xenomorph | 2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850

Analysis

max time kernel
916088s
max time network
162s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
02-11-2022 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e39505e65aec6835f680c902e1c8f7d8.apk
Size

2.4MB
MD5

e39505e65aec6835f680c902e1c8f7d8
SHA1

8b2984b8838067903ee3ff95d8a6823106216296
SHA256

2877b27f1b6c7db466351618dda4f05d6a15e9a26028f3fc064fa144ec3a1850
SHA512

19911ed73419450a03ad541f7164a5db05a93e2c63d894ab79fdc50409d77696bdc203155640361d5f12de1929f234d5b2da84ebf4c59306876d725221310887
SSDEEP

49152:+HpPPxxWmN+ib5RSmaCX3YVcVHl6lrylbQlDaf5rMrEji:+JXxxpUmaAFHl6lK6OferEji

Score

10^/10

xenomorph banker infostealer ransomware trojan

Malware Config

Extracted

Family

xenomorph

simpleyo5.tk

simpleyo5.cf

kart12sec.ga

kart12sec.gq

Extracted

Family

xenomorph

AES_key

Signatures

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.spike.old
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.spike.old

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.spike.old

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json	4575	com.spike.old

Reads the content of SMS inbox messages. 1 IoCs

infostealer

description	ioc	Process
URI accessed for read	content://sms/inbox	com.spike.old

Reads the content of outgoing SMS messages. 2 IoCs

infostealer

description	ioc	Process
URI accessed for read	content://sms/draft	com.spike.old
URI accessed for read	content://sms/sent	com.spike.old

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.spike.old

com.spike.old
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of outgoing SMS messages.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4575

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.spike.old/app_DynamicOptDex/hq.json

Filesize
893KB

MD5
2690b5434d844fcaa4527744faff8700

SHA1
2ec4338390f8bf65c7340257a149da66cb792593

SHA256
7cbcebcccb83e5dccd98a5ffef0aa16201e30f684cfa743bd91d459e5a1286e2

SHA512
87cc00acf8271f454dc756dd6247a207d793a4bb3e593850efac906e976bfc023ba6a9b27d2ca3f9a3d6a22ed94e8ca20db7bd4cf24180f73f2f6e075c032b86

Download Submit
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json

Filesize
2.4MB

MD5
fde08886038bffc5923fa098cd55d0cd

SHA1
d6f8dbbdd2ded86081cb81e690f5402552ee5345

SHA256
dae52bbee7f709fae9d91e06229c35b46d4559677f26152d4327fc1601d181be

SHA512
93b05624b145e56e081e0771b1ec635df4cf6109087abc67dabe7055ef745003109047370fd42bab83424b7ee396fc6116419f4c255bbd1a794ec558fa7a9091

Download Submit
/data/user/0/com.spike.old/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.spike.old/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
2a089e73cfc3d903d051271fe9eb9a6c

SHA1
914f17ee480156b0849f6c914fb832c8277d6af4

SHA256
5bfdfe1acf42d6e2f22c4509b4d02a5a842f97bb7ea1dbcfb650edaee723d3cf

SHA512
a6784aeb202e2e044e67d02fd87deed826d42dea2bfa02a6d403ea4e3ab401eecd397a406b7a56e0c63326ec7b65a8bacf76fffbd41f2ea46fa6f4169a3564c0

Download Submit
/data/user/0/com.spike.old/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.spike.old/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
aeb61f86ef12b00d9d8ce704ae3237f7

SHA1
c6171c04077c238f8f0a24f876762525d82645bc

SHA256
e80b1dab71e86e9c140223880aaf1d5828f4f77def24f6d562704b74a99103c3

SHA512
7e5daf74711e74ea70af5c0a57050b1f90068680cd1590e438a61c593c687a509358fbdd3c8e5e65167e27e1ee9a0b9bbf8902b84b97c1330b37cd2b172004ca

Download Submit
/data/user/0/com.spike.old/app_webview/webview_data.lock

Filesize
19B

MD5
93ff5039d531e0f6bc23a6421990d822

SHA1
4077e340ce28e4d8906ec8f2dbc4d4042ee4df7b

SHA256
baf11f38f2ffea2963b8066e6f56a1d44ac73b12af7ce0aa0cf4f80696486468

SHA512
2d47e3e16efaf7f19491ebbceb8ed5b9a963049d6f9387dd6d5c265398b210453abae1c51c825bdabf90fac3281d14bfc0962e232fa26a867d4d357f28ce11e6

Download Submit
/data/user/0/com.spike.old/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
964e951c80353f4139ed13efc8240a4c

SHA1
14fa0d0b535d718a1d905d88b8da58c44828a2f4

SHA256
c0bb7acf9486521f536296720b355fa91f779c3bc36c84758be811007b338c37

SHA512
4b02947770c7dcd2137cbe25514c8e0e9d09921c7d5d287db1f32a68824cb54dde9a668ec57d1af70bbd52b1a4518e6af9709d6d5e17f69099907e8005f3087e

Download Submit
/data/user/0/com.spike.old/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.spike.old/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
3b08854a5614079f24d4e2fb86c4b3ce

SHA1
a6bd12f684a0bbbb711a58a5cba0f610407e4dde

SHA256
dbe7583b7d4708b6c4ab7b261f904d3bb47fedf063c4755bb617c5121377da22

SHA512
9e9d28e6a4a5e3fc0523cf34490988cbcae4cc15da94c4841b09eb26f78754dbc88c50b01cea9c4e431ff0d40f3d39fd3ef5763be571c6c7d1c5eb53727941ab

Download Submit
/data/user/0/com.spike.old/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.spike.old/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
3b08854a5614079f24d4e2fb86c4b3ce

SHA1
a6bd12f684a0bbbb711a58a5cba0f610407e4dde

SHA256
dbe7583b7d4708b6c4ab7b261f904d3bb47fedf063c4755bb617c5121377da22

SHA512
9e9d28e6a4a5e3fc0523cf34490988cbcae4cc15da94c4841b09eb26f78754dbc88c50b01cea9c4e431ff0d40f3d39fd3ef5763be571c6c7d1c5eb53727941ab

Download Submit
/data/user/0/com.spike.old/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.spike.old/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads