xenomorph | 9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899

Analysis

max time kernel
4136216s
max time network
158s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
07-05-2023 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899.apk
Size

2.2MB
MD5

8ce057ff57478e98c0e246355ccd27db
SHA1

1d3cc636883c72d45e8f336344bdea97ec8d91d1
SHA256

9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899
SHA512

5fd1345c3d605859bc56cf4cf7088712b63d929a3d576e99a88406eaa3387e4a996361c3bcc78275650609ad967636b7042fa42c244b183da96a0e7cfff78a1f
SSDEEP

49152:grrgUCuMhTKb+/CZFLqtBOU3t95tnUAqkp3IQRRiEKfaFEjI:uTOKb+qXmBOuPUAqkpIQDGsEjI

Score

10^/10

xenomorph banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

xenomorph

dedeperesere.xyz

vldeolan.com

cofi.hk

Extracted

Family

xenomorph

AES_key

Signatures

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph

Xenomorph v3 payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json	family_xenomorph_v3

Makes use of the framework's Accessibility service. 3 IoCs

Processes:

com.great.calm

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.great.calm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.great.calm
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.great.calm

Acquires the wake lock. 1 IoCs

Processes:

com.great.calm

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.great.calm
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.great.calm

ioc pid process

/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json 4554 com.great.calm
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.great.calm

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.great.calm
Removes a system notification. 1 IoCs
evasion

Processes:

com.great.calm

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.great.calm
Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
ransomware

Processes:

com.great.calm

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.great.calm

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.great.calm

ioc	pid	process
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json	4554	com.great.calm

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.great.calm

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.great.calm

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.great.calm

com.great.calm
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4554

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json
Filesize
934KB

MD5
637d3020a6e8d9aa114d51e7939fe6a0

SHA1
7e172dabca14040635c9118920942805ddfc964a

SHA256
cc3c058fd60da1fd0c3c8f0e58fecd355eef4ecc1d138fe8c6b9da8920cf9797

SHA512
e426c769af5af742f4b6f2f0f1dce4df0543d55fa8652759417c850943c750e90ea4033a7ce5ebd1063779238c4961a82840f3074b00f7d62e7bcf9978b91e2b

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/hDpdaxQ.json
Filesize
2.6MB

MD5
033e4993902fa453fc96b86248ea7ae7

SHA1
efb980435f0b7de14861fef21e4c09434b519c4d

SHA256
b28162d529728bf31f7dac4eadf40825a0ea1e5e6039e9b521d5906280c29196

SHA512
fe27307d7401dbc3881b3f7aec18b228ea48285d3f8fa8ffab51b29a51a8eba91d677ebf7bdd9b44ece60c9f87a36604272ff98ff8c25102cb162f49f61aaca3

Download Submit
/data/user/0/com.great.calm/app_DynamicOptDex/oat/hDpdaxQ.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/.com.google.Chrome.b9nTPC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Cookies
Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Cookies-journal
Filesize
1KB

MD5
c448dc281ba8bac18f9b299dec1c1c7c

SHA1
888472b629e3dbbd5d02f33ac4d0c9ebabbe6ccf

SHA256
f95ecdbf262cc2f63fef8f4b230a4bc133345f76e3d76b2ff432ce104f7ae995

SHA512
0a146496833d680d5214da2d7936bd767bf04b38548e4ef652ba73af31fa7814c8fb6f35f6689b0e29cf8e99b625bbbcce9fd79dfab54d5bf4924c18cf8f7428

Download Submit
/data/user/0/com.great.calm/app_webview/Default/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.great.calm/app_webview/Default/GPUCache/index-dir/temp-index
Filesize
96B

MD5
bf27f96b6ffb7267f5d8b34984733832

SHA1
036a9aa6e46addd98d5bfac35fe36ff7f8bd1475

SHA256
8745567b05729bcfedf1f4ffdbd5b0e67e2b27d4f904b3e53b65af40fc5828ab

SHA512
4804731c86ac9e447f05f07fa43be373dfdb13df839fc723f448d96e471f1b61a6698c44f2df829fb2be8645a9fc69566b0c4a9a9a25935e83abbd81efd0233f

