xenomorph | 9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899

Resubmissions

24-04-2023 08:36

230424-khs3gacd9s 10

Analysis

max time kernel
2993287s
max time network
107s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
24-04-2023 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899.apk
Size

2.2MB
MD5

8ce057ff57478e98c0e246355ccd27db
SHA1

1d3cc636883c72d45e8f336344bdea97ec8d91d1
SHA256

9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899
SHA512

5fd1345c3d605859bc56cf4cf7088712b63d929a3d576e99a88406eaa3387e4a996361c3bcc78275650609ad967636b7042fa42c244b183da96a0e7cfff78a1f
SSDEEP

49152:grrgUCuMhTKb+/CZFLqtBOU3t95tnUAqkp3IQRRiEKfaFEjI:uTOKb+qXmBOuPUAqkpIQDGsEjI

Score

10^/10

xenomorph banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

xenomorph

dedeperesere.xyz

vldeolan.com

cofi.hk

Extracted

Family

xenomorph

AES_key

Signatures

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph

Xenomorph v3 payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json	family_xenomorph_v3
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json	family_xenomorph_v3

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.great.calm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.great.calm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.great.calm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.great.calm

Acquires the wake lock. 1 IoCs

Processes:

com.great.calm

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.great.calm

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.great.calm

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.great.calm/app_DynamicOptDex/oat/x86/hDpdaxQ.odex --compiler-filter=quicken --class-loader-context=&com.great.calm

ioc	pid	process
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json	4177	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.great.calm/app_DynamicOptDex/oat/x86/hDpdaxQ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json	4078	com.great.calm

Removes a system notification. 1 IoCs
evasion

Processes:

com.great.calm

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.great.calm
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.great.calm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.great.calm

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.great.calm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.great.calm

com.great.calm
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4078
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.great.calm/app_DynamicOptDex/oat/x86/hDpdaxQ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4177

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json

Filesize
934KB

MD5
637d3020a6e8d9aa114d51e7939fe6a0

SHA1
7e172dabca14040635c9118920942805ddfc964a

SHA256
cc3c058fd60da1fd0c3c8f0e58fecd355eef4ecc1d138fe8c6b9da8920cf9797

SHA512
e426c769af5af742f4b6f2f0f1dce4df0543d55fa8652759417c850943c750e90ea4033a7ce5ebd1063779238c4961a82840f3074b00f7d62e7bcf9978b91e2b

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json

Filesize
2.6MB

MD5
749ad09821c704469e50582298d5724e

SHA1
3eda0f7c169b309bcffa6c2d5c7d7480dfb8b52e

SHA256
ea1dfc385ac0862c0c0e8ed8214f7dc18df52a9bbaa2bc20cc1e70b63628c3a9

SHA512
6931a13b5f3816b5b99a40f7bb0fe455293f53be12e5323ff70cec2712674947dcec103479cd60c3a3177008bf1c6e83dd0a9c289c1ce50ab059eaa32a56c244

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json

Filesize
2.6MB

MD5
033e4993902fa453fc96b86248ea7ae7

SHA1
efb980435f0b7de14861fef21e4c09434b519c4d

SHA256
b28162d529728bf31f7dac4eadf40825a0ea1e5e6039e9b521d5906280c29196

SHA512
fe27307d7401dbc3881b3f7aec18b228ea48285d3f8fa8ffab51b29a51a8eba91d677ebf7bdd9b44ece60c9f87a36604272ff98ff8c25102cb162f49f61aaca3

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/oat/hDpdaxQ.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/oat/x86/hDpdaxQ.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/oat/x86/hDpdaxQ.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.great.calm/app_webview/Cookies-journal

Filesize
1KB

MD5
37dfeecc0f928c203ef2f76d638416e9

SHA1
b056f133c02a6045a65aa5f86984644fd6f3dba1

SHA256
3b9375871e8430bf6cd4e9a85e3d6b06ae0d0c9596f2c0c56fbf4d63901a6a90

SHA512
41560dc64c5339009db5886e2b6cfc0991473c7989873ad9fd1e9598d06fa5bf4303baf2f6d3894ac62470a0d9bd836b7f0bb0ccdf6deed82208c1b1fc0ec5f4

Download Submit
/data/user/0/com.great.calm/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.great.calm/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
884125a7699298c00bfb6e642108d3e0

SHA1
c8c99aea086dead39643115814c092b8fab52acc

SHA256
30d0024438386857cd14c56c7d8bb6d21a31d12bca954e9fe4bb43934eb368b2

SHA512
871d1ca6de561a15a1cb4de685834483cc5ebcdc094203e51ef7e6c3ce8c2b31ea1260a100cc9ca2d092a8a4cf3ccbbf716b05efdd8f88666fa13511ecefff04

Download Submit
/data/user/0/com.great.calm/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
43cebc570e2a56391f3b8f8a5614b455

SHA1
d5686460ffd42c313d407713c1145475ea409178

SHA256
d0e8f6d279e98eb42516c47bb9087c8167f6bcc60b4a5a3e0b8228592897aca3

SHA512
fcf2f223964dedcc8f26c4da48794e6624ceadcf5ca1c0be3ba3cf0417aa3cc30e98a2c254780b5d88302575949c3fad14e2fcb13dbfd52d90e74b8e1966f945

Download Submit
/data/user/0/com.great.calm/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.great.calm/app_webview/Web Data-journal

Filesize
1KB

MD5
bc03726fd673f599cd9da963296745d0

SHA1
3997a305ac4f8a9f2ddafe8d4828bcdf51811c90

SHA256
c9af875e9c2a78af97aceedcf760d141cc4e4d9b649d106956f4033b1529201c

SHA512
05a61af6c153c6c9497ca37478a84e6f4b9b7ab5bbc60dba94fe13977c50bc8fd4784015033760a0effde30730ab053d8c1c253f5b1f0789e012980160418920

