New YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords
Star Labs analyzed YuanKong, an Android RAT using Accessibility and overlays to steal banking PINs and passwords.
Star Labs analyzed YuanKong, an Android remote-access Trojan that uses Accessibility services, screen capture, remote taps, clipboard access, and fake keypad or web overlays to steal passwords and payment PINs. A dropper hides a child app decrypted with a simple XOR key, and the payload talks to operators over Socket.IO and WebSocket using TLS-protected JSON. Researchers examined 110 droppers and 57 child payloads signed with the same certificate and tied them to 42 operator accounts. The report does not establish the initial lure or how many phones were infected; local Android Debug Bridge access is described as shell-level, not root.
- YuanKong abuses Accessibility, overlays, and screen control to capture banking PINs.
- Star Labs reviewed 110 droppers and 57 child payloads sharing one certificate.
- Analysts linked 42 operator accounts, but victim count and lure method are unknown.
- It can enable Wireless Debugging and obtain a non-root ADB shell.
- Shared C2 domains include apppanda.xyz, ktxapp.com, and ktx123.net.
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | apppanda.xyz | ors of compromise (IoCs):- Type Indicator Context C2 domain apppanda[.]xyz Shared relay host C2 domain ktxapp[.]com , www[.]ktxapp[. |
| domain | ktx123.net | app[.]com , www[.]ktxapp[.]com Shared relay hosts C2 domain ktx123[.]net , www[.]ktx123[.]net Shared relay hosts C2 IP 206[.]82[.] |
| domain | ktxapp.com | ontext C2 domain apppanda[.]xyz Shared relay host C2 domain ktxapp[.]com , www[.]ktxapp[.]com Shared relay hosts C2 domain ktx123[ |
| domain | socket.io | s YuanKong and connects to command-and-control servers over Socket.IO and WebSocket. Its messages use typed JSON, while transport |
| domain | www.ktx123.net | [.]ktxapp[.]com Shared relay hosts C2 domain ktx123[.]net , www[.]ktx123[.]net Shared relay hosts C2 IP 206[.]82[.]1[.]14 Hardcoded ad |
| domain | www.ktxapp.com | n apppanda[.]xyz Shared relay host C2 domain ktxapp[.]com , www[.]ktxapp[.]com Shared relay hosts C2 domain ktx123[.]net , www[.]ktx12 |
| md5 |
Full article1,048 words · extracted from cybersecuritynews.com · click to collapse
A newly analyzed Android remote-access Trojan called YuanKong can watch and control a victim’s phone, capture passwords and payment PINs, and send stolen information to operators.
Rather than relying on access to text messages or contact lists, it uses Android’s Accessibility features and screen controls to observe what people do inside apps, including banking and payment apps.
Researchers warn that this approach can expose sensitive information even when the user is interacting with a genuine app. The malware is also built to stay active and give operators control from afar.
Its capabilities include screen capture, remote taps and swipes, clipboard access, notification reading, file transfers and location collection.
The examined sample did not request permissions for SMS, contacts, call logs, a camera or a microphone, so its risks come mainly from what it can read and do through the screen and Accessibility access.
Researchers from Star Labs identified and analyzed the malware by examining its Android app files and code. Their investigation covered 110 droppers and 57 distinct child payloads, all signed by the same YuanKong certificate. The samples carried different operator account details, pointing to a shared service that can be used by multiple operators.
New YuanKong Android RAT Hijacks Phones
In the sample examined by Star Labs, the first app acts as a dropper: it contains a hidden child app and installs it after unpacking the payload.
The dropper stores its decryption key and initialization value in a configuration file alongside the encrypted data. The researchers found that the file uses a simple XOR process rather than a strong encryption method, making the child app recoverable from the dropper without contacting the operator’s server.
The extracted child app identifies itself as YuanKong and connects to command-and-control servers over Socket.IO and WebSocket.
Its messages use typed JSON, while transport confidentiality relies on TLS; the analysis found no extra encryption layer for the messages inside that connection. The server can send commands and receive collected data, including screen captures and files.
.webp)
The use of Android’s own debugging feature adds another layer of concern. YuanKong can use Accessibility to enable Wireless Debugging, read the pairing details shown on the phone, and pair with the device’s local Android Debug Bridge service.