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/000001.dbtmp
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/000003.log
Filesize
61B

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/LOCK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/LOG
Filesize
126B

MD5
255d1c7b1f2b5c46de2b2b3efd7d160d

SHA1
0bb333dd9419546a9531a4426341a8ce1463e25d

SHA256
5ab94ddaa99de20ba90e3e41824c9f5d56c2f7b0dfc71605f66d335440cd2b6e

SHA512
df9ee9fe8d44c2d48fe54de2c404f00cd0d26e759ff163ea798bccde4854d539a88def50ec3507fa76c24c8de4fda932aa1fb34a2b06878b1fb865ee0bf0541b

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Session Storage/MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Web Data
Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.great.calm/app_webview/Default/Web Data-journal
Filesize
2KB

MD5
3b44b2228da40e3270b8a5d7eec2ddcd

SHA1
231343a3f91ea1ecfb9cec14ef25aa9d623043aa

SHA256
f4e2ca622ec0061861ea842cfcc7b919cbf52141dc48ae81be5d69d9570f99c4

SHA512
5277b64b06fca342f07950d5914689121769983ca88d4303d3565c67ff209beb10b10f595e7b5e9b94569570745fe4d70e864814a714b3299bde15a93a0ed429

Download Submit
/data/user/0/com.great.calm/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.great.calm/app_webview/webview_data.lock
Filesize
20B

MD5
3851ecf9ca883bbe5dab7426633fdf09

SHA1
5153f9d708c46a0060085be087ceae4ca8b0f6f1

SHA256
19d2345de08590997464a79ea121c33b1429badfe78d0f2c5d7c20fe29f53c22

SHA512
08f42513b5feb63045711eaa003e71ec1aafcf6ef5999c4a9f142d41d39b18e1fc5bc42e25a6fe382171d9342aff1360dccd9dd3622b5b82c0dd6703a3ab64ee

Download Submit
/data/user/0/com.great.calm/cache/WebView/Crashpad/settings.dat
Filesize
40B

MD5
b1157d3ca2e1bf9109b0ef072b612e7f

SHA1
8065ef05235b4e5ce45fa27712a4f68d80200383

SHA256
dc23be8a0d958b73121ee349984c7f3ec9b8702976a6d3a8dfd09ca514b9faac

SHA512
adc83ec0d9e56c297a942124563619fc1eb2e384e756de02b7aa431fdd95bd026f62f8a490087c89da92b89212a44f32bccdfd94869ed1eb586b47e01cdbb48f

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/21a97041b40c53c6_0
Filesize
11KB

MD5
b8e332d9aa0ed0d69ba40ea84b52035d

SHA1
dc39a7c74f17eb88d443a4ecb31b1a684751ae08

SHA256
094e9c8088f3295696bc62458524fb3693bb16b2abd3fd302a161a56aa5a9be3

SHA512
7491b3b360ba7ca51a6555bd0eb5b946a5b33ffcc28604544d98b1fc209dcb7bfbdf213e242772662017f85878c466b7335ddfabecd7ab3883c4783ac523488c

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/5dcc6771ad552215_0
Filesize
11KB

MD5
0fa6443c2c2e8f769d6a93b6cef01523

SHA1
a78c988a33cd4668f495e50a0bd0a8095cdc275e

SHA256
7fea91069ce10b2729b8c12bdcd2077edb528dd55a1ce3bc83b891511f17fd8e

SHA512
3f93211bd212cf976f870643628df07a1641103feab7698c13ead722200dcf7b48b93f620150b0e19824baa83d10a28a7380af4ba59d74216f5eacaece21d12d

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/624f2bd216494a6f_0
Filesize
11KB

MD5
6ec1cdff38f73f42a3347ace02a9ad60

SHA1
604e24f8440609a1de0ac37a13c6592dcb791453

SHA256
a62fbc2b5cdf0516b923f4b1fb7e5187a37cbd81cccd0a43f74c73e0902194d7

SHA512
2cd7f85807e3e272016cce2d008e2842ac24c29874043663d840b94b2447fb002dd8a98378cba600813d1272f79b2c1b9f8953f17a511b0c9ed05f5b87696945

