xenomorph | 6af8683c314fd060631e4789b7a793e73d209d87918f3112e8903a090940237d

Analysis

max time kernel
2377642s
max time network
171s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
15-03-2022 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6af8683c314fd060631e4789b7a793e73d209d87918f3112e8903a090940237d.apk
Size

1.9MB
MD5

1a5d505ba25689bfe85b14b47072141b
SHA1

cf86ffaec68c120b6b38e9bc90b0a910f1a4a207
SHA256

6af8683c314fd060631e4789b7a793e73d209d87918f3112e8903a090940237d
SHA512

76a932dca1d74ac1963cd9d7726258e13d0cf8c4e1ff567fafec22184d35d65e0c43a97609651f4e4b048c76b011474bf80667ab3c704c4478736c8b87271108

Score

10^/10

xenomorph banker infostealer ransomware trojan

Malware Config

Extracted

Family

xenomorph

simpleyo5.tk

simpleyo5.cf

kart12sec.ga

kart12sec.gq

Extracted

Family

xenomorph

Attributes

PackageNames
com.android.vending

com.google.android.gm
URLs
https://homeandofficedeal.com/local/multi/com.android.vending.html

https://homeandofficedeal.com/local/multi/com.google.android.gm.html

AES_key

Signatures

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.venture.raw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.venture.raw
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.venture.raw

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.venture.raw

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.venture.raw/app_DynamicOptDex/rZ.json	6345	com.venture.raw

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.venture.raw

com.venture.raw
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).
PID:6345

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads