YuanKong Android RAT: Multi-Tenant Mobile Espionage With Operator Watermarks — OTX Pulse Detection Pack

---
title: YuanKong RAT C2 Domain Resolution
id: 7a1c2d4e-9f3b-4c5a-8e6d-1b2a3c4d5e6f
status: experimental
description: Detects DNS resolution of known YuanKong Android RAT command-and-control domains associated with multi-tenant operator infrastructure.
author: Security Arsenal Threat Intelligence
 date: 2026/11/15
references:
  - https://starlabs.sg/blog/2026/10-yuankong-rat-the-android-remote-control-service-that-stamps-its-operators-names-into-every-build
logsource:
  category: dns
product: windows
detection:
  selection:
    QueryName|contains:
      - 'ktxapp.com'
      - 'ktx123.net'
  condition: selection
level: high
tags:
  - attack.command_and_control
  - attack.t1071
---
title: ADB Privilege Escalation or Unauthorized Debug Bridge Activity
id: 8b2d3e5f-0a4c-5d6b-9f7e-2c3b4d5e6f7a
status: experimental
description: Detects execution of ADB commands consistent with YuanKong RAT ADB escalation techniques, including unauthorized shell spawning and package installation via debug bridge.
author: Security Arsenal Threat Intelligence
date: 2026/11/15
references:
  - https://starlabs.sg/blog/2026/10-yuankong-rat-the-android-remote-control-service-that-stamps-its-operators-names-into-every-build
logsource:
  category: process_creation
product: windows
detection:
  selection_img:
    Image|endswith: '\adb.exe'
  selection_cmd:
    CommandLine|contains:
      - 'shell pm install'
      - 'shell settings put secure enabled_accessibility_services'
      - 'shell appops set'
      - 'shell su'
      - 'install -r'
  condition: all of selection_*
level: high
tags:
  - attack.privilege_escalation
  - attack.t1548
  - attack.command_and_control
  - attack.t1105
---
title: YuanKong RAT Dropper Hash Execution
id: 9c3e4f6a-1b5d-6e7c-0a8f-3d4c5e6f7a8b
status: experimental
description: Detects execution of files matching known YuanKong RAT dropper and payload hashes published in OTX pulse.
author: Security Arsenal Threat Intelligence
date: 2026/11/15
logsource:
  category: process_creation
product: windows
detection:
  selection_sha256:
    Hashes|contains:
      - 'SHA256=73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387'
      - 'SHA256=af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9'
      - 'SHA256=675d083b63e2169e8fd0ac0cfd27904005b5e2be00f6e3489f6e47fc4c57a4d1'
      - 'SHA256=12480408006dece2fa756b3572766eecb6fb2144a1226f4e21c4cb7d54383105'
  selection_md5:
    Hashes|contains:
      - 'MD5=4280a408a7f0490d9d2eaa3f536f339b'
  condition: 1 of selection_*
level: critical
tags:
  - attack.execution
  - attack.t1204

// YuanKong RAT — C2 communication and ADB escalation hunt
// Microsoft Sentinel / Defender XDR
let YuanKongDomains = dynamic(["ktxapp.com", "www.ktxapp.com", "ktx123.net", "www.ktx123.net"]);
let YuanKongHashes = dynamic([
    "73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387",
    "af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9",
    "675d083b63e2169e8fd0ac0cfd27904005b5e2be00f6e3489f6e47fc4c57a4d1",
    "12480408006dece2fa756b3572766eecb6fb2144a1226f4e21c4cb7d54383105"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (YuanKongDomains)
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend HuntHit = "C2_Domain_Resolution"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in~ (YuanKongHashes) or MD5 =~ "4280a408a7f0490d9d2eaa3f536f339b"
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5, ProcessCommandLine
    | extend HuntHit = "Hash_Match_Execution"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName =~ "adb.exe"
    | where ProcessCommandLine has_any ("shell pm install", "enabled_accessibility_services", "appops set", "shell su", "install -r")
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
    | extend HuntHit = "ADB_Escalation_Behavior")
| sort by TimeGenerated desc

