Its main feature is the very flexible ATS Engine, which offers a vast quantity of actions that can be used and chained into sequences of operations, triggered when specific conditions are met. Threat Actors refer to these sets of actions as "modules" of their engine. The malware contains in its configuration a large set of modules, which mostly offer possibilities to manipulate the infected device's settings, for example by granting write permission to the malware or disabling Doze mode (a mode that conserves battery by restricting apps' access to network and CPU-intensive services).

The list of modules available in the malware's hardcoded and encrypted configuration is very similar to the previous variant of Xenomorph that we reported earlier this year. In this version, a new module was added, which is highlighted in bold in the table below:

'Mimic' Feature

Threat Actors have also added a new feature, referred to as "mimic" in the code.

This feature is enabled or disabled using the "start_mimic" and "stop_mimic".

Effectively, whenever the malware is launched, it checks if this mimic mode is active. If it is, it will automatically launch another activity that was communicated as a parameter with the start_mimic command. This gives the option to the malware to act as any other application, and more importantly, removes one behaviour that is often associated with malware. The code contains an activity called IDLEActivity, which is used as a webView to display a legitimate website.

In most cases, after the first execution, malware hides its icon from the launcher, in order to pass unnoticed for the longest time possible. However, this is also something that can be checked by security products, and it increases the risk score associated with a specific application. 

By posing as another application, Xenomorph can avoid using this technique, avoiding triggering one of the many behaviours typical of Android malware.

In the samples observed the code for this feature is available, but it is manually disabled with a hardcoded flag. We expect this to change in the near future.

ClickOnPoint Feature

Finally, the last command added by the authors or Xenomorph is the ability to simulate a simple touch at specified coordinates, using the "clickOnPoint" command.

This is not an incredibly advanced feature, and definitely not the most complex that Xenomorph offers, however, it allows criminals to perform small actions without having to create a full ATS module.

This command adds more flexibility to the whole process:

if (!apiCommand0.command.equals("clickOnPoint") ||
     apiCommand0.parameters == null ||
     ((String)apiCommand0.parameters.get("x")) == null ||
     ((String)apiCommand0.parameters.get("y")) == null) {
          continue;
}
Integer integer0 = Integer.parseInt(((String)apiCommand0.parameters.get("x")));
Integer integer1 = Integer.parseInt(((String)apiCommand0.parameters.get("y")));
UtilAccessibility.click(App.getAccessibilityService(), integer0.intValue(), integer1.intValue());

Target Analysis

Overlays

The most recent samples of this new Xenomorph campaign date back to mid-August 2023, and were identified by the appTag "RUN-AUG1508-HIDE-1". This tag, apart from helping us identify the period of activity connected with this specific campaign, also indicates the likelihood of a recurrence of such activity.

We were able to identify a few dozen samples belonging to this campaign, connected with a targeted effort in the same areas we identified in what we defined as a "live campaign" in our previous article.

These areas include Spain, Portugal, Italy, Canada, and Belgium.

However, this latest campaign also added plenty of financial institutions from the United States, together with multiple crypto-wallet applications, totaling more than 100 different targets per sample, each one using a specifically crafted overlay to steal precious PII from the victim's infected device.

As mentioned in the introduction, this is a trend that we consistently observe in all modern malware families.

With the ubiquity of mobile banking adoption from institutions from all over the world, it is only logical that criminals are taking this opportunity to expand their activity to previously untapped markets.

Distribution

ThreatFabric was able to identify active campaigns distributing the malware via phishing pages. In these cases, the malware was distributed through phishing pages posing as a Chrome update.

This is in line with the standard lures used by many other malware families: usually with applications that are very common and generic, like Google Chrome browser or Google Play store, raise fewer suspicions among victims, who are extremely likely to have them already installed on their device. 

In this specific case, however, actors made the vital mistake of not restricting access to the server folder containing the files necessary to distribute the malware (not a first when it comes to Xenomorph).

This allowed us to monitor the server, identifying multiple interesting files.

One of them is named count.txt, and contains a list of entries, made up of IPs, user agents, and dates. Upon further investigation, we were able to confirm that these were the IPs of devices downloading the payload of the phishing page.

This gave us very valuable information about the actual downloads of this Xenomorph campaign.

From the graph, it is clear that this campaign is heavily focused on Spain, with more than 3,000 downloads in the span of a few weeks, followed by a large margin of downloads from the United States and Portugal, with more than 100 downloads each.

It is worth noting that, a few days before the publishing of this article, the drop point change payload, started distributing ExobotCompact/Octo. 

The reason behind this event could be one of the following:

• The server is used by one actor, using multiple threats, testing each one.
• The server is part of a distribution service, where the samples to be distributed are handed over to distributor which places them on one server for different campaigns of different operators.

Both cases are possible, and we have actually reported instances of each in the past. The first case is still connected to Xenomorph, being distributed side-by-side with Ermac payloads using Zombinder droppers.

The second case dates back to 2022, with the same infrastructure distributing both Medusa and Cabassous.

Currently, we do not have conslusive evidence to prove either of these hypothesis, but we will continue to monitor the infrastructure to gain more information.

Desktops are also Targeted