xenomorph | dcb88fb46c8d030c6f92dff0cd5e4c2f5bdf223070f2596c86a454f1adf00729 | Triage

Analysis

max time kernel
2377712s
max time network
166s
platform
android_x64
resource
android-x64-20220310-en
submitted
15-03-2022 13:11

Sharing

Report Analysis Logs

General

Target

dcb88fb46c8d030c6f92dff0cd5e4c2f5bdf223070f2596c86a454f1adf00729.apk
Size

2.0MB
MD5

4043d73d75d220738d77843ff9be0247
SHA1

4dcad01a821c3fd994b4b968b9a67c6f75181fcc
SHA256

dcb88fb46c8d030c6f92dff0cd5e4c2f5bdf223070f2596c86a454f1adf00729
SHA512

d8ed2f6ff17ef048bfb78ce2c9a465a29dcd3f9f4b3e88e36c1c5cb31c588ce08fc27306002b0f5a785d15d486e5838823e8d7a0b3d2f9ad97b6f1f2a485234d

Score

10^/10

xenomorph banker infostealer ransomware trojan

Malware Config

Extracted

Family

xenomorph

C2

simpleyo5.tk

simpleyo5.cf

kart12sec.ga

kart12sec.gq

Extracted

Family

xenomorph

AES_key

AES_key

AES_key

Signatures

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.token.jewel/app_DynamicOptDex/LmGiYP.json	6152	com.token.jewel

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.token.jewel

com.token.jewel
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads