YuanKong RAT is an Android-based Remote Access Trojan (RAT) designed to provide attackers with extensive remote control over compromised devices and facilitate credential theft, surveillance, and financial fraud. According to STAR Labs’ analysis, the malware operates through a multi-tenant model in which operators share a common codebase while individual builds contain operator-specific identifiers. The investigation examined 110 malicious dropper samples containing 57 distinct payloads associated with 42 operator accounts. The malware can capture sensitive information, monitor user activity, access device data, and manipulate applications, posing significant risks to individual users and organizations that rely on Android devices for banking, authentication, and business operations.
The infection process involves a dropper containing an encrypted child APK and a vault-config.json configuration file that stores the decryption key and initialization vector. The payload can be extracted through static analysis because its custom two-key XOR transformation provides weak protection. Once deployed, YuanKong RAT communicates with its command-and-control infrastructure using Socket.IO over WebSockets and transmits device telemetry alongside operator-specific identifiers. Its capabilities include screen capture, keystroke and PIN collection, notification and one-time-password theft, clipboard monitoring, file access, and location tracking. The malware also abuses Android Accessibility Services to automate user interactions and can exploit Wireless Debugging and on-device Android Debug Bridge (ADB) pairing to obtain shell-level execution capabilities without necessarily gaining root privileges.[/subscribe_to_unlock_form]
YuanKong RAT is an Android-based Remote Access Trojan (RAT) designed to provide attackers with extensive remote control over compromised devices and facilitate credential theft, surveillance, and financial fraud. According to STAR Labs’ analysis, the malware operates through a multi-tenant model in which operators share a common codebase while individual builds contain operator-specific identifiers. The investigation examined 110 malicious dropper samples containing 57 distinct payloads associated with 42 operator accounts. The malware can capture sensitive information, monitor user activity, access device data, and manipulate applications, posing significant risks to individual users and organizations that rely on Android devices for banking, authentication, and business operations.
The infection process involves a dropper containing an encrypted child APK and a vault-config.json configuration file that stores the decryption key and initialization vector. The payload can be extracted through static analysis because its custom two-key XOR transformation provides weak protection. Once deployed, YuanKong RAT communicates with its command-and-control infrastructure using Socket.IO over WebSockets and transmits device telemetry alongside operator-specific identifiers. Its capabilities include screen capture, keystroke and PIN collection, notification and one-time-password theft, clipboard monitoring, file access, and location tracking. The malware also abuses Android Accessibility Services to automate user interactions and can exploit Wireless Debugging and on-device Android Debug Bridge (ADB) pairing to obtain shell-level execution capabilities without necessarily gaining root privileges.[emaillocker id="1283"]
YuanKong RAT can enable unauthorized financial transactions, account compromise, persistent surveillance, and the theft of sensitive personal or organizational information. Organizations should monitor suspicious application installations, unauthorized Accessibility Service permissions, unexpected Wireless Debugging activation, unusual ADB pairing activity, and outbound connections to known malicious infrastructure. Security teams should correlate mobile telemetry with network indicators, investigate suspicious applications, and isolate potentially compromised devices while preserving forensic evidence. Users should install applications only from trusted sources, review sensitive permissions regularly, and change potentially exposed credentials from a clean device. If banking credentials or payment PINs may have been compromised, affected financial institutions should be notified immediately.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Execution | T1059.006 | Command and Scripting Interpreter | Python |
| Privilege Escalation | T1547.001 | Alter Security Configuration | Modify Registry |
| Defense Evasion | T1027.002 | Obfuscated Files or Information | Software Packing |
| Discovery | T1082 | Audit Log Discovery | - |
| Collection | T1119 | Automated Collection | - |
| Collection | T1056.004 | Input Capture | Keylogging |
| Collection | T1056.001 | Input Capture | Keylogging |
| Collection | T1056.003 | Input Capture | Web Browser |
| Collection | T1056.002 | Input Capture | Clipboard Data |
| Collection | T1056.005 | Input Capture | Clipboard Data |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
The following reports contain further technical details:
[/emaillocker]