Overview

overview

8

Static

static

6

xeno.apk

android-11-x64

8

Resubmissions

04/11/2026, 16:43

261104-t8dvxax18k8

04/11/2026, 16:36

261104-t4qc5sx14r8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    android-11_x64
  • resource
    android-x64-arm64-20260325-en
  • resource tags

    arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
  • submitted
    04/11/2026, 16:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xeno.apk
  • Size 4.7MB
  • Sample261104-t8dvxax18k
  • SHA256 109b4877dc27110ac08c22780bea74912de13fd44a205f4befdf09d85c3ab181
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryimpact

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    defense_evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.xeno.loader
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4738
    • chmod 777 /data/user/0/com.xeno.loader/files/worker
      2⤵
        PID:4799
      • chmod 700 /data/user/0/com.xeno.loader/files/worker.tmp
        2⤵
          PID:4829

      Network

            MITRE ATT&CK Mobile v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            xposed-module.conf.new
            • Path /data/user/0/com.xeno.loader/files/system/xposed-module.conf.new
            • Size 8B
            • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
            • MD5 SHA1 SHA512
            Submit Download

            worker.enc
            • Path /data/user/0/com.xeno.loader/files/worker.enc
            • Size 1.3MB
            • SHA256 d8cb6d7838473f3eb5dad1aa3a6a0ae9ba45338d9396df252d07de52a7279cc9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            worker.tmp
            • Path /data/user/0/com.xeno.loader/files/worker.tmp
            • Size 1.3MB
            • SHA256 b692ea5f88436d93b1ec01b069198febda584f7f25a3ffbdd75a8abf89bbafef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            xeno_device.cfg
            • Path /data/user/0/com.xeno.loader/files/xeno_device.cfg
            • Size 242B
            • SHA256 e435e0c404dcc5c5e83f87aca5d28a1ee07f263bd2bb330991cec733d95993cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            key
            • Path /storage/emulated/0/.xeno/key
            • Size 19B
            • SHA256 0dcaf92b364026b5605f7ffd4724eca622f53654adb0346fa1dececd9cb76f34
            • MD5 SHA1 SHA512
            Submit Download

            config.json
            • Path /storage/emulated/0/xeno/config.json
            • Size 1KB
            • SHA256 041e8bf69da669876e4834c0bd2dfe232ac381a221b019bad2867ddc0bff9bfc
            • MD5 SHA1 SHA512 TLSH
            Submit Download