xenomorph | 6af8683c314fd060631e4789b7a793e73d209d87918f3112e8903a090940237d

Analysis

max time kernel
2377645s
max time network
150s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
15-03-2022 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6af8683c314fd060631e4789b7a793e73d209d87918f3112e8903a090940237d.apk
Size

1.9MB
MD5

1a5d505ba25689bfe85b14b47072141b
SHA1

cf86ffaec68c120b6b38e9bc90b0a910f1a4a207
SHA256

6af8683c314fd060631e4789b7a793e73d209d87918f3112e8903a090940237d
SHA512

76a932dca1d74ac1963cd9d7726258e13d0cf8c4e1ff567fafec22184d35d65e0c43a97609651f4e4b048c76b011474bf80667ab3c704c4478736c8b87271108

Score

10^/10

xenomorph banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

xenomorph

simpleyo5.tk

simpleyo5.cf

kart12sec.ga

kart12sec.gq

Extracted

Family

xenomorph

AES_key

Signatures

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.venture.raw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.venture.raw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.venture.raw

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.venture.raw

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.venture.raw/app_DynamicOptDex/rZ.json	5169	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.venture.raw/app_DynamicOptDex/rZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.venture.raw/app_DynamicOptDex/oat/x86/rZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.venture.raw/app_DynamicOptDex/rZ.json	5098	com.venture.raw

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.venture.raw

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.venture.raw

com.venture.raw
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:5098
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.venture.raw/app_DynamicOptDex/rZ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.venture.raw/app_DynamicOptDex/oat/x86/rZ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5169

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads