We discovered DragonDoll, a previously unknown multifunctional Android spyware family.
The malware impersonates Google Chrome.
The operators tailored the infection flow for users in more than 26 countries.
DragonDoll is distributed through phishing sites that masquerade as browser update pages.
In spring 2026, researchers at the Positive Technologies Expert Security Center (PT ESC) identified an unusual campaign targeting users in Saudi Arabia. The campaign used a previously unknown APK named Chrome.apk. The sample immediately attracted our attention. Behind a benign-looking Google Chrome update screen and an unexpected request to enable Accessibility Services, we found a heavily protected execution chain that ultimately deployed Android spyware.
During our analysis, we confirmed that the malware had not been previously documented and named it DragonDoll. The implant is adapted for attacks against users in multiple regions, including Russia, China, Korea, and several MENA countries. We analyzed DragonDoll's capabilities, execution flow, and network communications. A retrospective investigation also allowed us to identify its distribution source and a broader collection of malware samples.
During initial triage, we noticed an interesting feature: the APK could not be extracted directly with standard archive tools. The operators used the Tampered Headers technique. Because an APK is a ZIP archive, corrupting selected ZIP header fields can interfere with analysis. In this case, the attackers modified the Flags field in the header and set the Encrypted fileflag. No actual encryption was used. After correcting the flag values, analysis could proceed:
After unpacking the archive and opening AmdroidManifest.xml , we found an important permission request: android.permission.REQUEST_INSTALL_PACKAGES . This permission allows the application to request installation of additional packages.
When the main method runs, the application loads another APK, K3iwv7VF.apk , from its resources using PackageInstaller . At the same time, a WebView loads a lure page named horror.html. The page imitates the installation or update process for Google Chrome and changes its content depending on the payload installation state.
The lure page also checks the following parameters: navigator.userLanguage and navigator.language. Based on the user's interface language, the content of the lure page changes. This installer included text templates for 34 languages, including Russian, Ukrainian, Korean, Japanese, Chinese, Hebrew, Persian, and Arabic.
Opening K3iwv7VF.apk , we found a large number of requested permissions in the manifest. However, its main method performs only one visible action: it loads a native library named crypto_4775h3 .
The main permissions are associated with classes in the package: com.me4dymbu.ysbf4ghb . However, this package is not present in the APK, which means the core logic is hidden elsewhere—in the native library.
The library acts as a dropper. It decrypts a file from the application resources using standard AES-256-GCM. Analysis of the library is complicated by LLVM-based obfuscation, including mixed Boolean-arithmetic (MBA) expressions and control-flow flattening (CFF). The dropper also performs several checks designed to obstruct analysis:
It checks whether the sample is running under a debugger, including Frida or similar frameworks. If debugging artifacts are detected, the file is not decrypted correctly.
It checks for network connectivity. If no connection is available, decryption also fails.
Important strings are protected with several XOR-based algorithms using an 8-byte key.
If all checks pass, the dropper decrypts the file config_[0-9a-z]{6,8}_[0-9a-z]{2,4}.json , which is another library.
This second library is similar to the first one. At the final stage, it loads the package com.me4dymbu.ysbf4ghb and transfers execution to the method x1. The decrypted APK is the DragonDoll spyware payload.
DragonDoll is a mature spyware implant capable of remotely controlling a mobile device and collecting device data in real time. It can monitor user input and taps, display malicious overlays on top of legitimate applications, control calls, access contacts and SMS messages, and steal data from messengers. It also uses multiple registered receivers to notify the operators changes in the device state.
We begin the spyware analysis with class x1, specifically its onCreate method.
The spyware checks network availability and starts the services and methods required for operation. DragonDoll has a modular architecture built around several core components:
bgs, BackgroundService. Prepares and sends collected data to the C2 server. It also gathers some device information, described in more detail in the Network communication section. Messages are sent through methods in the NetworkUtil class. This component also registers receivers for background data collection. The operators occasionally misspell words. For example, in the onTrimMemory method, they generate a memory-state message, but the resulting JSON contains the misspelled constant message.
wbs, WebSocketService. Handles incoming messages from the command-and-control server.
acs. Requests the permissions required for operation while pretending to be a Google Chrome update. When requesting these permissions, the spyware localizes the prompt for the victim. The message asks the user to update Chrome and is available in 27 languages.
mpsr, MediaProjectionService. Used to capture screenshots.
msrv, MainService. The main class responsible for managing and maintaining the VNC service.
DragonDoll also uses several additional services:
ntfy, which extends NotificationListenerService. Intercepts all notifications on the phone.
ajs, which extends JobService. Handles events from JobScheduler.
jin, which extends AppCompatActivity. Executes injection-related commands. See the Commands section for details.
acss, which extends AccessibilityService. Intercepts user actions, reads text, inspects screen elements and buttons, and performs other operations.
Intermediate values required for communication between services, for example, the encryption key or victim ID, are accessed through the MyAppPreference class. DragonDoll stores this data using MMKV, a mobile key-value storage framework used in WeChat.
For result storage and event logging, the spyware uses the DatabaseHelper class. This class creates, populates, and queries an SQLite database named device_status.db . During initialization, DragonDoll creates several tables to store command results and logs:
device_logs. Stores service status information, receiver messages, and operational log messages from the spyware.
acsb_logs. Stores messages from AccessibilityService.
notification_logs. Stores notifications collected by the ntfy service.
sms_logs. Stores messages collected by the smsdr and smrcv receivers.
current_status. Stores the current device state, including network connectivity, charging status, and other parameters.
app_config. Not used.
The final initialization stage displays an HTML lure that imitates a Google Chrome update. The spyware itself is not heavily obfuscated. The only protections are XOR-encrypted strings and partially removed class and method names.
DragonDoll's configuration is stored in the BuildConfig class. Some configuration parameters are either unused or unset. The configuration defines the version (9.3 in the analyzed sample), the application name used for masquerading, and the C2 server addresses. In this sample, the C2 domain was channelzones[.]co.
DragonDoll uses two main networking components: wbs, which creates handlers for the active connection, and NetworkUtils, which handles initial authentication and sends results. The wbs component is based on Socket.IO , while NetworkUtils uses OkHttp3.
Messages are protected with hybrid encryption. The transmitted data is encrypted with AES-256-CBC. The key is generated randomly and sent to the server encrypted with RSA-OAEP. NetworkUtils sends outbound messages and processes the corresponding server response based on the current state. The initial network exchange works as follows:
REGISTER_DEVICE. On first connection, DragonDoll sends a type-0 header requesting a client UUID and the server's public key.
The C2 server responds with a header containing a new client_id in JSON format. DragonDoll extracts the RSA public key from this response.
REGISTER_DEVICE_2. The client sends the generated AES key encrypted with RSA.
Once the key exchange completes successfully, DragonDoll sends an information message to the server.
Subsequent messages use the same header format. When data is encrypted with AES, a random IV is generated and transmitted with each message.
Encrypted data format:
After a successful key exchange, the bgs service sends an information message. In addition to standard data, such as receiver output and information accumulated in the database, the initial message contains extensive device information, including:
Accounts configured on the device
list and the device's own phone numbers
Application permission status, root status, and whether the app is running as device owner
List of installed applications
Hardware information, including model, serial number, IMEI, bootloader information, and CPU details
NetworkUtil works with bgs to send information messages and request files required for operation. The following states are implemented in NetworkUtils:
GET_OVERLAY_APPS. Requests overlay files (HTML files displayed on top of legitimate applications) required for the ENABLE_INJECT command.
GET_OVERLAY_APP. Retrieves overlay files for the ENABLE_INJECT command.
SEND_DATA. Sends messages to the C2 server, including information messages.
PING_TEST. Heartbeat functionality. Not used in the analyzed sample.
KEY_EXCHANGE. No actions are assigned.
At the same time, the wbs component handles incoming connections. Socket.IO provides a persistent connection through which data can be transmitted at any time. Current messages are processed by six handlers, each assigned to a specific message type.
The first three handlers are standard: they simply log connection, disconnection, and error events. The remaining handlers are more interesting. They implement DragonDoll's main command set. Let's dive into each one in detail.
The following sections describe the message handlers and the commands they support.
The onActionMsg handler processes the fe78a618 event, or messages of type Action. It receives JSON instructing the spyware to perform an action on the device. These commands do not return results and do not write execution results to the log database. Supported actions include:
POWER: open the power
VOLUME_UP: increase volume
VOLUME_DOWN: decrease volume
LOCK_SCREEN: turn the screen on or off, depending on the current state
RECENT_APPS: show recently used applications
: return to the screen
NOTIFICATIONS: open a notification
KEY_PRESS: press a specified key or character
The handler is onSreenViewMsg , which processes the bdb22236 event, or ScreenView messages. It also receives JSON and uses it to interact with the screen:
lastClickedNode . Uses the supplied screen bounds to find a clickable element and clicks it via performAction.
clickNode . Similar to the action, but searches across all windows rather than only the most recently opened one. Unlike lastClickedNode , this method uses several fallback techniques to increase the chance of a successful click. If it finds a matching accessibilityNode by the supplied bounds, it first attempts a normal click action ( performAction method). If that fails, it focuses the element first.
It then performs the click. For keyboard or for elements where no accessibilityNode can be obtained, DragonDoll performs a more complex click using GestureDescription.
textSender. Inserts the supplied text into the currently focused element.
gensureScrol. Generates a scroll gesture.
enableBlackScreen. Makes the screen black, disables touch interaction, and allows the spyware to continue operating.
disableBlackScreen. Reverses the command.
buttonAction. Uses performGlobalAction to emulate one of four system actions: , BACK, NOTIFY (open notifications), and RECENTS (recently run applications).
The onTaskMsg handler processes the e019c6a0 event and messages of type Task. These commands are more complex. Their execution is logged, and results are sent back to the server. Notably, only these messages are encrypted with AES-CBC (the key established during the initial network exchange).
The full command list is shown below.
DISABLE_BLACK_OVERLAY
ENABLE_UPDATE_OVERLAY
DISABLE_UPDATE_OVERLAY
PIN_SOLVER and PIN_SOLVER2. These two commands are used to enter device unlock credentials. PIN_SOLVER is used for text passwords. PIN_SOLVER2 emulates a single-touch gesture across specified points, most likely to enter an Android pattern lock. The password-entry process is implemented as follows:
DragonDoll searches for a suitable accessibilityNode by ViewID, for example: com.android.systemui: id/password_entry, android: id/text1 . It checks that the element is a text input field, enters the password, and then searches for the Enter key.
PIN entry follows a similar flow. DragonDoll searches for nodes such as com.android.keyguard: id/key, com.android.systemui: id/key , and others. It identifies the required digit and performs a click action.
ENABLE_INJECT, DISABLE_INJECT, and RELOAD_INJECTS: commands used to manage screen injections, that is, displaying an overlay that visually replaces the application's interface. When DragonDoll receives an inject task, the server supplies only the package name. The spyware then performs the following actions:
Creates the directory /ov1/. Creates the file /ov1/ .so.
Creates a "package name + file path" pair in the overlay_htmls_files hash set.
Sets the true flag for overlay_enabled_ .
In the acss class, described later, the onAccessibilityEvent method processes TYPE_WINDOW_CONTENT_CHANGED events through processContentChangedEvent , which then calls updateCurrentPackageAndOverlay . This method checks whether the current package is present in overlay_htmls_files and whether overlay_enabled_ is set to true. If both conditions are met, DragonDoll creates an Intent for the jin class.
The jin class initializes a WebView with broad permissions for interacting with the page, then loads data from /ov1/ .so . The JavaScript interface is implemented in the inject_interface class, which contains three methods: returnResult, sendData, andsend_log_injects . All three methods perform the same core action: they create JSON messages for the operators containing user-entered data and the current package name.
The resources do not contain the files required to imitate application overlays. Those files are saved only after a special GET_OVERLAY_APP command is received from the server. For this reason, we assess that this functionality is likely used to impersonate banking applications and other login forms in order to steal credentials.
START_VNC and STOP_VNC. These commands start and stop the VNC server. When DragonDoll receives START_VNC, it obtains connection parameters: host and port; password; pointers flag, which controls mouse-pointer behavior between clients; view_only flag; and access key.
DragonDoll then initializes the VNC server. Its implementation is based on the open-source droidVNC-NG project, which provides remote access to an Android device without root privileges. The project consists of Java components and a native library loaded by MainService (msrv) :
The Native library is loaded via System.loadLibrary and handles the network connection. It exports functions such as vncStartServer, vncStopServer, vncConnectReverse, vncConnectRepeater, vncIsActive, and others.
The Java layer handles Android Framework integration, including foreground service lifecycle, notifications, permissions, MediaProjection, AccessibilityService, Intents processing, network changes, autostart, and UI interaction.
In DragonDoll, the Java wrapper consists of several key components:
msrv, MainService. The main orchestrator. It receives commands, starts the VNC server through exported native functions, configures screen capture, registers the service on the local network, and tracks connected clients.
mpsr, MediaProjectionService. Captures the screen using the MediaProjection API to create a virtual display. This code closely follows the original project.
mpra, MPRequestActivity. Tracks requests to create a connection using parameters received from the C2 server and configures file transfer from the MediaProjection service.
srv, InputService. Intercepts user input, including clicks, taps, swipes, and keyboard input.
One interesting detail appears when DragonDoll creates its notification channel: it uses the name Chrᴏme, where the "o" is not the standard Latin letter but the Unicode character U+1D0F.
START_HVNC and STOP_HVNC. These commands enable and disable the HVNC server implemented entirely through Accessibility. When START_HVNC is received, the server collects the full node hierarchy across all active windows. For each window, the server creates a snapshot of the interface by sending a JSON tree describing the current node structure.
DragonDoll then waits for ScreenView messages from the server, which are used to emulate remote control of the device. Until the HVNC server is disabled, DragonDoll sends updated interface information to the C2 server on every TYPE_WINDOW_CONTENT_CHANGED event and on specific package-related events.
The acsb package contains a single class, acss, which extends the AccessibilityService service. AccessibilityService has long been abused by Android malware because of the extensive capabilities it provides. As described earlier, DragonDoll uses acss to execute most commands received from the server.
The class also overrides the onKeyEvent method, allowing it to intercept user input. In addition, it overrides the onAccessibilityEvent method, which gives DragonDoll visibility into many UI events, including clicks, focus changes, and text entry into fields that may contain passwords. These events are routed to the appropriate handlers.
DragonDoll's Accessibility abuse goes even further. By inspecting intercepted AccessibilityNodeInfo objects, the spyware collects data from messaging applications. DragonDoll has dedicated logic for three messengers. For all other targeted messengers, it uses a generic collection method.
DragonDoll steals information chats, groups, and user statuses. It also collects the list and, when a chat is opened, records recent messages, timestamps, and the involved in the conversation. The malware uses findAccessibilityNodeInfosByViewId to locate messenger UI elements by specific ViewIDs that contain chat and user data. For example, the following ViewID is used to collect chat-related data, including sender, message text, and timestamp: org.thoughtcrime.securesms: id/conversation_list_item_name .
In addition to collecting all visible readable UI elements using the generic message-extraction method described in the Other messengers section, DragonDoll uses a specific technique to collect Telegram notifications. Among all UI elements, it searches for the one positioned at the top of the screen.
It then checks the number of child elements in the parent node. The count must be greater than four. Publicly available descriptions of Telegram UI layouts show two XML files with five child objects: the layouts for large and small notifications. After identifying the notification structure, DragonDoll extracts and stores the notification text.
For WhatsApp, DragonDoll behaves similarly to its Signal logic. It uses known application ViewIDs to collect information chats, contacts, and message content.
* WhatsApp is a product of Meta, which has been designated extremist and banned in Russia.
For Viber and all packages containing the substring messenger, DragonDoll uses a simple method named extractGenericMessagingContent . This method recursively walks through all incoming elements and extracts text from each element and its children.
As noted earlier, the bgs class registers multiple receiver classes.
These receivers collect information events of interest on the device and store it in the database. The class names are descriptive enough to infer their purpose. Their behavior is summarized below:
air. Records when airplane mode is enabled.
btr. Collects battery-state information.
btrcv. Stores events related to device reboot.
btrs. Records when power-saving mode is enabled.
dlr. Records when the phone is locked.
rig. Records the current ringer mode (silent or normal) when the mode changes.
ir. Collects network connectivity information, including connection type.
pr. Collects information application installation, removal, and updates.
scrv. Records screen on/off events.
ssrcv. Reports the current SIM card state.
uus. Records the time and details of USB connections to other devices, such as a PC.
wrcv. Reports Wi-Fi connection parameters, including IP address, MAC address, and connection speed.
The bgs class also initializes SecurityReceiver. Despite the name, this class is not a receiver in the usual sense. Instead, it registers a ContentObserver instance that reacts to global changes under Settings.Global.CONTENT_URI . It monitors potentially interesting changes, including development_settings, adb, selinuxStatus, and others.
The class also checks for possible root privileges by looking for specific files on the system:
In addition to these passive BroadcastReceiver classes, DragonDoll includes several special-purpose classes:
almr. Internal event manager required for AlarmManager operation.
dar. Extends DeviceAdminReceiver and tracks privilege escalation events. It is used to check available permissions through the DevicePolicyManager service. It also records events related to password entry, username configuration, password changes, and entering or exiting lock mode.
smrcv. Handles the android.provider.Telephony.SMS_RECEIVED action. It collects data the sender, message text, and time received.
smsdr. Handles the android.provider.Telephony.SMS_DELIVER action. It collects data the sender, message text, and time received.
In the analyzed sample, we noticed several distinctive classes in the APK dropper:
PermissionPollService
We then searched for additional file indicators of compromise and found multiple packages with similar names of source files and similar class names. Most of these samples had been uploaded from Russia, with a smaller number from Spain and Saudi Arabia. One file was originally downloaded from a link pointing to the GitHub repository nowayintheland.
The operators registered the GitHub account kesmanta24 using the email address [email protected]. According to the commit history, this account was used to update the backdoor from March 6 to May 6, 2026. Over those two months, approximately 150 unique samples were uploaded from the account.
However, the samples differed only slightly. The discovered packages loaded the final payload using the same scheme. Based on the backdoor configuration, two DragonDoll versions were uploaded: 9.3 and 9.4. A quick comparison showed no major changes in backdoor functionality. The main difference was the addition of JobScheduler for most methods and receivers, which made DragonDoll more resilient after device reboots. The updated backdoor also introduced new commands. The spyware configuration changed very little: in all samples, the C2 address was channelzones[.]co.
ENABLE_OVERLAY_MAINTENANCE
Similar to the inject command, but the specified overlay is displayed over all applications.
DISABLE_OVERLAY_MAINTENANCE
Disables the command.
Initializes the socks5 tunnel using the supplied host, port, device_id, and token parameters. The tunnel functions are imported from a native library.
Removes the malware's own application package.
Opens an already stored overlay file.
The GitHub project led us to the phishing site datewithmealways[.]site. This site was used to distribute DragonDoll.
The page told the user that a critical Google Chrome update was required. If the user agreed to update the browser and clicked the corresponding element, the DragonDoll spyware was downloaded.
Using shared network characteristics, we also identified the following DragonDoll distribution addresses:
datewithmealways[.]online digitaladstracking[.]com
Like the APK file, the phishing site is localized into multiple languages. At the time of analysis, the initial source of links to the phishing sites remained unclear. Another notable detail is that the operators used Russian hosting infrastructure for their C2 server.
009027bda168bb10e7c17276ee95b6978a4835c93cdea953601a5b59966bf1e0
00dc95ba96e0df375ff15106f2dc2ed2f2dadc081dd6b94281edbee38a405545
019fd9143e6c51222b0dee1b3c3d8bf479052f6d7b8333f48cdfada4ba7dbd35
02afe94e2a0af9a0c33ca7256d7b7ff3c9d0f3f7a29c045a296fee161915bfe0
04d259ca2162f439c56d91796da0e12b9d47024425e14a61a302e7113143bbca
07551538ddcfe1be2d995c5dd172f22319a7f578267e5fa8655880888f3203d1
08978e3be3bad4c0982b716760f0d75a5f11bc87f27fce49cdb9bff08e6b3e1c
0d30a0ea32182136cec12281dc1aa209e750e4191956437136eb595893fefbf4
121607d969decb9a15f6eff42808e07decfc70f691d5c4460c6c43ae3c6296d9
138beada799604a74faad91b2789b991ff98d89addca3cadb8bac0af76fa21c1
147250257d3771a5d1f9f19959bafb913321d579e5715c75c7a53f42839a4c70
14a93f5dce190084037a88832b8756defdefc33a4cff1b44fe29b91656c8b3bd
1538adbc9188a5d936d8bc1ba5a336eaf252fb7de04f1275c62dcf85c8e542d3
157fb7ab7d77bd5179befda6e3281a31552d5d2481f0651db78a86125cd35048
1708101e3ead86392487f810790203c88fb36ea73e1b33f89cc226d36012ed71
17a554f79c7802be132579ac2d4cde8eabb210e0c55a26758b5460f2755d39b7
18118aa36a2ed00f524f7fadd5250e2c2c4c325d1773e30059d3b976511b481d
191f67d4302fdb744963e5f67275bf4a8b9eb10c41b1a461aa80e9021dcaf1b6
1a4128feee9459ab1f4d0c57b7629e3cbb220d961ef000feb94cf82feb5694f3
1ae2e020459b32fcae28a6d95e8453d573ad855ead56ff3864a9c7c258d31c32
1b744055a963c9fb9cb5ee30fde560487995962f2bfe7637152596288464dc47
1c9336ff9f12e61ce047c161e4bb30468392aca52f9c31d5d90233ea0d66f619
1d4494a8cf0c21edf236bff5c83c74f04d97609e90c983f83b1ed4874c18e754
1dd2573a2077553ae65a2be8fdf0e1b0d5d34e8ede1a4b8d4f012f28e72d0674
1fecb30ce7f3062e51c3713c6a7b683b6bd49b2edb6b2ff29ddb312d671d8e9c
23d1c6ef0be522519d9a3dd2cbd82e101e98a1c5d29d28213a12009a3adf4605
252dc3b6f024ddbfb0d098649d29abcc09f6a242a0427a0b373fd421981ce941
25a701617b397cf8b6e423252d14dc6e806be412b7411901266953337d997b83
26a0ce3a650044acbe91124f9bc6baf34e650002ed0ce1d08bb2b0cf89faba76
2915bd953252dfc827257063408a84f5aad0d86efe81ab6446d391bc49caa1ea
2a0837e3fdd89febf9c7cecc0d56e99e0958254d5bb73785fa4c3dedd7596057
2b355989aeea2d76842708c6d2b2b85889a4eced1e02d8cd0d36048d46e70bb5
2b4c342120d8eb56eb1558c751315739b82665ea6ae57faff21c9ada3b708dc1
2be25265858ee1d397ffae3251449615b315fe748745adc9b9ad871f6cf64ce3
2dc246d6e4f799c524b79bf6fea2f932cd36ca573f68d5115412a1921c1da4dd
2e313c8b0987291455ed87057029ad70fe766525f9d477b008cd632f589dbd58
2f7cda796008517fb57daf276996769b9f7fc9b7bbcfe7e86bc007d79d8d7c59
2f992640a490510b59bd967ad88504a198ccd42674070712b77d990a6e7103b7
2fa3766861538bebaf1ac4ee3ea4d84def5f950663adbda7ce9b936f92f66d7d
2feba3d30aff71b3b7105dd9ee83b940622919b3998a556881eed83d1750a01c
30ae2b0ff29a06c5142ce431e56b016217948556564454dcc066b8ef6484b9e5
32e03f8b89a480d40f80502c571d81cd0fd874565732540ec7f1e2bce7b8c1d4
3800c53713e5a7510bec012c966043e7632a7fd9900542bd124874b68541311b
383262120709ef7afac82fb4680166b07945328b026d33e23f1119e725cd1a38
41ed3e6c7376267daa85b53a529c41d37da2907dc4be0f9cf9802bf1acc98a2a
437ac8c7463dc7f7e45fa37b2cee87d649cb440634aa12d68fc6c00111910a1a
44142f3395231a75efde83e0715e732a1f872901bf7f1e31327deb9c4da3cdd1
44b4ed5f7a37cfb31e7e82d9d4357fe4e05823bf2e4eab9be58cdff722df2cff
474c4df0e0cc6d754fab946d0f13f0bd07631a186ac3fc0be126436274819a7d
4d139c1b9cbfcbffd458f8ef3710c0abceeeeaa1454e040c0765705353bb8e1d
4fa49919bd7708200ee017396038235ce754da19d705c1087473e56cc5181e40
51559181164cfce03348ac51722f55527cf3910897990b3aa79b5b8d46baf0ec
5255579444eedd89cc6547e6c9052fd42d77366ad01e18d18401ad1dc65c7ddf
530f65d96e5a641fc3e505832c064d8592f195f410dd362fcbfa445f57161837
5809d704abdc1d7c88360dec27295a762437bffb58e52a1e121f07bd42193c41
58fbabf0a5ed08c400bb65bc37f4938c6375976c1c2ca3c3fa7904b53add1066
59cd4f82f55645acab667f57d81cf9d9d6228474176d8752a3a9f4bd9c9b647a
5d8fcfbdbb1934cd50376fe752581f79b35c9dbbc08cc7e19d93444eb0e02361
5e752858271edeba74b335ff3476c5331e87dbf8954ead60a7185c3404d3e3bb
6006a72ce1afedfd5b454babc02fa202cc90eb8bd4f3eaa17ae527005bd11732
604ca3fe03cf1bbefcbf38af80c40e627d642e6bd19a9eac7213cbc087750708
606871f3810189d4ea22f28a6127887a73de27f7fee25e5e4fafc0ea742e0fe0
62c112a95514fa7375938a82261c938c1bcbe904ad7cad82a037f3eab142889f
63805aaa6f1b78d1cbbf8f497abdc12fb967a431202fcbaf58015944e1bff1ec
6653b36c69638d2a61f6ea45f6d06c1f71f8643921023b04696cd64b2c9d8f3b
669f002c9d66ceacfc1731d58314ff89d049707fb615dcf586f8c581696bc611
6b5dd6e6e752ea6924b8b24f857999967454e44414cc23957c167201e731d6a2
6ffc922f0bc8243b338e7bc1aa1a73e404572c950585864caf2808e135cb81f0
7166ba39c805c77a1a737b5e76a0a124492842537289119b0a20de5a772922d1
73f7d0326f158d220e1e343d8956d0ffe60a7d54d0f9ec3f1279a1fcfb257967
763676c06b79e490ab3074b60f82e921cbd68e76f41cc1a94426d89e871a93b6
784aeacdc9158c9269749dcbff2c80cb9d755490cf502608aceb466c32134562
794dbb1d7ec804bc8e4aadcff160c2306d8c4e333e17839ced4ee694f88d2190
796e1360e809c91df6d078665295d269451b725a7344445aaa41781ad78800b1
7c0b026b99afb385430b682302682f1e623ddd54d497ce19effbc6b895dc7034
7fafa7d0ef54063f5ededd74fb9e5de7dc1847a41aba5b227af175a031826403
81f4d31228e3a47b69ddfe2dca1a5bdecf99012401719273922bdd7a1d3609a2
82fe23506cc0269b98738b3cb2e75ad6ed8cc1c70605a10885d4729eca443b1f
885736028540a911d0e8b4f315ea5944438d46e58c6f30bb93f982c5e33d19cc
908658af272cd35e6a3f72c625a73c7dd6a63ed15a5a723133fc8e8b4ea48aec
92e30739b1ac316b7f83e7f57c6e540b826bef0f79e5c1e6795ebf8ea775e9a0
93cbe3516ff2984f9dc265d30d55c8e6c18ddf8ec9d8f579169c58ae1f30b111
961a2f72f4f6fabcea24d453dbea720986f46a05f7138b90474f4f07f8e234b8
98fa599750ba85f50cf1600f1dfec4c05a5a4cb92b89b78e6c2e6536cfd3be45
9a7e0c20de51615b04adfb82c4ed6ec13274d0dcafc163322fa578d18146a6e7
9b10c8d745b14428563cd40e83e7a7e5868d7c426d65f0a23a004abfda2bb771
9b7ffd0eba2fcbb4be95b303909b64843aa9ae4c32bcc5c5b2b8b68bb20ca587
9f724c6a8f32184dc806b9322f06d5830967efb6b6e724e9d302e2c24f1d540a
9fe2c6177dab9f0a1625b57570ca87a97a7becacabd81086f909a8cf77d95453
a04f99b61ff22e68defece0e2da932429917ec73527563685eec1266cfcccd3d
a0b1ad6a213e9880bafebf1c921cd736d7f4f4d7d248561dcdc43afd90688367
a44f33c23195a76239f6c10e8d1961366bf10ff42060585c133b7c66d1f978f4
a6347ac5d4b2383c86e656bf023f6dc3dd5ef501157a0d2a5fb7d9603d0b5d2a
a63c9d0f90a57adbde17c20fe5bd97199cf11587c05cdcb5b2cd5c1bebb05311
ad58dbf2ad7b397f2937ef155c0171aca970ccad32cdfcf63cbd36e520117764
adb4e5591480112a2ad1143d25832763f3dd1daa7f4fdde9962d65e875dab47b
afd7d44fd21dfbe20c7abd86166325f6404a3954041f45acbad47f48ac86db27
b0d1de979e38551fe682ba76caa66c3925f881ff78654c095cc82d7de2a5625d
b0dd7bf9df50a8eaffcad4a07b23e808f4785e502fb052a98e6ba9e94b06cf34
b40dd2bbf03967c11cd0b46cf8e70442dfb4fe881b112e44eea30256c8e6900d
b62f6feedb17d55087fa9946ca122cec5241fe13222f39add995998a2282ea03
b95b47357e08cc179ac5313d32e4f518bbd57cdc7f59eb14a451e72b6f8f54c7
bc908b1fbe1ccccd365f7c2345cc7dd61565d81dc2b734914be3a946fa7b6a17
bf4adc5a251b311cdcb30aef063e4edc407c61f16ed1a85b3f2c2204f1509ab4
c16c0e024cfbc5d9958c70b2728bf8e78003af4fb9a886a6f631969ee6f92250
c1c8d3fb40005bc60fc9c1396a4de98c7237619c2c9c896430a9d53f7363d12d
c2552ec7bb19ff16d27025abdd04d0ca96ce0dfb44dfaaf8b3f372259f0da457
c3a2e37c77b64763bd157636534838fda30b055cb5566ea0a90cce7163be1df7
c9d6f903cd1aa6fb4c95d37f0775ed667b6ae863d77180b48fc43557b7b16946
cd792c88177f0fb9af96de19831dbeadf9747c253b5154c8cfa91f7e12e41d5a
ce82f42dbba26f08039245247e360ef693cba6eb5a7ea16f870338676c463fd8
ce936a7d65f9b18b37608fa65a9f10ad881bcbe736c339bd043f7895ec46722e
d286a8007e9955ca30f923b1b5f418d34aa812d34e2958697378e2431bbe02a8
d47021dbfa14ca4012f68609f1892f8192a1cae5330067714467b1b06a256a8b
d4827fa238ca2f2c1447c81a50af4856e96bd2d92c3d36f686b5ef57fcc1f25c
d504e441c4f2613aa967d3367c8501fb34ccdbe56636af5afb7e6bcffb3a5e29
d62c02200a4a6f3ed90cb0f79cf6968eea6f1aa00458e835d97971ea9eab7a58
d6dab673d483899e01477ab7780751d6fa676c58b4eea55f76cda3131677305a
d746112da0608989a7165b78d20823f6b5a295df60c662d522ba1a41352a30cc
d84709435ff0d2f8d6b062f5b84300ec22a7772e6a67257ccfaf1e963bc09e8b
da02692647eff98bb3fa03e5eb0b6ba949979cf47ef38073f81bd95a61dd2053
dc8aec8c26ea66ead3f9034af6dcbe4a669d7a2e802349aee92e4a00b14a6e64
dd5d38aac146778dfef9079b7a19c6bd100599958603b35b10642159a9c5d044
df59ae4f45b4c1dc506efb222a4ac1faf25d66cc8910ba8211e9bff72327507c
dff4c18df5c09cea85857985a3be05713fb82599477758ce43260b5ceece173b
e07dfb6b580e771f1628c9e3978816cf6b78ffdd4443fd15e063101383be0e2e
e17c295e3d660ee69cf621530636e021aaa4dd401a2bc3ced0b09547817a2083
e2bf8753b40955d803cf8a12de5e92afe7bd52b9f093c7066696ee4b2302ede7
e48f30f476685b83707f86be367928e70c9dc0d35f4263f83d5eb74f1fb1a0f0
e5d6366b2b7972883bc700c53bea525563fa7a8a7a8727c7a72fb7e3321f6515
e625a87358249ffd06b11bbda038c3b1c39c2d7100f0a75071959efd835c2551
e62e96a5fd3a09b640ebd14c942f55fa32a1277e23d2fe8592b12fdd523dc1cd
e6b3cc520061790f45d55d75dd95e29be2f08cfab8e515e15c05adb6415723df
e8748e7184580b520050413352ca87c8b1d9b9428e71e2695c99f63a41ab78be
e8dfa2da6a97a141572dec2e643f2a0e5d221ae005f41b64634ac997c47e6e99
e9f2371cc72e1c441cdca918535f543ad78d3815f2eddb2d92ff80afe2356edc
ed1f9af1cae7e22a6e6c1253828ad5005ee42eb9837749611cdf62454939cc92
ed850a6754947c86ce6af38e2de056f1cbf5416283e84234bfdbd154031b258d
ef5f9534017782e47d2fa5fedaa833697bcc713510ee23dd5701719d5d554218
f1a6c2b8f18b6d42a6cfc764bcb56fcdb4730f1fae62d300caf9bb33eb99626e
f1d0cbda71addfe5366a228018c8fd4678dc178980dd62de4195c980fe044678
f1df6d4cfe5aee3ed8e25d80943831a385c0eb90891534f39a09edb3117899db
f232100025af74854dc2c09170f167613e7fd4b0b9a497e93629c62efb12a91e
f23a8e94c09ce70e8fda6b431759d315d2b892911793a8d513b55a5da21fab47
f27a8f0924e06984558d660d31ab508cec61c8851abf0032546da73caeee1276
f563a8c9579720d2382e63ccf49ee559d57c084c0fe62c7a503e0beb822cf5d0
fe838f017d1239cda1b474b94b65b782bc7c62583a4d931979df197c14380c1b
