Xenomorph Android Banking Malware Attacks 30+ US Banks

Xenomorph has been discovered with a new malware campaign targeting several United States and Spain institutions. This new campaign shows thousands of downloads of Xenomorph malware by victims.

Xenomorph is an Android malware that was discovered in February 2022 by Threat Fabric. According to previous malware campaigns, this Android malware was distributed using phishing webpages, tricking victims into installing malicious APKs. 

However, a new list of victims belonging to several institutions in the US, Portugal, and multiple crypto wallets have been identified, showing consistency in the banking malware family.

Xenomorph Android Malware

Xenomorph malware is capable of performing a simple SMS manipulation and can go up to full device control, which is due to the use of a very powerful Automated Transfer System (ATS) framework that Remote access capabilities had obtained. The malware has been constantly being added with new features by its developers for additional functionalities.

Xenomorph uses “overlay” as its primary method for obtaining Personally Identifiable Information (PII), including usernames, passwords, credit card numbers, and much more. The modules that are available in Xenomorph, including the new functionalities, are listed below

Further investigations on this new malware revealed that threat actors have inserted several modules that are supported by Samsung and Xiaomi devices, as these two contribute to 50% of the whole Android market share.

New Capabilities

A few additional commands have been added from the previous versions of Xenomorph. The new commands were start_mimic (Start Mimic Function), stop_mimic (Stop Mimic Function), show_push (Enable antisleep push notification), and click on point (simulate touch on specific coordinates). This mimic function enables the malware to act as any other application and remove a malware-specific behavior that was not available in the previous version. 

Furthermore, this malware was also found to be merged with RisePro stealer with Private Loader traces, which are some common Desktop-stealer malware. Additionally, the new version of Xenomorph also uses LummaC2, which was another well-known stealer. 

Moreover, the communication with the C2 has been updated, replacing HTTP with raw TCP sockets over port 50500 for receiving commands and data exfiltration.

A complete report has been published by Threat Fabric, which provided detailed information about the malware, distribution, code analysis, C2 communication, their old targets, new functionalities, and other information.

Indicators of Compromise

Xenomorph Samples

Xenomorph C2 servers

Protect yourself from vulnerabilities using Patch Manager Plus to quickly patch over 850 third-party applications. Take advantage of the free trial to ensure 100% security.