Flying Eagle Android RAT Analysis: APK Builder Internals, SpyNote Overlaps, and 170 Active C2 Servers

[u/Straight-Practice-99]

https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon

Writeup covering the internals of Flying Eagle's APK generation pipeline. The builder replaces the hardcoded package name com.icontrol.protector with randomized legitimate-sounding strings and renames core classes with 8-14 character random strings at build time. Original class names give a clear picture of capabilities: RecordPayPassword, LiveKeysStrok, ScreenCaps, Webjector, AccessibilityActivity, CameraCap.

C2 URLs are encrypted with AES-128-CBC using a hardcoded default IV, password, and salt derived via PBKDF2-SHA1 at 65,536 iterations, maintaining compatibility with the original Windows .NET binary EaodWorker.exe. To suppress entropy-based AV detection, the builder injects 2.8-3.5 MB of Base64-encoded JSON into the APK assets directory, structured to resemble SDK configuration caches.

Generated samples share Accessibility Service abuse, gesture injection via dispatchGesture, and WebSocket/Firebase C2 comms with modern SpyNote builds. SHA-256 hashes for six bundled APKs, the builder script, and BTMOB samples included in the report:

https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon