Star Labs details YuanKong Android banking RAT

Star Labs says YuanKong steals banking PINs via Accessibility and overlays and links samples to 42 operators.

Star Labs analyzed YuanKong, an Android remote-access Trojan that uses Accessibility services, screen capture or streaming, remote taps, clipboard access, and fake keypad or payment overlays to steal passwords and PINs. Both reports agree that 110 droppers and 57 child payloads share one signing certificate and connect to 42 operator accounts; the later report additionally identifies 44 rotating brands. A hidden child app is recovered with a simple XOR scheme, which the later report specifies as a two-key XOR with a plaintext key and IV in assets/vault-config.json. The payload communicates over Socket.IO WebSockets to apppanda.xyz, ktxapp.com, and ktx123.net; the earlier report describes TLS-protected JSON, and the later report adds the address 206.82.1.14. It can enable Wireless Debugging and obtain a non-root ADB shell, and the later analysis says it lacks SMS, contacts, camera, and microphone permissions while exposing operator account IDs. The sources do not disagree on the core counts, and neither establishes the initial lure or the number of infected phones.

• Star Labs analyzed YuanKong, an Android RAT that abuses Accessibility services, screen capture or streaming, remote taps, clipboard access, and fake keypad or payment overlays to steal passwords and PINs.
• Researchers examined 110 droppers and 57 child payloads signed with the same certificate and linked them to 42 operator accounts; the later report also cites 44 rotating brands.
• Shared command-and-control hosts are apppanda.xyz, ktxapp.com, and ktx123.net; the later report also lists 206.82.1.14 and Socket.IO WebSockets, while the earlier report describes TLS-protected JSON.
• The dropper hides a child app recovered with a simple XOR scheme, described more specifically in the later report as a two-key XOR using a plaintext key and IV in assets/vault-config.json.
• After enabling Wireless Debugging, YuanKong can pair with the device’s own ADB for shell-level access that is not root.
• The later report says the RAT lacks SMS, contacts, camera, and microphone permissions and that operator account IDs are exposed.
• Neither report establishes the initial lure or how many phones were infected.