xenomorph | 0fe3c7f51cab609170268a50284603515369769c0023cc9d493859406d56f9e5

General

Target

0fe3c7f51cab609170268a50284603515369769c0023cc9d493859406d56f9e5.apk
Size

2.4MB
MD5

1c313891a89889a9afe9743fc5c80b10
SHA1

e544b7c518ceb796f7a4570fb17b118f4fccb5f7
SHA256

0fe3c7f51cab609170268a50284603515369769c0023cc9d493859406d56f9e5
SHA512

769633f442182a714d1d290251843a06b0841b2c37e7a705b0a673fcf4ce949b4f45faf993cead676f70e882f6ddfdf5e1b857b66254b71225c431876b40a228
SSDEEP

49152:c05cft+H8jZQO8UuQRZpdlq26HtHkrylbQlDaf5rMRCIVEjU:OAcjZ84q/tHkK6Ofe5VEjU

Score

10^/10

xenomorph banker collection discovery evasion impact infostealer persistence trojan

Malware Config

Extracted

Family

xenomorph

C2

simpleyo5.tk

simpleyo5.cf

kart12sec.ga

kart12sec.gq

Extracted

Family

xenomorph

AES_key

Signatures

Xenomorph
Xenomorph is an Android banking trojan that is seemingly tied with AlienBot.
banker trojan infostealer xenomorph
Xenomorph family
xenomorph

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json	4236	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.spike.old/app_DynamicOptDex/hq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.spike.old/app_DynamicOptDex/oat/x86/hq.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json	4210	com.spike.old

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.spike.old

Reads the content of outgoing SMS messages. 1 TTPs 2 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/sent	com.spike.old
URI accessed for read	content://sms/draft	com.spike.old

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.spike.old

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.spike.old

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.spike.old

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.spike.old

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.spike.old

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.spike.old

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.spike.old

com.spike.old
1⤵
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of outgoing SMS messages.
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4210
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.spike.old/app_DynamicOptDex/hq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.spike.old/app_DynamicOptDex/oat/x86/hq.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4236

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Protected User Data

2

T1636

SMS Messages

2

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.spike.old/app_DynamicOptDex/hq.json

Filesize
893KB

MD5
2690b5434d844fcaa4527744faff8700

SHA1
2ec4338390f8bf65c7340257a149da66cb792593

SHA256
7cbcebcccb83e5dccd98a5ffef0aa16201e30f684cfa743bd91d459e5a1286e2

SHA512
87cc00acf8271f454dc756dd6247a207d793a4bb3e593850efac906e976bfc023ba6a9b27d2ca3f9a3d6a22ed94e8ca20db7bd4cf24180f73f2f6e075c032b86

Download Submit
/data/data/com.spike.old/app_DynamicOptDex/hq.json

Filesize
893KB

MD5
889aae346b72fa3bf1293888074da26a

SHA1
0626aa9b6ef6a3e695c92221a21ee323ebcc97a1

SHA256
40c6b36a316b596fca2b84cd4d65d745bd15d1c90c1428050b3e71917c1ee360

SHA512
5c06b9dc60abe38688b8b600557b1ebacbe51955f85776d18a010451774b529212f67f20ee5b05137fec76cb5975c33768e9ccc2c936aebe94b45f95cb11f3e4

Download Submit
/data/data/com.spike.old/app_DynamicOptDex/oat/hq.json.cur.prof

Filesize
2KB

MD5
145ae4d7fcdab6dc2ad6519d484ce85c

SHA1
c83bb215cf4f7429116f7a761267acd4e65722da

SHA256
fc348ed3a1f0bb1301c3e83886cc79893c20eefe3fbe39c2320e656e870a3d23

SHA512
d8329ba6700205190aab7ef41d12f6c25821338725f3a3081c8b8c77cca348d888c44e9e28a247953c659348a376fc3080e78de0afa44ebd8bd8a54a64ff1e39

Download Submit
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json

Filesize
2.4MB

MD5
04923b194242d88ff05d0d8bf0d20a29

SHA1
d3c88712a375fdda28672ce4da29a8853e3dc53f

SHA256
119c6888ab383bbb591f0317dae6d9456954e051d28e7605e49d7c67091ba53f

SHA512
48647eef16a163831a8389dbc508088917df1fb8f40e439cfc906b951811e883c83d1adedb9bd1011bb850cf47cb23150fcd3009fb2218bad2b7d2314aad4ca5

Download Submit
/data/user/0/com.spike.old/app_DynamicOptDex/hq.json

Filesize
2.4MB

MD5
fde08886038bffc5923fa098cd55d0cd

SHA1
d6f8dbbdd2ded86081cb81e690f5402552ee5345

SHA256
dae52bbee7f709fae9d91e06229c35b46d4559677f26152d4327fc1601d181be

SHA512
93b05624b145e56e081e0771b1ec635df4cf6109087abc67dabe7055ef745003109047370fd42bab83424b7ee396fc6116419f4c255bbd1a794ec558fa7a9091

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads