daa881fa9a033542e8f3288a…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

CloudSettle Tunnel RAT (provisional). CloudSettle Tunnel RAT (provisional) is an India-targeted Android banking/phishing RAT delivered by a per-build native dropper. The real payload is hidden in an encrypted asset and only runs after a multi-stage unpack.

What it does

Fake “NxtGen mParivahan” RTO e-challan and wedding-invitation lures (Wedding-Ceremoney / शुभ विवाहः / Vivah Utsav).
Installs a second-stage app via a fake Google Play update screen, then runs a Rs 1 “Verification Fee” UPI-PIN and card-phishing flow.
Steals and sends SMS, captures PINs via accessibility overlays, and opens a WebSocket reverse tunnel.

How the payload is unpacked (binary-only)

A per-build renamed native lib (ndsSV) decrypts the asset: 16-byte XOR, then 4-pass-KSA RC4, then AES-256-GCM (key = two dex byte[32] arrays XOR’d), then a zlib MSZ1 / MSP1 bundle = base.apk (empty classes.dex) + split_config.dex.apk (the RAT).
Recovered in-house with AES-GCM MAC validation on all six samples.

C2 and backend

Control channel wss://api.cloudsettle.org/ws/tunnel/device-b (https://api.cloudsettle.org API base for /register, /save-pin, /save-card, /sms/*).
This is the embedded default only: Firebase Remote Config keys base_url / tunnel_ws_url can rotate it at runtime.
Firebase project andromeda-d389d (FCM topic all_devices) is the command/config backend, a more durable channel than the domain.
All six samples share project andromeda-d389d; the two mParivahan lures share app id ...53c99731, the four wedding lures ...75b2e2.

Family label provisional. Indicators: wss://api.cloudsettle.org/ws/tunnel/device-b.

Recovered configuration

aes_key

abfdab2c63166f5797485a595e583ba67cb251ec5d7f6defb3856076391824d1

app_label

NxtGen mParivahan

c2_http_api_base

https://api.cloudsettle.org

c2_ws_tunnel

wss://api.cloudsettle.org/ws/tunnel/device-b

capabilities

Firebase Remote Config driven: PIN capture over ~70 Indian banking/UPI apps (HDFC, Paytm, PhonePe, GPay, Axis, SBI, Groww, Jupiter, MobiKwik, etc.), ghost overlays, VpnService 'kill' of security apps + Play/GMS traffic, security-app block tripwire.

lure

mParivahan / com.transport.gov.in (Indian vehicle-registration)

package

com.vodafone.android.provider.sqtf2vz

packer

Native libsyshelper.so unpacker: signing-cert SHA-256 anti-tamper gate, 16-byte XOR (gnjfg9[0:16]) -> 4-pass-KSA RC4 (key gnjfg9[16:32], j reset per pass) -> AES-256-GCM -> MSZ1(zlib) -> MSP1 bundle (base.apk + split_config.dex.apk). Payload asset 'gnjfg9'. Strings via getNativeStr (per-index XOR table).

source_to_sink

H.d('tunnel_ws_url', 'wss://api.cloudsettle.org/ws/tunnel/device-b') -> Request.Builder().url(...) -> OkHttpClient.newWebSocket(...) in B0/l.java; HTTP base in w0/H.java.

staged_update_path

/api/staged/fetch/ (native HTTP; headers X-Staged-Sha256 / X-Staged-Pkg / X-Staged-Activity; final staged pkg com.app.messenger SMS forwarder)

Identification

SHA-256: daa881fa9a033542e8f3288aa6fa07c6a18f24ddbe2cbb8b9fbc5f6abda62520
MD5: 4a55bfbcec8dde154717aebdf93fdd19

Observed

Families: CloudSettle Tunnel RAT (provisional)
First seen: 2026-10-12

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
api.cloudsettle.org/ws/tunnel/device-b	domain	-	wss	CloudSettle Tunnel RAT (provisional)	2026-10-12

Signing certificate

Subject CN: PrimePixel Software
Issuer CN: HappyByte Labs
Fingerprint: 4376502caad25b6fd94e5082c84605e14464d219e1ff8995f940ade1a5a0e906

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About CloudSettle Tunnel RAT (provisional)

**CloudSettle Tunnel RAT (provisional)** is an India-targeted Android banking/phishing RAT delivered by a per-build native dropper. The real payload is hidden in an encrypted asset and only runs after a multi-stage unpack. **What it does** - Fake **"NxtGen mParivahan"** RTO e-challan and **wedding-invitation** lures (`Wedding-Ceremoney` / `शुभ विवाहः` / `Vivah Utsav`). - Installs a second-stage app via a fake Google Play update screen, then runs a Rs 1 **"Verification Fee"** UPI-PIN and card-phishing flow. - Steals and sends SMS, captures PINs via accessibility overlays, and opens a **WebSocket reverse tunnel**. **How the payload is unpacked (binary-only)** - A per-build renamed native lib (`ndsSV`) decrypts the asset: 16-byte XOR, then 4-pass-KSA RC4, then AES-256-GCM (key = two dex `byte[32]` arrays XOR'd), then a zlib `MSZ1` / `MSP1` bundle = `base.apk` (empty `classes.dex`) + `split_config.dex.apk` (the RAT). - Recovered in-house with AES-GCM MAC validation on all six samples. **C2 and backend** - Control channel `wss://api.cloudsettle.org/ws/tunnel/device-b` (`https://api.cloudsettle.org` API base for `/register`, `/save-pin`, `/save-card`, `/sms/*`). - This is the embedded **default only**: Firebase Remote Config keys `base_url` / `tunnel_ws_url` can rotate it at runtime. - Firebase project **`andromeda-d389d`** (FCM topic `all_devices`) is the command/config backend, a more durable channel than the domain. - All six samples share project `andromeda-d389d`; the two mParivahan lures share app id `...53c99731`, the four wedding lures `...75b2e2`. Family label provisional.