Researchers Link Android DragonEgg Spyware to LightSpy and Detail Its Data-Theft Capabilities
Summary
ThreatFabric researchers linked Android DragonEgg to LightSpy and analyzed its modular spyware, finding capabilities to steal private data, track precise locations, record calls and extract WeChat Pay transaction history.
Key points
- Researchers traced a two-stage infection chain beginning with a patched Telegram app that downloads a second-stage loader and then the LightSpy Core.
- The Core coordinates command-and-control, updates, and plugins; researchers retrieved the Core and 14 plugins from 20 active servers.
- Plugins can collect contacts, messages, files, app and Wi-Fi data, track location—including building floors—and record audio.
- The bill plugin can access WeChat Pay and retrieve transaction details; another plugin hooks WeChat audio functions to record VOIP calls.
- Researchers connected DragonEgg and LightSpy through shared configuration patterns, code references, plugin structure, and command-and-control behavior.
- They observed infrastructure shared with AndroidControl, also known as WyrmSpy, and said it could be a LightSpy successor; attribution and victim targeting were presented with some uncertainty.
- Researchers found deployment dates ranging from December 2018 to July 2023 and warned that new servers appeared during their investigation.
Article Details
- Attack Vectors
- A patched Telegram messenger served as the first stage; injected code downloaded the second-stage smallmload.jar payload.
- The downloader queried C2 for a version.txt file, then downloaded the named Core payload and plugins.
- LightSpy could be loaded into WeChat's address space or use superuser privileges to access WeChat data and hook VOIP audio functions.
- Defensive Notes
- ThreatFabric recommends avoiding software from untrusted sources, including software delivered through spam messages—even when the sender is trusted.
- The article warns that a messenger installed from a third-party store might not receive updates from its original trusted source.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | spaceskd[.]com | Listed as a LightSpy control-server domain in the article's indicators of compromise. |
| IPV4 | 103[.]27[.]108[.]207 | Listed as a LightSpy control server in the indicators of compromise. |
| IPV4 | 103[.]43[.]17[.]53 | LightSpy C2 address in the implant configuration; used for payload delivery and communications. |
| IPV4 | 118[.]193[.]39[.]165 | LightSpy C2 address in the implant configuration and the smallmload.jar download URL. |
| IPV4 | 121[.]201[.]109[.]98 | LightSpy C2 address in the implant configuration. |
| IPV4 | 46[.]17[.]43[.]74 | Listed as a LightSpy control server in the indicators of compromise. |
| MD5 | e444c12808ef037487a50b0bb42e4145 | MD5 of the LightSpy Core version 6.5.24, described as the most recent version observed. |
| SHA256 | 177e52c37a4ff83cd2e5a24ff87870b3e82911436a33290135f49356b8ee0eb1 | SHA-256 of the LightSpy locationBaidu plugin. |
| SHA256 | 2282c6caef2dd5accc1166615684ef2345cf7615fe27bea97944445ac48d5ce4 | SHA-256 of a LightSpy Core artifact listed in the article's indicators of compromise. |
| SHA256 | 407abddf78d0b802dd0b8e733aee3eb2a51f7ae116ae9428d554313f12108a4c | SHA-256 of a second-stage smallmload.jar payload downloaded from LightSpy servers. |
| SHA256 | 446506fa7f7dc66568af4ab03e273ff25ee1dc59d0440086c1075d030fe72b11 | SHA-256 of the LightSpy wifi plugin. |
| SHA256 | 5f93a19988cd87775ad0822a35da98d1abcc36142fd63f140d488b30045bdc00 | SHA-256 of a LightSpy Core artifact listed in the article's indicators of compromise. |
| SHA256 | 68252b005bbd70e30f3bb4ca816ed09b87778b5ba1207de0abe41c24ce644541 | SHA-256 of a LightSpy Core artifact listed in the article's indicators of compromise. |
| SHA256 | 71d676480ec51c7e09d9c0f2accb1bdce34e16e929625c2c8a0483b9629a1486 | SHA-256 of the LightSpy telegram plugin. |
| SHA256 | 77f0fc4271b1b9a42cd6949d3a6060d912b6b53266e9af96581a2e78d7beb87b | SHA-256 of a LightSpy Core artifact listed in the article's indicators of compromise. |
| SHA256 | 7d8a08af719f87425d1643d59979d4a3ef86a5fc81d1f06cfa2fd8c18aeb766b | SHA-256 of the LightSpy chatfile plugin. |
| SHA256 | a01896bf0c39189bdb24f64a50a9c608039a50b068a41ebf2d49868cc709cdd3 | SHA-256 of a LightSpy Core artifact listed in the article's indicators of compromise. |
| SHA256 | bace120bf24d8c6cfbb2c8bfeed1365112297740e2a71a02ea2877f5ffc6b325 | SHA-256 of the LightSpy cameramodule plugin. |