fe90eca568f307530f04b9d5219d461aaab935d46cfa894e381670bbea5f54ae
Hosting technology LTD
Hosting technology LTD
Device Administrator Permissions
DragonDoll checks the system for specific files and permissions that can be used for privilege escalation.
DragonDoll can trigger clicks, complex screen movements, and text selections. It can also simulate pressing the , BACK, and buttons.
Ingress Tool Transfer
DragonDoll can download overlay HTML pages for subsequent execution of the inject command.
Foreground Persistence
DragonDoll runs its main classes in the background.
System Information Discovery
DragonDoll sends basic device information, such as the OS version, device model, root status and country. It also sends device hardware information, such as the kernel model.
DragonDoll uses the AlarmManager API to schedule tasks.
DragonDoll examines the applications installed on the device.
DragonDoll can control phone calls.
System Network Connections Discovery
DragonDoll checks the network connection to select the appropriate distraction element (link or HTML page from resources).
Uninstall Malicious Application
DragonDoll can remove itself from the device.
Download New Code at Runtime
DragonDoll can download and install additional application files.
DragonDoll can delete SMS messages, call logs, and numbers.
DragonDoll can simulate a screen-off state while continuing to execute necessary commands. DragonDoll can also change the overlay of applications, both its own and third-party ones.
Symmetric Cryptography
DragonDoll encrypts its messages using an AES key generated at startup. The generated key is encrypted with RSA using a public key received from the server and then sent to the server.
DragonDoll disguises HTML pages stored in the application resources as files with the .so extension.
DragonDoll initializes more than ten different broadcast receivers to monitor the state of the victim's device.
Abuse Accessibility Features
DragonDoll uses Accessibility Service event monitoring to execute most of its commands. This allows it to monitor user interactions, intercept text input, and steal data from messaging apps.
Obfuscated Files or Information
DragonDoll hides the C2 server address using AES encryption. In addition, most of the strings used during its operation are obfuscated using XOR.
DragonDoll can capture screenshots.
Suppress Application Icon
DragonDoll uses the HIDE_ICON command to hide the application icon.
DragonDoll is distributed in encrypted and packed form. The dropper uses the BadPack technique.
File and Directory Discovery
DragonDoll checks for specific files that can be used for privilege escalation.
When VNC is enabled, DragonDoll transmits the contents of the victim's screen.
Exfiltration Over C2 Channel
DragonDoll sends all collected device data to the attackers' server.
DragonDoll uses native libraries for the VNC server and SOCKS5 proxy.
DragonDoll can manage SMS messages by acting as the device's default SMS application.
DragonDoll can log keystrokes and steal passwords entered by the user.
Match Legitimate Name or Location
DragonDoll disguises itself as legitimate applications, such as Google Chrome.
crime_android_ZZ_DragonDoll__Spy
crime_android_ZZ_DragonDoll__Dropper
tool_android_ZZ_BadPack__Trojan__TamperedHeaders
Create.System.Package.Install
Create.Android.WebView.UnsafeContentAccess
Create.Event.Broadcast.Receiver
SPYWARE [PTsecurity] DragonDoll sid: 10017941