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
8c2b6883581ded4a6999c0ddbd950a24

SHA1
49813ec62075b9b900f019b80d76d92a14c7d76e

SHA256
5cec8664f8b7e52f84da681ce8384bb5c246a09ee6b40cc406139f67193b2308

SHA512
36102506459a67b4739af1a0b5bb7bf3bd98fc9657bdbab85ecb0acd29ee3b962f2b11876f741991070680858f1a6b245d201e9f719a91de12288671836db3e2

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
Filesize
96B

MD5
4ad84693cae761e5602d6b67f20a97ca

SHA1
f9986eae3f5b9429cf3c3d5a76d87db45f6d4e2c

SHA256
59d1eb75d3de84a1c14f47d4f9ad138a58bf83cd39a5f4483f20e582823d95ae

SHA512
43b097637050a90a3277c561ec3d53fa315defea45e6cd24d8e84f01dc98e6d0e870b725caf0de561769b0455a7f166fffc9c95519c837469c341ae9bf99d9ea

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/a0c2ffc2995089d9_0
Filesize
11KB

MD5
f842038164e2436b4f1d278324f87bc4

SHA1
d9b4d758777ad8247e495ab4f41f4bef87c415b4

SHA256
45faa37e3e7a8ea73a5e110b11849570b391492ba1848c7af445de0057fed434

SHA512
27fa9617eb59d450236c2b1fd7d901a472edbfc5bc4deb06438743cf31475ec4b721250409dabed66c37089c5fea3402191f9273b8094b6b08a93306af39353f

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/ba6620262a558c11_0
Filesize
11KB

MD5
d2bb72e6d995959de59a6165c14c5982

SHA1
fd328d86d0f0aecf1d62f5e3d419a3507ef3137b

SHA256
8f04a9e020afe0912c664cfacd508eb4a9c8022ea2e30ad26306665196d9fe72

SHA512
f1012132ca7c9343a81e450da1a2adf60562a1d2441541200fa2cf69b836f020d427b0216f769a60ffba25ae7d3b2eb44be761f5edecf82c078d07bb9bad062d

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/c74c995875787a06_0
Filesize
379KB

MD5
c3371b33b1341eb5dd54e2a54c1d9f5c

SHA1
316123d9fb566b272622f57f94a2cedbe662dfeb

SHA256
90935a4b7ceb0c87d25baf65975df511619a1c8559b1b964c7bb8381ba7c1204

SHA512
017d6833ed4c44b4c350495387d472aa28ff28e065d67e4a519b05a8dc5c792c08b4492911c69e1479c6d774b58840bd9b04dcfac27c7183e444487247a1fead

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/index-dir/temp-index
Filesize
384B

MD5
82fd39bfd677a3ad23835dbc476f6b26

SHA1
fd3e84096c3a2b0199adef734322aa1c655a2302

SHA256
4ed285e3e692038a6673773e8c031af8a4c1a1461faee910562f42ce560acc03

SHA512
79653092eb692ba1664a60662212aed53ea2e2dd58ba5ca3e27a1d6236c22bb779e213fe5dbf60b60e3b397ced525edf8e117a248613fea5eb7ffce1a7aecbd8

Download Submit
/data/user/0/com.great.calm/cache/WebView/Default/HTTP Cache/index-dir/temp-index
Filesize
384B

MD5
e51c87065ba7f6395273df2bba20c5eb

SHA1
16b8b03329eb1cfd9f918c66da7f1da73a3ee2de

SHA256
b47c4683666e4a03882030a26348b695bde17f7b58aaa5bc6a5951aea6845934

SHA512
2ebbddc754118871eec403da02042032383d5b0a6280177fc388cceb90f1463f038660d57c5c9f358de9ce6c5fb2b03f5f05a1ee5d6d4e8e9dcf2d8d9cce765f

Download Submit
/data/user/0/com.great.calm/cache/WebView/font_unique_name_table.pb
Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.great.calm/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit