---
title: Wicked Panda Using WyrmSpy and DragonEgg Android Spyware
description: Lookout recently reported Wicked Panda was observed leveraging Android spyware families WyrmSpy and DragonEgg.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Wicked Panda Using WyrmSpy and DragonEgg Android Spyware](https://blog.polyswarm.io/wicked-panda-using-wyrmspy-and-dragonegg-android-spyware)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Jul 31, 2023 6:33:15 PM

## **Executive Summary**

## Wicked Panda was observed leveraging WyrmSpy and DragonEgg, two spyware families that target Android devices. 

**Key Takeaways**

- Wicked Panda was observed leveraging WyrmSpy and DragonEgg.
- Both families are used as spyware or surveillanceware and target Android devices.
- Both apps request extensive device permissions and rely on downloaded modules to achieve full functionality. 

**Background**

Lookout recently [reported](https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41) on Wicked Panda activity leveraging two Android malware families, WyrmSpy and DragonEgg. Both families are used as spyware or surveillanceware, which falls in line with Wicked Panda’s propensity toward espionage. The use of these malware families indicates Wicked Panda has expanded its targeting to mobile devices. Although Lookout first discovered early samples of these families in 2017 and 2021, they have observed WyrmSpy and DragonEgg being used for activity as recently as April 2023. Lookout linked this activity to Wicked Panda due to the malware’s hardcoded C2, which was a part of known Wicked Panda infrastructure. The apps linked to WyrmSpy and DragonEgg do not appear to be on the official Google Play store and likely came from a third-party app repository. Lookout believes victims were lured to the downloads via social engineering campaigns.

**What is WyrmSpy?**

### WyrmSpy, first detected in 2017, masquerades as a default operating system app used for notifications. Later variants were disguised as adult video content, a food delivery platform, and Adobe Flash. WrymSpy requests extensive device permissions and then leverages modules that are downloaded post-installation. Its capabilities include harvesting and exfiltrating log files and photos and acquiring device location. WyrmSpy can also read and write SMS messages and record audio. Lookout researchers noted that based on the permissions requested, it is highly likely a secondary payload exists for more extensive surveillance capabilities.

**What is DragonEgg?**

DragonEgg, first detected in 2021, masquerades as a third-party keyboard or messaging app. It also requests extensive device permissions and relies on additional payloads to achieve full functionality. DragonEgg is capable of harvesting and exfiltrating information such as device contacts, SMS messages, external device storage files, device location, audio recordings, and photos.

**Who is Wicked Panda?**

Wicked Panda, also known as Axiom, Winnti, APT41, and Bronze Atlas, is a sophisticated China nexus threat actor group perpetrating activity in support of or in conjunction with the Chinese Ministry of State Security (MSS) and the People's Liberation Army (PLA). Active since at least 2009, Wicked Panda’s roots seem to have emerged in cybercrime and later evolved into the group’s current form.

Their activity has ranged from criminal, financially motivated attacks to stealthy espionage campaigns in support of Chinese military intelligence collection requirements. Wicked Panda has been known to attack a wide range of targets, including software development companies, computer hardware manufacturers, telecommunications providers, social media companies, video game companies, non-profit organizations, universities, think tanks, and foreign governments. The group has targeted a broad range of entities across the APAC, AMEA, and AMERICAS regions.

Wicked Panda is known for having skilled programmers capable of developing sophisticated tools. The group uses a variety of TTPs, including but not limited to LoTL tactics, phishing, ransomware, cryptocurrency mining, supply chain attacks, China Chopper, Gh0st RaT, PlugX, HighNoon, Derusbi, BioPass RAT, RedXOR, and ShadowPad. The group is also known to steal software signing certificates to use in their campaigns.

**IOCs**

PolySwarm has multiple samples of WyrmSpy and Dragon Egg.

