Resubmissions
20/03/2022, 22:30
220320-2e69csgffl1014/03/2022, 16:11
220314-tnc3wahee910/03/2022, 18:07
220310-wqcw1achbm1010/03/2022, 17:34
220310-v5qkzahdf7710/03/2022, 17:12
220310-vq77gahca6710/03/2022, 16:14
220310-tp5jhsbham710/03/2022, 16:02
220310-tgwawabggk10Analysis
- max time kernel
2843151s - max time network
173s - platform
android_x64 - resource
android-x64-arm64-20220310-en - submitted
20/03/2022, 22:30
General
- Target 2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850.apk
- Size 2.4MB
- Sample220320-2e69csgffl
- SHA256 2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850
Score
10/10
Malware Config
Extracted
Family
-
xenomorph
C2
-
simpleyo5.tk
-
simpleyo5.cf
-
kart12sec.ga
-
kart12sec.gq
Extracted
Family
-
xenomorph
Attributes
-
PackageNames
com.android.vending
com.google.android.gm
-
URLs
https://homeandofficedeal.com/local/multi/com.android.vending.html
https://homeandofficedeal.com/local/multi/com.google.android.gm.html
AES_key
AES_key
AES_key
Signatures
- Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
- Makes use of the framework's Accessibility service. 1 IoCs
- Acquires the wake lock. 1 IoCs
- Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
- Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
Processes
-
com.spike.old1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data).