xenomorph | 9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899

Resubmissions

24-04-2023 08:36

230424-khs3gacd9s 10

Analysis

max time kernel
2993344s
max time network
166s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
24-04-2023 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899.apk
Size

2.2MB
MD5

8ce057ff57478e98c0e246355ccd27db
SHA1

1d3cc636883c72d45e8f336344bdea97ec8d91d1
SHA256

9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899
SHA512

5fd1345c3d605859bc56cf4cf7088712b63d929a3d576e99a88406eaa3387e4a996361c3bcc78275650609ad967636b7042fa42c244b183da96a0e7cfff78a1f
SSDEEP

49152:grrgUCuMhTKb+/CZFLqtBOU3t95tnUAqkp3IQRRiEKfaFEjI:uTOKb+qXmBOuPUAqkpIQDGsEjI

Score

10^/10

xenomorph banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

xenomorph

dedeperesere.xyz

vldeolan.com

cofi.hk

Extracted

Family

xenomorph

AES_key

Signatures

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph

Xenomorph v3 payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json	family_xenomorph_v3

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.great.calm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.great.calm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.great.calm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.great.calm

Acquires the wake lock. 1 IoCs

Processes:

com.great.calm

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.great.calm
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.great.calm

ioc pid process

/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json 4264 com.great.calm
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.great.calm

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.great.calm
Removes a system notification. 1 IoCs
evasion

Processes:

com.great.calm

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.great.calm
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.great.calm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.great.calm

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.great.calm

ioc	pid	process
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json	4264	com.great.calm

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.great.calm

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.great.calm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.great.calm

com.great.calm
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json

Filesize
934KB

MD5
637d3020a6e8d9aa114d51e7939fe6a0

SHA1
7e172dabca14040635c9118920942805ddfc964a

SHA256
cc3c058fd60da1fd0c3c8f0e58fecd355eef4ecc1d138fe8c6b9da8920cf9797

SHA512
e426c769af5af742f4b6f2f0f1dce4df0543d55fa8652759417c850943c750e90ea4033a7ce5ebd1063779238c4961a82840f3074b00f7d62e7bcf9978b91e2b

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json

Filesize
2.6MB

MD5
033e4993902fa453fc96b86248ea7ae7

SHA1
efb980435f0b7de14861fef21e4c09434b519c4d

SHA256
b28162d529728bf31f7dac4eadf40825a0ea1e5e6039e9b521d5906280c29196

SHA512
fe27307d7401dbc3881b3f7aec18b228ea48285d3f8fa8ffab51b29a51a8eba91d677ebf7bdd9b44ece60c9f87a36604272ff98ff8c25102cb162f49f61aaca3

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/oat/hDpdaxQ.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/.com.google.Chrome.y1YYly

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Cookies

Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Cookies-journal

Filesize
1KB

MD5
9648884189fdf3f8b81e3c6cc8944613

SHA1
ee56261eda84c763748cbb8570731d8aed161a79

SHA256
b350dc97dde272068f06ceed1b8e66cc79aa65a8b1d94fda76b8461d994ba3cc

SHA512
8cf084225848cd1f04578e2a3cd2db5eafe3b34410b4d6f655cf4ae2f8e113f3cd8d7a828e02038c5520d9cd04f44675380a64afc9d90a56df8df4407bb4a4bb

Download Submit
/data/user/0/com.great.calm/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.great.calm/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
127039d34cc37546efbea190220b899b

SHA1
33923e0c205bc74ecbce6365311b23e0628fbf1d

SHA256
149f13b3abd3bfc171cba5aef1762936b844fed56f18283bcd802e65b8df7746

SHA512
296432d692c084cc84c4eddd67bcef06dd257cde26eebc433e9d0e0436ff337744b3295445f0399f05aa28bc8e13e88c57de2f0b073eb251b66b98f035a59e88

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/000003.log

Filesize
61B

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/LOCK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/LOG

Filesize
126B

MD5
4e6a159b11a59484a3938df423351a5e

SHA1
04baa07c1cbf292c0150619939b28846cdb16d56

SHA256
58b2fe78803cbd980fbf1960bdc45d0d3f0d50fd8d521b9ca2c6d0a5104e4e16

SHA512
e50af3ea04261714dcef82e3fb3c1e9be707484d62355b584e58e84fc1ee5e223264532ef3e882c4aa4694cc73159b1680092c8e3790cdc9665b6bd9008a7d8c

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
5d60c1c27047090d944fc95153eef7c2

SHA1
83ea9cb0fe6dd44e9fdb1753e852fa99dadbfbbb

SHA256
0e18f47bd3f81a46c8fd47e81ad3ae6b546748e57364105674455df2ec532e33

SHA512
24c5e9c8cc5ac82cf2b74cbf4929a5b8222b57cd1081b31f6d14af99ff4b507cfaed9a83c9f940dbe4388d537609486243ad0e026ea03bfc7415242bfaa36668

Download Submit
/data/user/0/com.great.calm/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/webview_data.lock

Filesize
20B

MD5
e8f3c404cd0694ef970e8cf7d081401e

SHA1
1e410b4e52568cfa9a1d5019f62a33b356d80019

SHA256
1cd719be8a5be6e3bd8eabbfad27bc46a4988848fe2a76dc64c99b43aebc3eed

SHA512
9243c268f06598cacf8b5eaf4f1e058dd6b81bb14f2ca5a539a4c1bc735dbbb522fbbca41df3a8330f265f1c735b184b3f15b9c70bab01895c4fa4985e5a3b3d

Download Submit
/data/user/0/com.great.calm/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
1ec68628da935d9f6b882c00fe39383a