 

**WyrmSpy**

[b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905](https://polyswarm.network/scan/results/file/b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905)

[6caf068e1c0be245083aa6c3b92bd34909cb57d3d989cf509db18a8be4045fc5](https://polyswarm.network/scan/results/file/6caf068e1c0be245083aa6c3b92bd34909cb57d3d989cf509db18a8be4045fc5)

[43193e32872c589785ae720da875e5e20099a5fa36c8aee838034c91986ed34c](https://polyswarm.network/scan/results/file/43193e32872c589785ae720da875e5e20099a5fa36c8aee838034c91986ed34c)

[4355b4eb3d73b96577194cbd0ff319e0f4ff02d0cabdde8b15e1abd1840e6481](https://polyswarm.network/scan/results/file/4355b4eb3d73b96577194cbd0ff319e0f4ff02d0cabdde8b15e1abd1840e6481)

[6b9a540801613a2abd15b5994def2ac4904a896e14e1ab364b032de5b3d1e098](https://polyswarm.network/scan/results/file/6b9a540801613a2abd15b5994def2ac4904a896e14e1ab364b032de5b3d1e098)

[8bf60e625d628e39320015de654933947b56621d8a4538f9be55c27ffc29a99c](https://polyswarm.network/scan/results/file/8bf60e625d628e39320015de654933947b56621d8a4538f9be55c27ffc29a99c)

[8c01132a0c1c7799e44608247f93d4680935f36df3fc94d59c7da83afe375ff2](https://polyswarm.network/scan/results/file/8c01132a0c1c7799e44608247f93d4680935f36df3fc94d59c7da83afe375ff2)

[8d7fd7dcf5f0e144f3e3cc96ebf3ab8789d0d8edaeefa65e0f03dac67c1f046f](https://polyswarm.network/scan/results/file/8d7fd7dcf5f0e144f3e3cc96ebf3ab8789d0d8edaeefa65e0f03dac67c1f046f)

[7a618ac4a0fb2b68df540554ee99aa48caa148b3dd2800777a084a7322efe22f](https://polyswarm.network/scan/results/file/7a618ac4a0fb2b68df540554ee99aa48caa148b3dd2800777a084a7322efe22f)

[36d72fedc17be9936f182b38ca98c40a0f9ba44cac170bd63cbded9568452d25](https://polyswarm.network/scan/results/file/36d72fedc17be9936f182b38ca98c40a0f9ba44cac170bd63cbded9568452d25)

[1d76df42d77080a96f885ed31ab8a83f4f985e071e715fd54297dab398c4be6b](https://polyswarm.network/scan/results/file/1d76df42d77080a96f885ed31ab8a83f4f985e071e715fd54297dab398c4be6b)

[fa4a0aaa6b8f25e8f177ce2e3202c933c2358d4a45d94427dd54df83778a4225](https://polyswarm.network/scan/results/file/fa4a0aaa6b8f25e8f177ce2e3202c933c2358d4a45d94427dd54df83778a4225)

[9ba0078a12f7cd515303aefdb151d65a2d3cb1188242e72e3bd9e629dc246582](https://polyswarm.network/scan/results/file/9ba0078a12f7cd515303aefdb151d65a2d3cb1188242e72e3bd9e629dc246582)

 

**DragonEgg**

[79a316353747d11ca0ac00e6cbe1e1ce80061d067d9ff3274be33c40d12ca5de](https://polyswarm.network/scan/results/file/79a316353747d11ca0ac00e6cbe1e1ce80061d067d9ff3274be33c40d12ca5de)

[68494cde4ee344cba80e8651c579418f2ce534018d88745797f030a3115ed19b](https://polyswarm.network/scan/results/file/68494cde4ee344cba80e8651c579418f2ce534018d88745797f030a3115ed19b)

 

You can use the following CLI command to search for all WyrmSpy samples in our portal:

**$ polyswarm link list -f WyrmSpy**

 

You can use the following CLI command to search for all DragonEgg samples in our portal:

**$ polyswarm link list -f DragonEgg**

 

***Don’t have a PolySwarm account? Go [here](https://polyswarm.network/) to sign up for a free Community plan or to subscribe.

Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports***

 

[View full post](https://blog.polyswarm.io/wicked-panda-using-wyrmspy-and-dragonegg-android-spyware)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2023-07-31T18:33:15.525Z",
  "datePublished" : "2023-07-31T18:33:15Z",
  "headline" : "Wicked Panda Using WyrmSpy and DragonEgg Android Spyware",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/WICKEDPANDA.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/wicked-panda-using-wyrmspy-and-dragonegg-android-spyware",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```