Xenomorph: A newly hatched Banking Trojan

guest · Nov 13, 2022

Malicious app in the Play Store spotted distributing Xenomorph Banking Trojan
By Pierluigi Paganini - November 12, 2022

Zscaler ThreatLabz researchers discovered a couple of malicious dropper apps on the Play Store distributing the Xenomorph banking malware.
Click to expand...

Researchers speculate that the two malware could have been developed by the same actor, or at least by someone familiar with the codebase of the Alien banking Trojan.

Zscaler discovered a malicious app in the Play Store named “Todo: Day manager” with over 1,000 downloads.
Click to expand...

“Our analysis found that the Xenomorph banking malware is dropped from GitHub as a fake Google Service application upon installation of the app. It starts with asking users to enable access permission.” reads the analysis published by ZScaler.
“Once provided, it adds itself as a device admin and prevents users from disabling Device Admin, making it uninstallable from the phone. Xenomorph creates an overlay onto legit banking applications to trick users into entering their credentials.”
The experts shared Indicators of Compromise (IoCs) for this threat, they also notified Google that promptly removed the app from the store and banned its developers.
Click to expand...

ThreatFabric: Xenomorph: A newly hatched Banking Trojan

February 15, 2022
In February 2022, ThreatFabric came across a new Android banking Trojan, which we dubbed Xenomorph. The name comes from its clear ties with another infamous banking Trojan, Alien, from which Xenomorph adopts class names and interesting strings.

Based on the intelligence gathered, users of 56 different European banks are among the targets of this new Android malware trojan, distributed on the official Google Play Store, with more than 50.000 installations.
Click to expand...

ZScaler: Rise of Banking Trojan Dropper in Google Play

November 10, 2022
Malicious Dropper Dropping Banking Trojans

The Zscaler ThreatLabz team has recently discovered the Xenomorph banking trojan embedded in a Lifestyle app in the Google Play store. The app is “Todo: Day manager,” and has over 1,000 downloads. This is the latest in a disturbing string of hidden malware in the Google Play store: in the last 3 months, ThreatLabz has reported over 50+ apps resulting in 500k+ downloads, embedding such malware families as Joker, Harly, Coper, and Adfraud.
Click to expand...

Our analysis found that the Xenomorph banking malware is dropped from GitHub as a fake Google Service application upon installation of the app. It starts with asking users to enable access permission. Once provided, it adds itself as a device admin and prevents users from disabling Device Admin, making it uninstallable from the phone. Xenomorph creates an overlay onto legit banking applications to trick users into entering their credentials.
Click to expand...

FanJ · Mar 10, 2023

Xenomorph v3: a new variant with ATS targeting more than 400 institutions

ThreatFabric - 10 March 2023
https://www.threatfabric.com/blogs/xenomorph-v3-new-variant-with-ats.html

Xenomorph Introduces ATS and hundreds of new Targets
Click to expand...

In the last year ThreatFabric saw a radical shift in the approach towards mobile malware from criminals. Criminals have started paying closer attention to the world of Mobile banking, abandoning more rudimental approaches in favor of a more refined and professional philosophy.

The most evident example of this new wave of malware creators is offered by the Hadoken Security Group. We have mentioned this actor previously in our blog about BugDrop: the products developed and distributed by this group have been circulating for the entirety of 2022, while the actors themselves surfaced by claiming the ownership of the malware in May.
Click to expand...

Long article with analysis.

Log in or Sign up

Xenomorph: A newly hatched Banking Trojan

guest Guest

FanJ Updates Team

Log in or Sign up

Xenomorph: A newly hatched Banking Trojan

guest Guest

FanJ Updates Team

Useful Searches