SHA1
ce47915b8948178efcbb3b47a4f8b8f5812581c3

SHA256
e10418b635bbc6cc7604df5d971b7550d464b072b392ce4f8127b3662b95fa9c

SHA512
a847931ae23fe4c293cd07d1a70f0d171c9ceec1aeab173121c312809fcf7551d0e923a55d5583d9f4643256a51b8979a049db2b1c62e75f4f1d494247f90aba

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/21a97041b40c53c6_0

Filesize
11KB

MD5
351798026daaf8c73afd965fe14f5c64

SHA1
ddb5dc8a3e40d6578717672bcf080e3f10e49f18

SHA256
42374115d1e2aeb3b1e30a958128768fe39c69ea38d16a291fe6bbc856f9b289

SHA512
1214f0742a275b8ee7f749b447b21477095f814a04d706d645a0a2d2cceebd3da2641409e4836dbbc254829aa553d315463b750da3b419f9d7f90ed046703a28

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/5dcc6771ad552215_0

Filesize
11KB

MD5
385d044121b3161b3614352c2d9ca009

SHA1
c3b42a13538c6017a5b283d010d5b5b5b75ef4c9

SHA256
41910d1d176a323b3ab6a26a6ef7881f5a127bcbbdcd43c7af46cc4205733070

SHA512
69db402d383391af4e2e51200b5e25133630d5930690b0a28f0cbc7a446b0843e9631d0ac274e64f0b40058237c5451eddbc7c2038feee729ca35c27170bf197

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/624f2bd216494a6f_0

Filesize
11KB

MD5
e0dd4146bc51a654678fcb2f03302d6e

SHA1
e172c600ec7c55dd9e4fcd7e7534bd9b44987bee

SHA256
6a94013b5864307ece6f38f1c949c1d7877cd343b420f8331881af7adb1a6d61

SHA512
538a61e1cb6605b5748f4c24ccc02b16f0a12f08adf8715d10b6059bdd45c079c27aad925e578430b7da61973d4c2e8577c3b8e6698049fba6dade75c21e70f8

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
40ca7e2caacb962df82c4616a2441f8b

SHA1
4542357bf62256d6e2fca0021292c4500a83632e

SHA256
cfa677ed9ed20da1070b414489a8045cf2a02ffba2f92134f7605815f2ecd502

SHA512
daf000460796285dea1cf3ff98003790dcdcac09c9476609eb098728765fcfacf6cb43d39e57c43fdd24ebee9a5d7585f1044ca8aa9c7bbe72635a7aa6f74047

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
42a62ea735168a855564720188ee9bc9

SHA1
0edb03919819c1ed89e611f03e331b8b0151a330

SHA256
b931f6523833805d1bdee683e84f8fddf0bca61c88d83ab5c8c1f1e9aa9eb465

SHA512
7f2ad195009252efb4a6c1af18e73e31a82c2835dd706940bc4183e6a2b4f8d9bac099a41f1298c17a7a7c2e7d48680ff2287be493c792393d3b966433527cb4

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/a0c2ffc2995089d9_0

Filesize
11KB

MD5
42b7ab08434077e15e8b0b6b18695672

SHA1
c66795133fd36d5668fc13a339019be0059398b1

SHA256
fa540962f94a5ba00dd292bddd7fdfa9a7e9750f455486b58fae4ee49afa3cf3

SHA512
b2004077bc97f3449f894a4b8a8fd435e15cd11c3e55723632440d9b90e4b17787a0a74d400b27d7d1c777cce7fd888b27c495e304533376ed1c3f325e7825d1

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/ba6620262a558c11_0

Filesize
11KB

MD5
a7bee36dd8e36377a691327edb635dbd

SHA1
87f526df467c9e58792e3848812c9da297b66f26

SHA256
36c4d3837268f7e8f6b78f3efba2fedf188dd9fad10e69e15c49548494f5324b

SHA512
e867e8f8049a355dcd7798538a3783fdf51f1ebea60d63e484913a65774414a983824f50fed95691acb38541c28d58f4fe9252e80a32c03b750935b7d549e137

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/c74c995875787a06_0

Filesize
379KB

MD5
0c2912293d00586d0011a41cb6299dda

SHA1
d93064b61fb014a1f76911cf77883e32a8218576

SHA256
eb3e8c5469a81ecafca73b9661508cbcafbc59a883547abaabd9d49c4e45d137

SHA512
2ef7815a0df29eba7a6bb08288f78bb2e9eba69d2352d6de3e637e95177eaa10236c6885ac70ebb09d1e4bed629b54ef1777313b4f58df393958610536fdd061

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
384B

MD5
a41810950ee6d3dd37933d681cc06a83

SHA1
b42d058aed0a5be1506da9e1db307610ca4f1abb

SHA256
cf20eb02f7e2747e414d60f0a3c36d53fcbc1d5456fe575d17600488b4b81121

SHA512
5dbed7f54c63c7f951f33b5722559c0ff18d70045ef5a4c49b620be62cb6fd93c61b8838b0c0f3814b78c2a85cd567fef04a60784f769b25fef4ed4463f82e50

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
384B

MD5
364c8d9ad8c53a70daacb4b6e57cadfc

SHA1
3a776c8c82a4e948337202ce6d3503a9a15892a4

SHA256
c3cc95dc9ac4c74e484240692daba1d6813929d1bdffbdb05099615108bb78d7

SHA512
7a07d78cf86f3707d68a121e5c32d38eb1925697e1aa477eb6e9e3ff168e5ec7f717ff393c8d554b599b23151d4ec1291aae02aef6583b550ea3743927882981

Download Submit
/data/user/0/com.great.calm/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.great.calm/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit