New Insights on the YuanKong Android Remote-Access Trojan
A recent analysis has shed light on an Android remote-access Trojan (RAT) named YuanKong, which exhibits alarming security vulnerabilities. The investigation reveals that the Trojan’s dropper, a component responsible for delivering its payload, is weakly protected, exposing critical operator account identifiers inherent in each build. This lack of security not only endangers individual users but also raises concerns about wider implications for cybersecurity.
The research scrutinized a total of 110 droppers associated with YuanKong and unveiled 57 unique child payloads, 42 operator accounts, and 44 rotating build brands. These elements are interconnected through a common signing certificate and a centralized command-and-control (C2) infrastructure. This kind of organization makes it easier for the developers to maintain and manage their malicious activities while complicating tracking efforts for cybersecurity professionals.
One of the noteworthy features of YuanKong is its “SVLT-XOR-v2” routine, which employs a straightforward two-key XOR operation. This methodology enables analysts to extract child APK files statically, bypassing the need to run the malware or connect to its servers. As a result, the loaded application identifies itself as YuanKong, carrying a signature that links all 57 payloads. This shared certificate serves as a vital detection anchor, despite potential variations in package names or branding.
However, perhaps the most striking security flaw lies in YuanKong’s own configuration. Each version of the build possesses an operator account ID, account name, and enrollment code encoded as string constants. This information is not simply a byproduct; YuanKong transmits these fields as telemetry data back to its C2 infrastructure whenever the foreground application is altered. Consequently, a single sample can divulge both the capabilities of the malware and the account associated with its specific build.
Digging deeper, researchers managed to identify 42 distinct accounts utilizing this telemetry method, illustrating how the malware facilitates surveillance without relying on traditional data permissions. Unlike many typical applications, the analyzed YuanKong build lacks permissions to access SMS, contacts, call logs, camera, and microphone functionalities. Instead, it employs Android Accessibility services to scrutinize interface content, capture alterations in text—including activities conducted in password fields—and execute remote interactions such as tapping, swiping, typing, and navigation.
The implication of these capabilities is significant. YuanKong can stream the phone’s screen, read notifications and clipboard data, gather files and location information, and even overlay attacker-supplied windows over specific applications to capture sensitive payment credentials. This behavior presents a considerable risk, especially during financial transactions, where unsuspecting users may unknowingly disclose vital information.
The loader of YuanKong proves to be particularly careless, storing its decryption key and initialization vector in plaintext within an assets directory, revealing further vulnerabilities. Furthermore, it maps touch inputs to on-screen keypad positions, allowing it to infer PIN entry without directly reading digits from the application.
A black-screen overlay technique is also employed, which can obscure remote activities from users, potentially enabling fraudulent actions during banking or financial sessions. Although the analysis has not pinpointed the exact number of devices affected, the intricacies of YuanKong’s operations raise alarms about its potential for widespread impact.
The C2 setup comprises multiple domains rather than a singular, hard-coded host. The analysis identified three distinct C2 domains defined in the loader’s code, and additional aliases strengthen its obfuscation efforts. Notably, YuanKong utilizes a local privilege escalation method by abusing Wireless Debugging, a technique that circumvents the need for a software vulnerability. Once granted Accessibility access, it can enable debugging features, extract pairing information from the system interface, and connect with the device’s Android Debug Bridge service. This grants the malware shell-level access—augmented control without root access—an important distinction that allows for additional permissions and enhanced persistence.
In terms of communication, YuanKong’s C2 channel relies on persistent Socket.IO/Engine.IO WebSocket connections and communicates using typed JSON messages. Notably, the analyzed code did not reveal any distinct application-layer encryption, placing confidence in confidentiality solely on TLS.
Research has uncovered specific indicators of compromise associated with YuanKong, including various C2 hosts. The identified hosts include apppanda.xyz, ktxapp.com, and ktx123.net, along with an IP address, 206.82.1.14. It is emphasized that the package-name strings found in the configuration are not reliable indicators of C2 communications or target devices, underscoring the importance of nuanced detection methods.
The findings from the YuanKong analysis mirror broader trends in Android security threats. For instance, the RatHat malware, documented by Zimperium, also exploits Accessibility features but operates under a different architecture. Despite similarities, researchers caution against assumptions of a shared operator or unified codebase between these threats.
For defenders in the cybersecurity landscape, prioritizing the shared YuanKong certificate and confirmed C2 indicators becomes imperative over transient app names. It is essential to scrutinize unfamiliar Accessibility services and Wireless Debugging activities, particularly from apps that demand extensive control without significant justification. Users are also urged to refrain from installing APKs from unknown sources and to review which applications have been granted Accessibility access.
In summary, the YuanKong Trojan not only exposes vulnerabilities in its operation but serves as a clarion call for both cybersecurity professionals and users alike. Active vigilance and informed decision-making are pivotal to safeguarding against this and other emerging threats in the ever-evolving digital landscape.