xenomorph | 2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850

Analysis

max time kernel
2377582s
max time network
169s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
15-03-2022 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850.apk
Size

2.4MB
MD5

e39505e65aec6835f680c902e1c8f7d8
SHA1

8b2984b8838067903ee3ff95d8a6823106216296
SHA256

2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850
SHA512

19911ed73419450a03ad541f7164a5db05a93e2c63d894ab79fdc50409d77696bdc203155640361d5f12de1929f234d5b2da84ebf4c59306876d725221310887

Score

10^/10

xenomorph banker infostealer ransomware trojan

Malware Config

Extracted

Family

xenomorph

simpleyo5.tk

simpleyo5.cf

kart12sec.ga

kart12sec.gq

Extracted

Family

xenomorph

AES_key

Signatures

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.spike.old

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.spike.old
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.spike.old
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.spike.old

Acquires the wake lock. 1 IoCs

Processes:

com.spike.old

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.spike.old
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.spike.old

ioc pid process

/data/user/0/com.spike.old/app_DynamicOptDex/hq.json 6671 com.spike.old
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.spike.old

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.spike.old

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.spike.old

ioc	pid	process
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json	6671	com.spike.old

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.spike.old

com.spike.old
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6671

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.spike.old/app_DynamicOptDex/hq.json

MD5
2690b5434d844fcaa4527744faff8700

SHA1
2ec4338390f8bf65c7340257a149da66cb792593

SHA256
7cbcebcccb83e5dccd98a5ffef0aa16201e30f684cfa743bd91d459e5a1286e2

SHA512
87cc00acf8271f454dc756dd6247a207d793a4bb3e593850efac906e976bfc023ba6a9b27d2ca3f9a3d6a22ed94e8ca20db7bd4cf24180f73f2f6e075c032b86

Download Submit
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json

MD5
fde08886038bffc5923fa098cd55d0cd

SHA1
d6f8dbbdd2ded86081cb81e690f5402552ee5345

SHA256
dae52bbee7f709fae9d91e06229c35b46d4559677f26152d4327fc1601d181be

SHA512
93b05624b145e56e081e0771b1ec635df4cf6109087abc67dabe7055ef745003109047370fd42bab83424b7ee396fc6116419f4c255bbd1a794ec558fa7a9091

Download Submit
/data/user/0/com.spike.old/app_DynamicOptDex/oat/hq.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.spike.old/app_webview/.com.google.Chrome.M3jOwI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.spike.old/app_webview/Default/GPUCache/index

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.spike.old/app_webview/Default/GPUCache/index-dir/temp-index

MD5
4ec880f0b68a6f2fbd626cfb45585c58

SHA1
ce7f13c9d82b562ad505ba56680b952e18b678d0

SHA256
e4a9560f44dab704aa5678797a183f527bbf34be11d80997f4c7f1e6b598b6f7

SHA512
077bc1b18e190b6f4d7a82134907852f8958507e67c53cb542a51a5d6103ecfe558e205046d27a3607733627ba49b41088af35de8d80731a5ed3a31eebc09b41

Download Submit
/data/user/0/com.spike.old/app_webview/Default/Session Storage/000001.dbtmp

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.spike.old/app_webview/Default/Session Storage/000003.log

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.spike.old/app_webview/Default/Session Storage/LOCK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.spike.old/app_webview/Default/Session Storage/LOG

MD5
db0194f1fabf5e07ceb7fc1da74e8282

SHA1
8131510e9111bb458dec8adb7b09b4008889ee6c

SHA256
ccb904ba999d4bdc28e3ed7d31b06d4ca7c95acdc7e86022b6ad6d5b7880b5ad

SHA512
2886ef4b2cb27e8e4abb3b1449adad0d6017ce1d1350846b171975110bcf2c410471d5492f1bead4e1494ea672fe9da542c73615f5df7573c7c1d67315aa6e98

Download Submit
/data/user/0/com.spike.old/app_webview/Default/Session Storage/MANIFEST-000001

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.spike.old/app_webview/Default/Web Data

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.spike.old/app_webview/Default/Web Data-journal

MD5
f4d20eaf8c2ee4616574721c6c6e9580

SHA1
b4ca26d3fa69fdc377d776ea3026303ae80b2b8e

SHA256
507dd5050775f95ba8116c6cd45f9b982e75bb398ace99d5f9f9b8e62539850f

SHA512
4a328b317b49ac7ca6c2e3eec9e081f24ba393f674efacced2672adfe2f59899c35f7b6fbc6ba08fa15f6f21034f25ec28607d05ce79daad6a34e1930b354de9

Download Submit
/data/user/0/com.spike.old/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.spike.old/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.spike.old/app_webview/webview_data.lock

MD5
500fefab8091dff07433cd71fab23908

SHA1
66f3b150adaaf6b3fcf14cf078cc854c37de05ed

SHA256
95185d8882ef90d0a7627d7d415c4a34e454686feca45a5ef87d93e0e636d1d8

SHA512
a5108c3fa4fd492c9fabaaaad5c4471bc81914cac389cb248ad36c9339c7ca18aafd5c72668a5aa87cabfd32a1e1ec679720d844e79ab17cf553b06a9f0abaa7

Download Submit
/data/user/0/com.spike.old/cache/WebView/Crashpad/settings.dat

MD5
a80b64b3783e9485fc8a0e15dae32ab8

SHA1
9c7fa410b9e0d8353052c153754367c085d6b2e1

SHA256
84a6383dede278037876caf7163b140fa248e2a92a2f781a0a79e7ed812178d9

SHA512
c9022859309395e3e5701650c02f35e642280d47ec29dea8ddc3c5e4c2914fb821c5fc58ca8ac84634f0c04ce0343fe8cf665002621db7832cc0fd675c378655

Download Submit
/data/user/0/com.spike.old/cache/WebView/Default/HTTP Cache/Code Cache/js/index

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.spike.old/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

MD5
e8945175981b1a3d04aa8249b745b363

SHA1
a0e54d241a67e8b411cb81aa5d098a3455fc5071

SHA256
8a4db891f7e986d24b3315af92ae78c66c273501a2f0730a638bb7f63895f03d

SHA512
de01d03e85651e43d216919d424ebb8c635807ef91ec7195ee2e01948d7a84fa8ed6cff47bb2f91ee6ae8ae4f48386086a9d9103c1d3265fc0098522eb39b9a8

Download Submit
/data/user/0/com.spike.old/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.spike.old/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

MD5
81e04523b7ff9c7110d81d0c70aaa555

SHA1
d5df689bfc2e9ca66e86aa7b9310c7f26567bd3c

SHA256
bc64197028b451a13170df8a18bdc0f2d357b4b7297c1b618c9f3571c7a1af39

SHA512
b02edf8167976968980451626a1a00a23eeaea3cd0780a70037627f3568c079789c029f13e670faa848f7b6598f0e26ab2154ce71e19c99b090daeb1b506a7d3

Download Submit
/data/user/0/com.spike.old/cache/WebView/font_unique_name_table.pb

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.spike.old/shared_prefs/WebViewChromiumPrefs.xml

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit