xenomorph | 2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850

Target

2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850.apk
Size

2.4MB
MD5

e39505e65aec6835f680c902e1c8f7d8
SHA1

8b2984b8838067903ee3ff95d8a6823106216296
SHA256

2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850
SHA512

19911ed73419450a03ad541f7164a5db05a93e2c63d894ab79fdc50409d77696bdc203155640361d5f12de1929f234d5b2da84ebf4c59306876d725221310887

Score

10^/10

Malware Config

Family

xenomorph

simpleyo5.tk

simpleyo5.cf

kart12sec.ga

kart12sec.gq

Family

xenomorph

Attributes

PackageNames
com.android.vending

com.google.android.gm
URLs
https://homeandofficedeal.com/local/multi/com.android.vending.html

https://homeandofficedeal.com/local/multi/com.google.android.gm.html

AES_key

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.spike.old
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.spike.old
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.spike.old

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.spike.old

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json	5223	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.spike.old/app_DynamicOptDex/hq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.spike.old/app_DynamicOptDex/oat/x86/hq.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json	5186	com.spike.old

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.spike.old

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.spike.old

com.spike.old
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5186
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.spike.old/app_DynamicOptDex/hq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.spike.old/app_DynamicOptDex/oat/x86/hq.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5223