YuanKong RAT: the Android remote-control service that stamps its operators' names into every build
YuanKong is a multi-tenant Android remote access trojan whose dropper stores decryption keys in cleartext configuration files. The malware uses a two-key XOR scheme to unpack payloads signed with a shared certificate across all operator builds. Each build embeds operator account identifiers as hardcoded string constants, including account IDs, operator handles, and enrollment codes that are transmitted to command-and-control servers. Analysis of 110 dropper samples revealed 57 distinct payloads belonging to 42 different operator accounts. The RAT steals credentials through screen capture, accessibility service abuse, and overlay attacks while escalating privileges by self-pairing with the device's own ADB daemon to obtain shell access. It communicates via Socket.IO over WebSocket with a shared set of C2 domains.
Pulse ID: 6ad241d9f4cd3e84da0dbd3c
Pulse Link: https://otx.alienvault.com/pulse/6ad241d9f4cd3e84da0dbd3c
Pulse Author: AlienVault
Created: 2026-10-16 15:25:13
Be advised, this data is unverified and should be considered preliminary. Always do further verification.