ACTAndroid C2 Tracker

48bf67f14bd62bfcd2455455…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

CloudSettle Tunnel RAT (provisional). India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional. ’ Indicators: wss://api.cloudsettle.org/ws/tunnel/.

Recovered configuration

anti_tamper
SHA-256 of signing certificate
https_api
https://api.cloudsettle.org
lure
wedding invitation / guest registration (Rs 1 fee)
package
com.batch.helper.main
packer
5-layer native (XOR+RC4-4pass+AES-GCM+zlib MSZ1+MSP1 bundle, key from libnetbridge.so)
targets
Indian banking (Federal Bank)
websocket_c2
wss://api.cloudsettle.org/ws/tunnel/device-<id>

Identification

SHA-256
48bf67f14bd62bfcd2455455a84e458ff6460db8d03cae3cc80d18be910fdb3c
MD5
6a45249b3ef638e5855f5706ce319fa9

Observed

Families
CloudSettle Tunnel RAT (provisional)
First seen
2026-10-05

APK metadata

Summary

Type
Android · APK
Package
com.batch.helper.main
Main activity
com.batch.helper.main.s2
Internal version
454
Displayed version
4.2.77
Min SDK
24
Target SDK
37

Signing certificate

Valid from
2026-10-04 23:54:52
Valid to
2057-09-13 23:54:52
Serial
efead0514414daa4
Thumbprint
9e067a70cc81012d2896bd1d8658efd443c5a9de
Subject
C:IN, CN:HappyByte Labs, L:Vadodara, O:Moonlight Studios, ST:Gujarat
Issuer
C:IN, CN:HappyByte Labs, L:Vadodara, O:Moonlight Studios, ST:Gujarat

Permissions (11)

android.permission.ACCESS_NETWORK_STATEandroid.permission.CHANGE_WIFI_STATEandroid.permission.FLASHLIGHTandroid.permission.FOREGROUND_SERVICEandroid.permission.FOREGROUND_SERVICE_DATA_SYNCandroid.permission.INTERNETandroid.permission.REORDER_TASKSandroid.permission.REQUEST_INSTALL_PACKAGESandroid.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTIONandroid.permission.USE_FINGERPRINTandroid.permission.WAKE_LOCK

Activities (5)

  • com.batch.helper.main.e
  • com.batch.helper.main.l
  • com.batch.helper.main.s2
  • com.batch.helper.main.sw
  • com.batch.helper.main.zw5

Services (1)

  • com.batch.helper.main.y1

Receivers (1)

  • com.batch.helper.main.s

Providers (1)

  • com.batch.helper.main.z

Intent filters - actions

android.net.VpnService

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
api.cloudsettle.org/ws/tunnel/ domain - wss CloudSettle Tunnel RAT (provisional) 2026-10-05

Signing certificate

Subject CN
HappyByte Labs
Issuer CN
HappyByte Labs
Fingerprint
23a9ed597362579e8258f031fa5afaa759e5e8f866ef7a80d1b4e393a662e8d1

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About CloudSettle Tunnel RAT (provisional)

India-targeted, heavily packed Android banking RAT. The real payload is recovered only after a five-layer native unpack chain (header XOR, a 4-pass-KSA RC4, AES-256-GCM with a key built by XORing two hardcoded arrays, zlib inflate, then a bundle format) guarded by certificate-pinning anti-tamper. It establishes a control tunnel over WebSocket to wss://api.cloudsettle.org/ws/tunnel/ with an https://api.cloudsettle.org fallback. Family label provisional. '