Overview

overview

10

Static

static

7

bfa9a861d9...c4.apk

android_x86

10

bfa9a861d9...c4.apk

android_x64

10

bfa9a861d9...c4.apk

android_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4

  • Size

    4.6MB

  • Sample

    220621-k9l38sehd9

  • MD5

    f418c75d5a0eb0186f5111770180e6dd

  • SHA1

    f098f8a8f7a195e2c16dc2127e74237a65dbf024

  • SHA256

    bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4

  • SHA512

    eb78728d813583a0b74e3ba1226dea8935cd4659f8a88e273f4dd16466a7449f1b2d9eed58faa90496745eb57644e699d8c332bfb4a632530ea40f9490007fd1

Score
10/10
malibotandroidbankerevasioninfostealertrojan

Malware Config

Targets

    • Target

      bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4

    • Size

      4.6MB

    • MD5

      f418c75d5a0eb0186f5111770180e6dd

    • SHA1

      f098f8a8f7a195e2c16dc2127e74237a65dbf024

    • SHA256

      bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4

    • SHA512

      eb78728d813583a0b74e3ba1226dea8935cd4659f8a88e273f4dd16466a7449f1b2d9eed58faa90496745eb57644e699d8c332bfb4a632530ea40f9490007fd1

    Score
    10/10
    malibotbankerevasioninfostealertrojan

    • Malibot payload

    • malibot

      Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.

      infostealertrojanbankermalibot

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Removes a system notification.

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks