell dex string pool (method bytecode is XOR-encrypted but the string pool stays readable): HTTP C2 https://lfga.constapr.com, WebSocket C2 wss://xnko.constapr.com, plus 713c1.constapr.com and a908cccc.atrnu.top. Indicators: https://lfga.constapr.com, wss://xnko.constapr.com, a908cccc.atrnu.top.

Recovered configuration

app_class

*.ProxyApplication (dpt-shell)

main

tt.kk.uas.qaa.SplashActivity

namespace

asdf.ump.stdf

native

librc_ka.so, libmmkv.so, libsentry

package

org.pjl34i5w.lknshydv.uz9n489i.ozl6q8hc

Identification

SHA-256: bf005cdc3a127ca240d0c12c386cabf90297a816c11ed303a33f2de052bd57e9
MD5: 687c495094595603ea0795c31639efb3

Observed

Families: RemoteControl SDK RAT
First seen: 2026-09-22

C2 configuration (3)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
a908cccc.atrnu.top	domain	-	-	RemoteControl SDK RAT	2026-09-22
lfga.constapr.com	domain	-	https	RemoteControl SDK RAT	2026-09-22
xnko.constapr.com	domain	-	wss	RemoteControl SDK RAT	2026-09-22

Signing certificate

Subject CN: jffk
Issuer CN: -
Fingerprint: 2a9ddd06f9131e2b8e11ad5fc21e0f94326873dc384a7e90ae41a77a54815ee0

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About RemoteControl SDK RAT

Android remote-control / screen-capture RAT distributed as dpt-shell-packed APKs (ProxyApplication loader, assets/d_shell_data_001, obfuscated org.<random> package names, main tt.kk.uas.qaa.SplashActivity). The real payload lives under the asdf.ump.stdf namespace: a RemoteControlSdk with HTTP control plus multiple WebSocket channels (controlWsBaseUrl, captureWsBaseUrl, auditWsBaseUrl, realtimeWsBaseUrl) and an apkUploadBaseUrl, driven by a SERVER_BASE_URL config. Capabilities implied by the SDK: live screen capture, realtime remote control, activation/task management (HomeActivation*) and remote APK push. C2 base URLs were recovered from the intact dpt-shell dex string pool (method bytecode is XOR-encrypted but the string pool stays readable): HTTP C2 https://lfga.constapr.com, WebSocket C2 wss://xnko.constapr.com, plus 713c1.constapr.com and a908cccc.atrnu.top.