Xenomorph Malware Burrows into Google Play Users, No Facehugger Required

An Android trojan dubbed Xenomorph has nested in Google Participate in, already racking up much more than 50,000 downloads from the formal application store, researchers warned. For anybody who downloaded the “Fast Cleaner” application, it is time to nuke it from orbit.

According to a ThreatFabric analysis, Xenomorph has a concentrate on record of 56 unique European banking companies, for which it supplies convincing facsimiles of log-in pages any time a target tries to log into a mobile banking application. The goal of class is to steal any qualifications that victims enter into the fake log-in overlay.

However, the malware is also a adaptable, modular banking trojan, which has code overlaps and other ties to the Alien malware – that’s why the identify. It notably is made up of the capability to abuse Android’s accessibility solutions for wide management about a device’s abilities, which could open the doorway to perilous options that go further than hijacking mobile banking qualifications.

“The Accessibility engine powering this malware, together with the infrastructure and command-and-command (C2) protocol, are carefully created to be scalable and updatable,” the researchers warned in a Monday publishing. “The information stored by the logging capability of this malware is incredibly substantial, and if despatched again to the C2 server, could be utilized to implement keylogging, as properly as gathering behavioral facts on victims and on mounted apps, even if they are not component of the checklist of targets.”

That superior features is not however carried out, so the researchers have considered Xenomorph as even now below development. Nonetheless, they noted that it’s by now creating a mark on the banking trojan front: “Xenomorph is already sporting productive overlays [for banking apps] and remaining actively distributed on formal application stores.”

It also makes use of SMS and notification-interception to log and use potential two-factor authentication (2FA) tokens, according to ThreatFabric. And, they extra, “It would be unsurprising to see this bot sport semi-automatic transfer procedure (ATS) abilities in the extremely around long run.”

ATS is the approach of instantly initiating wire transfers from the victims with out needing to use credentials, consequently bypassing 2FA and all anti-fraud measures.

ThreatFabric noticed the malware becoming loaded by a dropper hiding in a Google Engage in software known as “Fast Cleaner” (given that described to Google). Sporting 50,000 installations, it purported to get rid of unused muddle and battery optimization blocks for much better unit processing situations.

“This is not an unheard of entice, and we have seen malware people like Vultur and Alien being deployed by these kinds of application[s],” the researchers claimed.

Inside the Shell: Xenomorph’s Core Operation

In conditions of its key overlay attack vector, Xenomorph is run by Accessibility Providers privileges, the scientists identified.

“Once the malware is up and working on a device, its track record products and services get Accessibilty situations every time a little something new occurs on the device,” they explained in a Monday publishing. “If the software opened is portion of the listing of targets, then Xenomorph will induce an overlay injection and display a WebView Action posing as the specific bundle.”

More exclusively, after set up, the malware enumerates and sends back a list of set up deals on the contaminated product. Primarily based on what qualified programs are present, it goes on to obtain the corresponding overlays to inject.

“The list of overlay targets returned by Xenomorph incorporates targets from Spain, Portugal, Italy and Belgium, as properly as some common purpose applications like emailing expert services, and cryptocurrency wallets,” in accordance to ThreatFabric.

Following getting Accessibility Providers privileges, Xenomorph will initially sign-up and confirm itself with the C2, by sending a ask for employing the respectable, open-supply project Retrofit2 (a style-risk-free Relaxation consumer for Android, Java and Kotlin formulated by Sq.).

That very first message has the first details exfiltrated about the gadget, according to ThreatFabric. After that, Xenomorph periodically polls for new commands from the C2.

For now, the commands permit the malware to log SMS messages, listing the web injects sent by the C2, enable or disable intercept notifications, and enumerate mounted apps.

Meanwhile, the malware also performs the aforementioned logging: “All the facts collected is only exhibited on the neighborhood gadget logs, but in the long run a very small modification would be enough to increase keylogging and Accessibility logging capabilities to the malware,” researchers warned.

Part of the Alien Franchise?

ThreatFabric’s examination uncovered evidence of code reuse that hyperlinks Xenomorph to the identified Alien malware, which is a descendent of the notorious Cerberus malware.

These contain the “use of the same HTML useful resource web site to trick victims into granting the Accessibility Solutions privileges.” And further, Xenomorph uses condition-monitoring by means of the use of the “SharedPreferences” file.

“This file is frequently utilized to keep track of the point out of an software,” scientists noted. “However, the design of variable naming utilised by Xenomorph is pretty reminiscent of Alien, even with getting most likely even extra detailed.”

They included, “potentially the most interesting fact is the true title of the sharedPreferences file made use of to shop the configuration for Xenomorph: the file is named ring0.xml. This could possibly glance like any other generic random string, but it occurs to coincide with the identify of the intended actor driving the advancement of the first Alien malware.”

Even while for now Xenomorph is a quite common banking trojan, ThreatFabric mentioned that it does have untapped probable.

“Modern banking malware is evolving at a very speedy rate, and criminals are starting up to undertake far more refined enhancement procedures to assistance foreseeable future updates,” researchers concluded. “Xenomorph is at the forefront of this change…ThreatFabric predicts that with some more time to complete enhancement, this malware could reach bigger menace levels, comparable to other modern-day Android banking trojans.”

Be part of Threatpost on Wed. Feb 23 at 2 PM ET for a LIVE roundtable dialogue, “The Secret to Preserving Tricks,” sponsored by Keeper Security, will focus on how to identify and lock down your organization’s most delicate information. Zane Bond with Keeper Security will be part of Threatpost’s Becky Bracken to offer you concrete actions to safeguard your organization’s critical information in the cloud, in transit and in storage. Sign up NOW and remember to Tweet us your questions ahead of time @Threatpost so they can be