Analysis
- max time kernel
151s - max time network
141s - platform
android_x64 - resource
android-x64-arm64-20231215-en - resource tags
- submitted
29/01/2024, 13:54
General
- Target com.great.calm.apk
- Size 2.2MB
- Sample240129-q7kehsbcc2
- SHA256 9ce2ad40f3998860ca1ab21d97ea7346bf9d26ff867fc69c4d005c477c67a899
Score
10/10
Malware Config
Extracted
Family
-
xenomorph
C2
-
dedeperesere.xyz
-
vldeolan.com
-
cofi.hk
Extracted
Family
-
xenomorph
AES_key
AES_key
Signatures
- Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
- Xenomorph v3 payload 1 IoCs
- Makes use of the framework's Accessibility service 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Removes its main activity from the application launcher 2 IoCs
- Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
- Acquires the wake lock 1 IoCs
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.great.calm1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
hDpdaxQ.json
hDpdaxQ.json
hDpdaxQ.json.cur.prof
hDpdaxQ.json