# YuanKong Android RAT: Accessibility-Driven Remote Control, Overlay Credential Theft and Wireless Debugging Self-Pairing, With Operator Identities Embedded in Every Build

> STAR Labs analyzed YuanKong, an Android remote access trojan delivered by 110 weakly protected 'Nova' droppers (57 distinct child payloads, 44 rotating build brands, 42 operator accounts). It abuses Accessibility Services for screen streaming, overlay PIN/payment credential capture and remote UI control, and escalates to shell-level access by pairing with the device's own Wireless Debugging service.

- **Published:** 2026-10-17T14:01:23Z
- **Last reviewed:** 2026-10-17T14:01:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3810
- **ID:** TL-2026-3810
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

YuanKong is an Android remote-control trojan analyzed by STAR Labs (October 2026). It is delivered through 'Nova' droppers (example loader package com.system.loader.va363d031) signed with a throwaway certificate (CN=Nova Build 20260703113341, OU=APK Factory, O=Nova, L=Singapore, C=SG). The dropper carries the child APK in an encrypted vault whose parameters are stored in plaintext in assets/vault-config.json. The 'SVLT-XOR-v2' routine is a two-key XOR (plaintext[i] = ciphertext[i] ^ key[i % keylen] ^ iv[i % ivlen]) with the key and IV in the same file, so the child APK (payload/child.apk inside a decrypted ZIP) can be recovered statically without running the sample. Across 110 droppers STAR Labs recovered 57 distinct child payloads, all signed with one shared certificate (CN=Remote Control, OU=Dev, O=YuanKong, L=Beijing, ST=Beijing, C=CN; SHA-256 73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387) and presenting under 44 rotating brand names.

The child (application class com.remote.control.RemoteControlApp) is a multi-tenant remote-control service. Each build hardcodes an operator account ID, account name and six-digit enrollment code as string constants in its configuration class; these values are included in C2 telemetry whenever the foreground app changes. That exposed 42 distinct operator accounts (for example handles lichunfeng7, xx7876 and laiqian2-001). C2 traffic is Socket.IO/Engine.IO over WebSocket (okhttp, wss) carrying typed JSON ControlMessage objects (AUTH, HEARTBEAT, RELIABLE_DATA_BATCH, RELIABLE_DATA_ACK) with no application-layer encryption beyond TLS. The shared relay set is apppanda.xyz, ktxapp.com and ktx123.net (plus www aliases for the latter two), and a hardcoded IP, 206.82.1.14, to which the domains resolved on 2026-10-15.

Capabilities: Accessibility-based UI inspection, password-field detection and keystroke capture (TYPE_VIEW_TEXT_CHANGED); gesture injection (click, long click, swipe, key input, back/home/recents); full and thumbnail screen capture, live screen streaming and a black-screen overlay; overlay keypads and HTML overlays that capture PINs and payment PINs (touch coordinates are mapped to keypad positions to infer PIN entry); clipboard and notification/OTP monitoring; location retrieval; file list/download/upload/delete/rename; app launching and lock-screen control. Data is stored locally in a Room database (PaymentPinRecord, KeyInputRecord, TouchRecord, AppUsageRecord, EventLogRecord) and queued as RELIABLE_DATA_BATCH when the socket is down. The sample declares no SMS, contacts, call-log, camera or microphone permissions and relies on UI control instead.

Privilege escalation does not use a software vulnerability. After obtaining Accessibility access the app turns on Wireless Debugging (Settings.Global adb_wifi_enabled=1, kept enabled by a GuardianService), parses the system pairing dialog through the accessibility node tree to extract the six-digit pairing code and port, and uses the embedded libadb-android library to complete a SPAKE2 pairing with the local adbd (127.0.0.1:5555, runtime-derived AES-128-GCM session key). Over the resulting shell channel (uid 2000, not root) it runs pm grant for WRITE_SECURE_SETTINGS, DUMP and PACKAGE_USAGE_STATS, whitelists itself from doze, and writes /data/local/tmp/remote_control_daemon.sh, a loop that restarts ConnectionService and sets oom_adj -17 / oom_score_adj -1000. Panel commands include LOCAL_ADB_ACTIVATE, LOCAL_ADB_PREPARE and LOCAL_ADB_CAPTURE; ADB screenrecord is used for H.264 streaming.

Persistence and evasion: a device-admin receiver, mutually rebinding foreground services (WatchdogService, KeepAliveMeshService, StealthKeepAliveService, AccountKeepAliveService), HIDE_APP_ICON, opportunistic su escalation on rooted devices, remote uninstall (REQUEST_SELF_UNINSTALL), and a stable device fingerprint persisted in credential-encrypted and direct-boot storage. STAR Labs notes that package names in the configuration (for example com.netflixgratis.app, io.litetube.app) are seed material for device-identity generation, not C2 indicators or confirmed targets, so defenders should not block on those names. STAR Labs compares YuanKong with RatHat (Zimperium, September 2026): both combine Accessibility abuse with local ADB pairing, but RatHat has a separate architecture (raw touch capture via getevent) and there is no evidence of a shared operator or codebase. No CVE is associated; severity is analyst-assigned from the reported capabilities. Actor attribution is not established: the certificate subject and operator handles suggest Chinese-language operators, but these are self-asserted strings.

## MITRE ATT&CK

- T1417.002 GUI Input Capture
- T1417.001 Keylogging
- T1417.002 GUI Input Capture
- T1453 Abuse Accessibility Features
- T1513 Screen Capture
- T1414 Clipboard Data
- T1430 Location Tracking
- T1533 Data from Local System
- T1516 Input Injection
- T1406 Obfuscated Files or Information
- T1628.001 Suppress Application Icon
- T1629.001 Prevent Application Removal
- T1626 Abuse Elevation Control Mechanism
- T1626.001 Device Administrator Permissions
- T1541 Foreground Persistence
- T1623.001 Unix Shell
- T1418 Software Discovery
- T1437.001 Web Protocols
- T1646 Exfiltration Over C2 Channel

## Sources

- [YuanKong RAT: The Android Remote-Control Service That Stamps Its Operators' Names Into Every Build (STAR Labs)](https://starlabs.sg/blog/2026/10-yuankong-rat-the-android-remote-control-service-that-stamps-its-operators-names-into-every-build/)
- [Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data (GBHackers)](https://gbhackers.com/android-remote-access-trojan/)
- [RatHat: AI-Powered Mobile Threat Is Here for Your Credentials and Bank Accounts (Zimperium)](https://zimperium.com/blog/rathat-ai-powered-mobile-threat-is-here-for-your-credentials-bank-accounts)
- [RatHat Turns Android Accessibility Into an Attack Weapon (Security Affairs)](https://securityaffairs.com/199317/malware/rathat-turns-android-accessibility-into-an-attack-weapon.html)
- [MITRE ATT&CK Mobile T1453 Abuse Accessibility Features](https://attack.mitre.org/techniques/T1453/)
- [MITRE ATT&CK Mobile T1417.002 GUI Input Capture](https://attack.mitre.org/techniques/T1417/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3810