Kiran 
Researchers at STAR Labs have torn down YuanKong, an Android remote-control trojan. It hides almost nothing about the people who run it. Its builds carry the operator’s account name as a plain string, and the malware sends that name to its command server.
The sample STAR Labs analyzed is a loader signed as “Nova Build” from a claimed Singapore “APK Factory.” It stores its decryption key and IV in cleartext in a file named vault-config.json, placed next to the encrypted payload
The scheme, labeled SVLT-XOR-v2, is a two-key XOR rather than real cryptography. Anyone holding the config can recover the hidden ZIP and the child APK inside it.
YuanKong Android Malware
The unpacked app is signed “Remote Control, O=YuanKong, Beijing.” The same certificate (SHA-256 starting 73cbe8e3) signs all 57 distinct child payloads across 110 droppers in STAR Labs’ collection. Those payloads share one set of command servers.
Each build carries its own account ID, account name, and six-digit enrollment code, which makes the malware multi-tenant.
Analyst’s view: Criminal platforms that rent out malware usually protect their customers’ anonymity. YuanKong does the reverse, because the same design that lets the panel sort victims by operator also lets a researcher sort operators by victim.
These identifiers are compiled into the code. The app reports them to the server with every foreground-app event, along with the device fingerprint.
STAR Labs used a single static pass to extract 42 distinct operator accounts and 44 rotating build brands without contacting the command server. Handles such as lichunfeng7 and xx7876 share stems with numeric suffixes.
YuanKong requests no SMS, contacts, call-log, camera, or microphone permissions. Instead, it abuses accessibility services to read the screen, log keystrokes, inject taps, and stream the display.
It can draw a fake numeric keypad to capture PINs, or overlay operator-supplied HTML on targeted payment apps. A black-screen mode hides the operator’s activity from the victim.
Researchers say this enables unattended on-device banking fraud. The attacker unlocks the phone, opens the banking app, and enters the harvested PIN while the screen appears dark.
The malware also escalates privileges. It switches on Wireless Debugging, scrapes the six-digit pairing code and port from the system dialog, and pairs with the phone’s own debug daemon on 127.0.0.1:5555.
That gives it a shell-level session, not root. Over that shell, it grants itself WRITE_SECURE_SETTINGS and installs a watchdog script that restarts the app and shields it from being killed.
STAR Labs notes the technique is shared tradecraft rather than shared code. Pradeo reported it in RedHook and Zimperium reported it in RatHat.
Mitigation
Defenders should hunt on the signer, not the package name, because packages and brands rotate with every build. The key indicators STAR Labs published are below.
The command-server hosts are apppanda[.]xyz, ktxapp[.]com, ktx123[.]net and 206.82.1.14. The ktxapp and ktx123 domains resolved to that IP on October 15, 2026.
The family certificate is 73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387. The packer certificate is af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9.
The sample dropper hash is 675d083b63e2169e8fd0ac0cfd27904005b5e2be00f6e3489f6e47fc4c57a4d1.
Two further signals are worth monitoring. One is the Socket.IO WebSocket channel secured only by TLS. The other is libadb-android pairing code inside an app in the com.remote.control namespace.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
2 thoughts on “YuanKong Android Malware Hardcodes Operator Names, Exposing 42 Cybercrime Accounts”