YuanKong Android Trojan Exposes Operator IDs in Weakly Protected Dropper
Researchers found that the YuanKong remote-access Trojan leaks operator account identifiers embedded in its configuration, compromising the anonymity of its controllers.
Key points
- Analysis of 110 droppers revealed 57 distinct payloads and 42 operator accounts tied to a shared signing certificate.
- The malware abuses Android Accessibility services to capture credentials without requiring SMS or camera permissions.
- A simple XOR decryption routine allows static analysis of the payload without executing the malicious code.
Security researchers have uncovered a significant operational security failure within the YuanKong Android remote-access Trojan, which inadvertently exposes the identities of its operators. According to GBHackers, the malware’s weakly protected dropper contains embedded account identifiers that are transmitted to command-and-control servers, allowing analysts to link specific builds to individual criminal accounts.
The investigation analyzed 110 dropper samples and identified 57 distinct child payloads, 42 unique operator accounts, and 44 rotating build brands. All these variants share a common signing certificate and command-and-control infrastructure. The presence of operator account IDs, names, and enrollment codes as string constants in the configuration means that each sample reveals the specific account associated with its build when telemetry is sent.
Technical Analysis and Capabilities
The YuanKong malware employs an “SVLT-XOR-v2” routine that uses a simple two-key XOR operation to encrypt its payload. This weak encryption allows security analysts to recover the child APK statically without running the malware or contacting its servers. The extracted application identifies itself as YuanKong and is signed with a certificate shared across all 57 payloads, providing a reliable detection anchor despite changes in package names and branding.
Starlabs Researchers noted that the loader stores its decryption key and initialization vector in plaintext within an assets file named vault-config.json, located beside the encrypted payload. This design flaw simplifies reverse engineering efforts. The command-and-control infrastructure is not limited to a single hard-coded host, suggesting a more distributed or dynamic network structure for communication.
Surveillance Methods and Risks
YuanKong relies on controlling the user interface rather than traditional data permissions for surveillance. The analyzed build lacks permissions for accessing SMS messages, contacts, call logs, the camera, or the microphone. Instead, it abuses Android Accessibility services to inspect interface content, capture text changes, including activity in password fields, and remotely simulate taps, swipes, and navigation.
The malware can stream the screen, read notifications, access clipboard contents, collect files and location data, and present attacker-supplied overlays over selected apps to capture payment credentials. It maps touches to keypad positions, combining touch coordinates with detected keypad layouts to infer PIN entry without reading digits directly. A black-screen overlay can conceal remote activity from the user, potentially enabling fraudulent actions within banking or payment sessions.
A recent report from Android Authority suggests consumers should prioritize older flagship models over new budget devices due to performance and longevity advantages. While this report does not establish how many devices have been infected by YuanKong, the exposure of operator accounts provides a rare opportunity to track the threat group.
What should you do?
Security teams should monitor for applications with unusual Accessibility service requests, especially those lacking standard permissions for SMS or media access. Users should be cautious of apps that request overlay permissions, as these can be used to capture credentials. Organizations should implement strict application allowlisting to prevent unauthorized APK installation.
What to do and how to stay safe: YuanKong
- Review installed applications for any that request Accessibility services without a clear, legitimate need for such broad interface control.
- Enable Google Play Protect and keep it updated to scan for known malicious signatures, including those associated with the YuanKong certificate.
- Avoid downloading APK files from third-party sources or unofficial app stores, as these are common distribution vectors for such trojans.
- Monitor device behavior for unexpected screen overlays, black screens, or unusual battery drain, which may indicate remote access activity.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does YuanKong expose its operators?
The malware embeds operator account IDs and enrollment codes in its configuration, which are sent to command-and-control servers during telemetry.
What permissions does YuanKong require?
It does not require SMS, contact, camera, or microphone permissions, instead relying on Android Accessibility services to control the interface.
Can the malware payload be analyzed without execution?
Yes, the simple XOR encryption allows analysts to statically recover the child APK without running the malware or contacting its servers.