# YuanKong RAT IOC Hunt Script — Security Arsenal
# Checks for C2 connections, DNS cache hits, suspicious ADB activity, and known hashes
# Run elevated. Output: YuanKong_Hunt_<hostname>_<date>.log

$report = @()
$YuanKongDomains = @("ktxapp.com", "www.ktxapp.com", "ktx123.net", "www.ktx123.net")
$YuanKongHashesSHA256 = @(
    "73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387",
    "af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9",
    "675d083b63e2169e8fd0ac0cfd27904005b5e2be00f6e3489f6e47fc4c57a4d1",
    "12480408006dece2fa756b3572766eecb6fb2144a1226f4e21c4cb7d54383105"
)

Write-Host "[*] YuanKong RAT Hunt — $(Get-Date)" -ForegroundColor Cyan

# 1. Active network connections to C2 infrastructure
Write-Host "[*] Checking active TCP connections..."
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Established" }
foreach ($c in $conns) {
    try {
        $dns = [System.Net.Dns]::GetHostEntry($c.RemoteAddress).HostName
        foreach ($d in $YuanKongDomains) {
            if ($dns -like "*$d*") {
                $report += "[CRITICAL] Active connection to YuanKong C2: $dns ($($c.RemoteAddress):$($c.RemotePort)) PID=$($c.OwningProcess)"
            }
        }
    } catch {}
}

# 2. DNS client cache for historical resolutions
Write-Host "[*] Checking DNS cache..."
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $YuanKongDomains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { $report += "[HIGH] DNS cache entry for YuanKong domain: $($hit.Entry) -> $($hit.Data)" }
}

# 3. Suspicious ADB processes or recent ADB command artifacts
Write-Host "[*] Checking for ADB escalation artifacts..."
$adbProc = Get-Process -Name "adb" -ErrorAction SilentlyContinue
if ($adbProc) {
    $report += "[HIGH] ADB process running: PID $($adbProc.Id) Path=$($adbProc.Path)"
}
$adbPaths = @("$env:LOCALAPPDATA\Android", "$env:USERPROFILE\platform-tools", "C:\platform-tools", "C:\adb")
foreach ($p in $adbPaths) {
    if (Test-Path $p) {
        $recent = Get-ChildItem $p -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) }
        if ($recent) { $report += "[MEDIUM] ADB tooling with recent writes found at $p — review for unauthorized device bridging" }
    }
}

# 4. Hash sweep of common staging directories
Write-Host "[*] Sweeping staging directories for known YuanKong hashes..."
$scanDirs = @("$env:TEMP", "$env:USERPROFILE\Downloads", "C:\ProgramData")
foreach ($dir in $scanDirs) {
    Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -lt 50MB } | ForEach-Object {
            try {
                $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
                if ($YuanKongHashesSHA256 -contains $h) {
                    $report += "[CRITICAL] YuanKong hash match: $($_.FullName) SHA256=$h"
                }
            } catch {}
        }
}

# 5. Scheduled tasks referencing APK/adb staging (workstation-side droppers)
Write-Host "[*] Checking scheduled tasks..."
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match "adb|\.apk|ktx") {
        $report += "[HIGH] Suspicious scheduled task: $($_.TaskName) — $actions"
    }
}

# Output
$outFile = "YuanKong_Hunt_$($env:COMPUTERNAME)_$(Get-Date -Format 'yyyyMMdd').log"
if ($report.Count -eq 0) {
    "[OK] No YuanKong indicators found on $env:COMPUTERNAME" | Out-File $outFile
    Write-Host "[OK] Clean — no indicators found." -ForegroundColor Green
} else {
    $report | Out-File $outFile
    $report | ForEach-Object { Write-Host $_ -ForegroundColor Red }
    Write-Host "[!] $($report.Count) findings written to $outFile" -ForegroundColor Yellow
}