YuanKong RAT: the Android remote-control service that stamps its operators' names into every build

YuanKong RAT is an Android remote access trojan whose dropper stores decryption keys in cleartext configuration files. It uses a two-key XOR scheme to unpack payloads signed with a shared certificate across all operator builds. Each build hardcodes operator account identifiers such as account IDs, operator handles, and enrollment codes, which are transmitted to command-and-control servers. Analysis of 110 dropper samples identified 57 distinct payloads linked to 42 different operator accounts. The RAT steals credentials through screen capture, accessibility service abuse, and overlay attacks. It escalates privileges by self-pairing with the device's own ADB daemon to obtain shell access. Communication with C2 servers is via Socket.IO over WebSocket using a shared set of domains.

The malware enables attackers to remotely control infected Android devices, steal user credentials through multiple techniques including screen capture and overlay attacks, and escalate privileges to gain shell access via ADB daemon pairing. This compromises device confidentiality, integrity, and potentially allows full device control by multiple distinct operator accounts.

No official patch or remediation is indicated. Mitigation should focus on detecting and blocking known command-and-control domains and IPs associated with YuanKong RAT. Users should avoid installing untrusted applications and monitor for suspicious accessibility service usage or overlay behaviors. Since this is malware, remediation involves device cleanup and removal of the infection.