andromeda-d389d.firebasestorage.app

About CloudSettle Tunnel RAT (provisional)

**CloudSettle Tunnel RAT (provisional)** is an India-targeted Android banking/phishing RAT delivered by a per-build native dropper. The real payload is hidden in an encrypted asset and only runs after a multi-stage unpack. **What it does** - Fake **"NxtGen mParivahan"** RTO e-challan and **wedding-invitation** lures (`Wedding-Ceremoney` / `शुभ विवाहः` / `Vivah Utsav`). - Installs a second-stage app via a fake Google Play update screen, then runs a Rs 1 **"Verification Fee"** UPI-PIN and card-phishing flow. - Steals and sends SMS, captures PINs via accessibility overlays, and opens a **WebSocket reverse tunnel**. **How the payload is unpacked (binary-only)** - A per-build renamed native lib (`ndsSV`) decrypts the asset: 16-byte XOR, then 4-pass-KSA RC4, then AES-256-GCM (key = two dex `byte[32]` arrays XOR'd), then a zlib `MSZ1` / `MSP1` bundle = `base.apk` (empty `classes.dex`) + `split_config.dex.apk` (the RAT). - Recovered in-house with AES-GCM MAC validation on all six samples. **C2 and backend** - Control channel `wss://api.cloudsettle.org/ws/tunnel/device-b` (`https://api.cloudsettle.org` API base for `/register`, `/save-pin`, `/save-card`, `/sms/*`). - This is the embedded **default only**: Firebase Remote Config keys `base_url` / `tunnel_ws_url` can rotate it at runtime. - Firebase project **`andromeda-d389d`** (FCM topic `all_devices`) is the command/config backend, a more durable channel than the domain. - All six samples share project `andromeda-d389d`; the two mParivahan lures share app id `...53c99731`, the four wedding lures `...75b2e2`. Family label provisional.