Download Submit
/data/user/0/com.great.calm/app_webview/metrics_guid

Filesize
36B

MD5
d2cce414bf8c55f6047702eec89ff853

SHA1
6a0180df88e47b60d516d825d71e78355f61dd52

SHA256
9286713ecb3ab2d3a35e920af01d3d89bb0205cd0b944f6aff99bbd2c1292086

SHA512
e5bfcac43906f05f17a5cb26c46cca09639baf7b4847b7b52e476d65e72bbdb870cf82164917f2be91735d458397a2a3fd98adf631edd432aa5ffb8bff4f56f9

Download Submit
/data/user/0/com.great.calm/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/cache/org.chromium.android_webview/21a97041b40c53c6_0

Filesize
6KB

MD5
84366d17b95cd6fbc7cb3145a68ff339

SHA1
9abe897d3227c5733ede5a042568efb89148d67b

SHA256
09b74be7de78f1cd9420f5a7713130e1665c297be408007cde987316e25a6173

SHA512
5dccdf6b45f9badc9e1216c584fc821be0cd4e460f153b596a7a3adc37051e2c525025833850f1c483ec92ebd73caf7f6b58ac74f9b2a563434b390e2d3bbf04

Download Submit
/data/user/0/com.great.calm/cache/org.chromium.android_webview/5dcc6771ad552215_0

Filesize
6KB

MD5
56d6337a80c516dad908071586f7e8cb

SHA1
55d4f342ddf3e80a4629f9d3f40c4b2d846b4d0e

SHA256
3b521a79fa14ece19192ede74953e31af8ca0172e40a3575b91255d98bc42ee7

SHA512
2b1f46174cedcc8f3b6745cb734c43df3f3aa6f30dc33c1469f8c8499bed8b8a1675677dbb82323ee89a8f3f2aa50b6883383fe90522adf5f107310f90954de8

Download Submit
/data/user/0/com.great.calm/cache/org.chromium.android_webview/624f2bd216494a6f_0

Filesize
6KB

MD5
4feb7306086a554072e54523439a33f8

SHA1
1e212bc4603ee90be6843b422b51fcfd8ecc2d9b

SHA256
575d1e6e58339b319e65703b4f9c7d7dba3e5fd16a83211a165b1e4f80a7e4bf

SHA512
941b3cc7b4d86f61f305b6f1fd4e8db76256efd2a0ab55248161455d8e0c596f2d635265d2225b484177d7edb3ddfdc1259c7d520d9bb96686f4e8177e862fd3

Download Submit
/data/user/0/com.great.calm/cache/org.chromium.android_webview/a0c2ffc2995089d9_0

Filesize
6KB

MD5
f7b683b08c8aac8ca02a6f42743ad42f

SHA1
8ad97a585e847d940f5f7c98aa1d5acd9a318866

SHA256
f66d49764d4d62558ec5f7b5e436a167ce380038fe816a420182d6dbe1a05f15

SHA512
06fd3841ddbcffa457a3da5b459ff0f3d359e6f37838fa8bcbd7a70eb436ed51bac51aa1ebd237f81e16b389db056fc55930cff9e7e11572a8a3cff52865643b

Download Submit
/data/user/0/com.great.calm/cache/org.chromium.android_webview/ba6620262a558c11_0

Filesize
6KB

MD5
057ed54e7566554edbf8c53253c3dac8

SHA1
89c9a44f55ed276ae976727904521c0779cd8d82

SHA256
a8cc51ba0f2c0d75a58ce4470b0fb4e42c045b9de16cc217124d4db7a30bdc84

SHA512
b4762180ff1633b35be026421c3ebe92dab438146608e794b1a33d7bd52c837a93b901147e7830caae42cd5ed63e792480af69cf7a707932a92b261663ed6305

Download Submit
/data/user/0/com.great.calm/cache/org.chromium.android_webview/c74c995875787a06_0

Filesize
189KB

MD5
563a25fff20e8554af9083280a3b1925

SHA1
a62a5a6809003285499fa18886b075ced887e2c2

SHA256
308216b92f2dbe118dfc3a1913fc75588e92fdbbf6583c34feac9c7c6063d225

SHA512
d4eab2e192c91171605ce2325d4d7a87c5b73742f96037d329fe1556d1478a066d172de6696b503b44b4791cd71ad8431bb78202ee50539ec7d07842595bf40b

Download Submit
/data/user/0/com.great.calm/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.great.calm/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
c7cd7b308dba5edfd474962fe356c2ab

SHA1
e49219a3b064128f9db836c68e3ef4457f5ea288

SHA256
3e37ed92f5ac84818ba698bec79b896a1843a8be184309a27b292cbfe729efc9

SHA512
22aa2d05ad2209f10eca0e9e975c3f612f4f0bcd4252b48c3e6d46119dc4d71d3f01a9dee628c9fc8bc03e1089fd91f42ae8d61408f9afd04592adbd45648fc4

Download Submit
/data/user/0/com.great.calm/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
192B

MD5
5f98de434bf2a17e41acf808e2bca02c

SHA1
802a586e339142216218f7d719227b2498815804

SHA256
0afb240f20cd03adc4728e50a11b0fd393a878f6a66dc6b9110bb2bd8aefeeaf

SHA512
3937e9328449fe2f289ce6877d711b41d151e145507a80382e3a81a3e6b0ea00e97420a818bfa7c80eaf1cfac60ffad8a1fe134a7e399dac4b13797c9b379a16

Download Submit
/data/user/0/com.great.calm/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit