Flying Eagle Android trojan source spreads across Telegram, traces found on 170 servers

The source code of Flying Eagle — an Android remote-access trojan (RAT) framework — is circulating through criminal Telegram channels. Specialists at Hunt.io, working together with an independent researcher going by the handle NetAskari, matched identical control panels and certificates to 170 servers on the internet.

A fake government app

The framework was tied to a bogus app posing as a Chinese public-security service («公安一网通办»), aimed at Android users in China. The kit can intercept payment passwords and keystrokes, record the screen, access the camera, and overlay phishing windows on top of financial, “adult,” and government apps.

China's National Cyber Threat Notification Center warned back on June 18 that the counterfeit was being distributed from the domain 110gongan[.]com and could steal payment data and remotely control the device. Authorities advised victims to delete the app, check the device, change passwords, freeze payment channels if funds had moved, and contact the police.

What the researchers found

In telemetry from the preceding 30 days, Hunt.io found infrastructure fingerprints on 170 servers: 158 by the AdminPro page title, HTTPS-redirect behavior, and matching response headers, and another 12 by the default certificate that ships with Flying Eagle. The authors stress that the figure is almost certainly an undercount, since it excludes similar servers that lack the expected 302 redirect. That said, 170 servers is not 170 infected phones, victims, or confirmed command-and-control centers.

The code itself, according to the joint research published on July 28, was being distributed as a 388 MB archive named 中国龙.zip (“Chinese Dragon”). Inside was a ready-to-run Docker deployment with nginx, PHP, MySQL, a Node.js WebSocket server, Android build tools, phishing templates, and a default TLS certificate.

The panel lets an operator choose the app name, icon, lure text, and C2 address, then builds a signed APK from one of two templates. The builder randomizes package and class names, encrypts the hardcoded control-server URLs with AES-128-CBC, and adds 2.8–3.5 MB of low-entropy JSON “ballast” disguised as configuration for legitimate SDKs. Antivirus engines flagged the analyzed samples as SpyNote; Android accessibility services were used to escalate privileges and spoof gestures.

Channels and caveats

Modified versions of the framework were handed out by two Telegram channels — SQLRCE0 and Yx Technology, the latter of which advertised cash-out services for 20–50% of the transaction amount. The chats included unverified claims of a breach of infrastructure comprising 189 Flying Eagle servers.

Since June 23 the SQLRCE0 channel has been promoting a separate kit called Night Dragon — researchers found two related servers and an open panel with 46 “online” devices, but could not determine whether these were real victims or test records. Hunt.io makes a point of noting: this is not the Night Dragon espionage campaign that McAfee wrote about in 2011 — what we have here is financially motivated Android malware. And the link between the code leak and the discovered servers has yet to be proven, either.

Source: The Hacker News