Overview

overview

10

Static

static

6

1b2c32c709...c3.apk

android-9-x86

10

1b2c32c709...c3.apk

android-10-x64

10

1b2c32c709...c3.apk

android-11-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    25/02/2025, 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1b2c32c70906a78e4c3e662bf4c00715e93a1a24403903ddaacb4b0d78a879c3.apk

  • Size

    2.5MB

  • MD5

    978d079cfe323a1f5708bf2972df2f67

  • SHA1

    f3cd47d0ed926765f0c663eb7d0132487b2aad68

  • SHA256

    1b2c32c70906a78e4c3e662bf4c00715e93a1a24403903ddaacb4b0d78a879c3

  • SHA512

    6404934649d2abeb149dea8b50511fe9caa26388458345a003ad9939d0608515f061e1080f04348dfec74711961dbaa7d4028b77e90503f8e6856cfcbbf34a34

  • SSDEEP

    49152:HfqX6+aitzx4TaNBQSir+agLW/ojO+3RY7nbFY1CUh1rylbQlDaf5rMUORHEjvAL:Hfqq+ayzbBQ/gK/MY7bFvUh1K6OfeBHJ

Score
10/10
xenomorphbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencetrojan

Malware Config

Extracted

Family

xenomorph

C2

simpleyo5.tk

simpleyo5.cf

kart12sec.ga

kart12sec.gq

Extracted

Family

xenomorph

AES_key
AES_key

Signatures

  • Xenomorph

    Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.

    bankertrojaninfostealerxenomorph
  • Xenomorph family
    xenomorph
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
    collection
  • Reads the content of outgoing SMS messages. 1 TTPs 2 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.spike.old
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Reads the content of SMS inbox messages.
    • Reads the content of outgoing SMS messages.
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4224
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.spike.old/app_DynamicOptDex/hq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.spike.old/app_DynamicOptDex/oat/x86/hq.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4249

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

2
T1636

SMS Messages

2
T1636.004

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1
T1471

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.spike.old/app_DynamicOptDex/hq.json
    Filesize

    893KB

    MD5

    2690b5434d844fcaa4527744faff8700

    SHA1

    2ec4338390f8bf65c7340257a149da66cb792593

    SHA256

    7cbcebcccb83e5dccd98a5ffef0aa16201e30f684cfa743bd91d459e5a1286e2

    SHA512

    87cc00acf8271f454dc756dd6247a207d793a4bb3e593850efac906e976bfc023ba6a9b27d2ca3f9a3d6a22ed94e8ca20db7bd4cf24180f73f2f6e075c032b86

    Download Submit

  • /data/data/com.spike.old/app_DynamicOptDex/hq.json
    Filesize

    893KB

    MD5

    889aae346b72fa3bf1293888074da26a

    SHA1

    0626aa9b6ef6a3e695c92221a21ee323ebcc97a1

    SHA256

    40c6b36a316b596fca2b84cd4d65d745bd15d1c90c1428050b3e71917c1ee360

    SHA512

    5c06b9dc60abe38688b8b600557b1ebacbe51955f85776d18a010451774b529212f67f20ee5b05137fec76cb5975c33768e9ccc2c936aebe94b45f95cb11f3e4

    Download Submit

  • /data/data/com.spike.old/app_DynamicOptDex/oat/hq.json.cur.prof
    Filesize

    2KB

    MD5

    67d98c486db470026683c10b0d0df6e6

    SHA1

    41b16025998a81a8880885147f772451b5b3b40d

    SHA256

    78e3b95685d3fc942ba971b88a12874f8f39a37ddb2fb9c1aa86b291d9c083a0

    SHA512

    bf63733368d4b1870d15034ed9b0ea38df50059a631b69844544c4fad0fc6074d357ef2de11cdeba9744d3dcfa4c317dd56e3a90d03ae77cb1921e1c07457f5c

    Download Submit

  • /data/user/0/com.spike.old/app_DynamicOptDex/hq.json
    Filesize

    2.4MB

    MD5

    04923b194242d88ff05d0d8bf0d20a29

    SHA1

    d3c88712a375fdda28672ce4da29a8853e3dc53f

    SHA256

    119c6888ab383bbb591f0317dae6d9456954e051d28e7605e49d7c67091ba53f

    SHA512

    48647eef16a163831a8389dbc508088917df1fb8f40e439cfc906b951811e883c83d1adedb9bd1011bb850cf47cb23150fcd3009fb2218bad2b7d2314aad4ca5

    Download Submit

  • /data/user/0/com.spike.old/app_DynamicOptDex/hq.json
    Filesize

    2.4MB

    MD5

    fde08886038bffc5923fa098cd55d0cd

    SHA1

    d6f8dbbdd2ded86081cb81e690f5402552ee5345

    SHA256

    dae52bbee7f709fae9d91e06229c35b46d4559677f26152d4327fc1601d181be

    SHA512

    93b05624b145e56e081e0771b1ec635df4cf6109087abc67dabe7055ef745003109047370fd42bab83424b7ee396fc6116419f4c255bbd1a794ec558fa7a9091

    Download Submit