DragonEgg
Description
(Lookout) Similar to WyrmSpy, DragonEgg appears to rely on additional payloads to implement the full scale of its surveillance functionality.
At launch, the malware acquires — either from C2 infrastructure or a bundled file within the APK — a payload often named “smallmload.jar” which attempts to acquire and launch additional functionality. Like WyrmSpy, the DragonEgg samples request extensive permissions for services that are not directly exploited in the core app.
We suspect that by trojanizing legitimate chat apps like Telegram, APT41 is trying to remain inconspicuous while requesting access to extensive device data. Messaging apps typically request access to sensitive device data, and by hiding its surveillance functionality within a large, fully-functional app, the threat actor is better able to remain inconspicuous while the app is running on the device or statically analyzed by a researcher.
Names
| Name |
|---|
| DragonEgg |
| LightSpy |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Info stealer
- Credential stealer
- Exfiltration
Information
- https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41
- https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack
Malpedia
Other Information
Uuid
b92e627c-2e0f-4d95-90f1-798028d00ba1
Last Card Change
2023-10-13