This gives it a shell-level session, not root access, which it can use to grant permissions and run a persistence script. Similar misuse of Wireless Debugging has been reported in RedHook’s ADB abuse and other Android malware cases.
How it captures PINs and passwords
YuanKong can read text from Accessibility events, including changes in input fields, and inspect the screen’s accessibility tree for password fields.
It also supports a fake numeric keypad overlay: taps enter the real digits into the malware’s capture buffer while the screen can display masked dots.
For some genuine keypads, the malware can map the positions of digit buttons and use touch coordinates to work out which numbers the victim entered.
Payment PIN theft can also use an overlay. An operator can supply a web page and have it displayed over a selected payment app. If the victim enters a PIN into that imitation screen, YuanKong records the value and can send it to the control server.
These methods are similar in broad purpose—but not necessarily in technical design—to other Android threats that use fake banking screens or Accessibility access, such as RemControl’s banking overlays.
Operators can remotely click, swipe, open apps and lock the screen. YuanKong can also hide its icon, use services that restart one another, resist removal and queue stolen records for later upload if the connection drops.
Its local ADB shell can install a daemon that helps keep the app running. The analysis describes this as escalation to Android’s shell user, not a root exploit.
The researchers traced 42 operator accounts across the samples they reviewed. Account identifiers and enrollment details were compiled into the app and sent in device activity reports, allowing analysts to link builds with particular accounts without accessing the control panel.
The sample analysis does not establish how victims were first lured into installing the apps or how many phones were affected, so those details remain unknown.
For defenders, the shared YuanKong signing certificate and command-and-control host set are stronger family clues than the changing package names and app branding.
Security teams can search for the certificate, the listed domains and IP address, suspicious Wireless Debugging activity, unfamiliar Accessibility services and unexpected remote-control behavior.
The certificate is a useful detection signal, but teams should confirm findings against their own environment before taking action.
Phone users should avoid installing APKs from links or unfamiliar sites, review which apps have Accessibility access, and leave Wireless Debugging off when it is not needed.
If a device may be infected, contact the bank using an official number and change banking passwords from a separate trusted device. Recent reporting on RatHat’s Android control also shows why unusual Accessibility and debugging requests deserve close attention.
Indicators of compromise (IoCs):-
| Type | Indicator | Context |
|---|---|---|
| C2 domain | apppanda[.]xyz | Shared relay host |
| C2 domain | ktxapp[.]com, www[.]ktxapp[.]com | Shared relay hosts |
| C2 domain | ktx123[.]net, www[.]ktx123[.]net | Shared relay hosts |
| C2 IP | 206[.]82[.]1[.]14 | Hardcoded address in family samples |
| Certificate SHA-256 | 73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387 | Shared YuanKong child-app signer |
| Certificate SHA-256 | af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9 | Nova dropper signer in the examined sample |
| Dropper SHA-256 | 675d083b63e2169e8fd0ac0cfd27904005b5e2be00f6e3489f6e47fc4c57a4d1 | Examined dropper |
| Dropper MD5 | 4280a408a7f0490d9d2eaa3f536f339b | Examined dropper |
| Child-app SHA-256 | 12480408006dece2fa756b3572766eecb6fb2144a1226f4e21c4cb7d54383105 | Unpacked net.echorelay.app |
| Child-app MD5 | 2fe7803a60175e27d8a2934c020e6413 | Unpacked child app |
| Vault blob SHA-256 | 5f682a13639b6234bc5dbee43c24085140b4ccacd558884c1460352072d3157f | Encrypted payload asset |
| Additional dropper SHA-256 | d96056e9f00bb82c621be36f6a7c5c1f47cce61d11be141ee976c0092c8693b1 | Second analyzed sample |
| Additional child SHA-256 | 5e4d1980f76e571dd0300b9fa356818f874528fc0517d0d0e0afb7e561904764 | Second sample’s child app |
| App class | com.remote.control.RemoteControlApp | YuanKong child application class |
| Dropper package | com.system.loader.va363d031 | Examined Nova loader |
| C2 transport | Socket.IO/Engine.IO over WebSocket | Persistent control channel |
| Vault marker | SVLT-XOR-v2 | Dropper payload format; key and IV stored in its configuration |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.