DragonDoll uses hybrid encryption with AES-256-CBC for data and RSA-OAEP for key exchange, then sends extensive device information after registration. Its NetworkUtils and bgs components support C2 messaging, overlay file retrieval for ENABLE_INJECT, and persistent Socket.IO-based handling of incoming connections. #DragonDoll #NetworkUtils #bgs #Socket.IO
Keypoints
- DragonDoll protects transmitted messages with hybrid encryption using AES-256-CBC and RSA-OAEP.
- On first connection, the malware sends a REGISTER_DEVICE request to obtain a client UUID and the server’s public key.
- The C2 server returns a JSON response containing a new client_id, and DragonDoll extracts the RSA public key from it.
- During REGISTER_DEVICE_2, the client sends the AES session key encrypted with RSA, then continues with encrypted communication using a random IV for each message.
- After key exchange, the bgs service sends an information message containing device data such as accounts, contacts, phone numbers, app permissions, root status, installed apps, and hardware details.
- NetworkUtils manages outbound messages, heartbeat logic, overlay file requests for ENABLE_INJECT, and communication with the C2 server.
- The wbs component handles incoming connections over Socket.IO and processes messages through six handlers mapped to specific message types.
MITRE Techniques
- [T1119 ] Automated Collection – The malware gathers extensive device information automatically after setup, including accounts, contacts, phone numbers, installed apps, and hardware details (‘the initial message contains extensive device information’).
- [T1020 ] Data Exfiltration – The client sends information messages and other collected data back to the C2 server (‘sends outbound messages and processes the corresponding server response’).
- [T1095 ] Non-Application Layer Protocol – The wbs component uses Socket.IO for persistent inbound communication channels (‘Socket.IO provides a persistent connection through which data can be transmitted at any time’).
- [T1573 ] Encrypted Channel – Communication is protected with AES-256-CBC and RSA-OAEP, encrypting data in transit (‘The transmitted data is encrypted with AES-256-CBC’ and ‘sent to the server encrypted with RSA-OAEP’).
Indicators of Compromise
- [Malware / component names] malware and modules referenced in the behavior description – DragonDoll, bgs, NetworkUtils, wbs
- [Protocol / framework] persistent messaging channel used by the component – Socket.IO
- [Encryption algorithms] encrypted communications and key exchange – AES-256-CBC, RSA-OAEP
- [Message/state names] operational states used during communication and file retrieval – REGISTER_DEVICE, REGISTER_DEVICE_2, GET_OVERLAY_APPS, GET_OVERLAY_APP, SEND_DATA, PING_TEST, KEY_EXCHANGE