| SHA256 | bcb31d308ba9d6a8dbaf8b538cee4085d3ef37c5cb19bf7e7bed3728cb132ec1 | SHA-256 of the LightSpy wechat plugin. |
| SHA256 | bd6ec04d41a5da66d23533e586c939eece483e9b105bd378053e6073df50ba99 | SHA-256 of a second-stage smallmload.jar payload downloaded from LightSpy servers. |
| SHA256 | bdcc5fc529e12ecb465088b0a975bd3a97c29791b4e55ee3023fa4f6db1669dc | SHA-256 of a LightSpy Core artifact listed in the article's indicators of compromise. |
| SHA256 | bf338e548c26f3001f8ad2739e2978586f757777f902e5c4ab471467fd6d1c04 | SHA-256 of the LightSpy locationmodule plugin. |
| SHA256 | c0c7b902a30e5a3a788f3ba85217250735aaaf125a152a32ee603469e2dfb39e | SHA-256 of a LightSpy plugin listed in the article's plugin indicators. |
| SHA256 | c6ccd599c6122b894839e12d080062de0fa59c4cd854b255e088d22e11433ef6 | SHA-256 of the LightSpy bill plugin, which collects WeChat Pay payment history. |
| SHA256 | cc6a95d3e01312ca57304dc8cd966d461ef3195aab30c325bee8e5b39b78ae89 | SHA-256 of the LightSpy baseinfo plugin. |
| SHA256 | d640ad3e0a224536e58d771fe907a37be1a90ad26bf0dc77d7df86d7a6f7ca0e | SHA-256 of a LightSpy Core artifact listed in the article's indicators of compromise. |
| SHA256 | e1152fe2c3f4573f9b27ca6da4c72ee84029b437747ef3091faa5a4a4b9296be | SHA-256 of the LightSpy shell plugin. |
| SHA256 | e5bdeedac2c5a3e53c1fdc07d652c5d7c9b346bcf86fc7184c88603ff2180546 | SHA-256 of the LightSpy filemanager plugin. |
| SHA256 | f32fa0db00388ce4fed4e829b17e0b06ae63dc0d0fac3f457b0f4915608ac3b5 | SHA-256 of the LightSpy qq plugin. |
MITRE ATT&CK
T1005 · Data from Local SystemPlugins collect local data including contacts, call history, SMS, messenger files, payment history, and stored files.T1027 · Obfuscated Files or InformationThe article describes XOR-based payload decryption and obfuscated strings in LightSpy components.T1041 · Exfiltration Over C2 ChannelLightSpy uploads exfiltrated data, including camera shots and execution logs, through its HTTPS C2 channel.T1105 · Ingress Tool TransferThe downloader retrieves the second-stage payload, and the Core downloads additional plugin payloads from C2.T1407The smallmload.jar downloader retrieves the LightSpy Core and additional plugins at runtime from C2.T1426The Core collects a device fingerprint containing device specifications and cellular and Wi-Fi network information.T1429The soundrecord plugin records microphone audio, phone calls, and WeChat VOIP conversations.T1430The location plugins track device location, including location within buildings and floor-level information.T1437.001LightSpy uses WebSocket for command delivery and HTTPS for data exfiltration over the same host and port.
Threat Actors
Malware
AndroidRATSo, all three hosts were active C2 of WyrmSpy, or as it was named by attackers AndroidControl or androidRat.DragonEggIn July 2023 our colleagues from Lookout posted a report about two families of Spyware: DragonEgg and WyrmSpy, researchers attributed both families to the Chinese APT-41 group.LightSpyWe performed our own investigation and linked DragonEgg to sophisticated iOS implant LightSpy and its Android component which was reported by TrendMicro and Kaspersky in 2020.WyrmSpyIn July 2023 our colleagues from Lookout posted a report about two families of Spyware: DragonEgg and WyrmSpy, researchers attributed both families to the Chinese APT-41 group.
Products
AndroidWe performed our own investigation and linked DragonEgg to sophisticated iOS implant LightSpy and its Android component which was reported by TrendMicro and Kaspersky in 2020.TelegramThe first stage was patched Telegram messenger, and the main function of the injected code was downloading the second stage file which was called "smallmload.jar".WeChatLightSpy is capable of payment data exfiltration from WeChat Pay backend infrastructure WeChat PayLightSpy is capable of payment data exfiltration from WeChat Pay backend infrastructure
Tools
Countries
ChinaThe threat actor group had active servers in China, Singapore, and RussiaHong KongWe found that LightSpy infrastructure contains several dozens of servers located in China mainland, Hong Kong, Taiwan, Singapore, and Russia.RussiaThe threat actor group had active servers in China, Singapore, and RussiaSingaporeThe threat actor group had active servers in China, Singapore, and RussiaTaiwanWe found that LightSpy infrastructure contains several dozens of servers located in China mainland, Hong Kong, Taiwan, Singapore, and Russia.