malibot | bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4

Analysis

max time kernel
2240842s
max time network
173s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
21-06-2022 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4.apk
Size

4.6MB
MD5

f418c75d5a0eb0186f5111770180e6dd
SHA1

f098f8a8f7a195e2c16dc2127e74237a65dbf024
SHA256

bfa9a861d953247eea496f4a587f59e9ee847e47a68c67a4946a927c37b042c4
SHA512

eb78728d813583a0b74e3ba1226dea8935cd4659f8a88e273f4dd16466a7449f1b2d9eed58faa90496745eb57644e699d8c332bfb4a632530ea40f9490007fd1

Score

10^/10

malibot banker infostealer trojan

Malware Config

Signatures

Malibot payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/base.apk.w88gItg1.pUU	family_malibot

malibot
Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.
infostealer trojan banker malibot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.vvozewzes.zbggimdsu

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.vvozewzes.zbggimdsu

Acquires the wake lock. 1 IoCs

Processes:

com.vvozewzes.zbggimdsu

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.vvozewzes.zbggimdsu
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.vvozewzes.zbggimdsu

ioc pid process

/data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/base.apk.w88gItg1.pUU 6998 com.vvozewzes.zbggimdsu
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

31 icanhazip.com

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.vvozewzes.zbggimdsu

ioc	pid	process
/data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/base.apk.w88gItg1.pUU	6998	com.vvozewzes.zbggimdsu

flow	ioc
31	icanhazip.com

com.vvozewzes.zbggimdsu
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:6998

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.vvozewzes.zbggimdsu/app_webview/.com.google.Chrome.dkOQ2p
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/app_webview/Default/Cookies
Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/app_webview/Default/Cookies-journal
Filesize
1KB

MD5
f11f1831b71f5800b298442ab27a3021

SHA1
0b3830b37601b166504ba11cb1e9aee7c0ad1825

SHA256
bfe980d9841b7bbb7663abc9799aaf33649f17159aa08f407539ff2d4d84ed1a

SHA512
4a75c1bea78b2d572d38c805bdbfaa123519450bbe54c89e79797505e6bd8e886fbaf8554822baedc708d375dc13861123ab3925ef4dbdd516393bdacf0ce329

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/app_webview/Default/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/app_webview/Default/GPUCache/index-dir/temp-index
Filesize
96B

MD5
d9298e0d7a70952e0de657f7150bccd0

SHA1
ad983f97f946aa6f524c069be9ee3278770510c5

SHA256
a323a96402d309f7dc1a3a31c7eb6896245e9cf93de144a60a276f85e5a3faa5

SHA512
64e690e79adc6d083f8419f8abd271622b863b2d6c263203bfa6d08a48a935d52a8e0e411c9c06a3382bfa71f083006315ac0273cd71ce544c4f3139665d39e9

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/app_webview/Default/Web Data
Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/app_webview/Default/Web Data-journal
Filesize
2KB

MD5
427cf5937543f3eddcc1a3781aced39d

SHA1
bd3860f2a5adc79a2d16fa3e3820c7adeabb1a84

SHA256
1134bc0120871d07388b427d1e5924a153212ca41be8574de31b617c08762a85

SHA512
c6ba6334209339399cf1444ea2950297b1ad5ff1211156ff2cc0cd7255e5ac5082ec9d2c007c8753df2b79b9af64c080fe5651906c0ed814fc17e9446aeff973

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/app_webview/webview_data.lock
Filesize
29B

MD5
6697229907a9613edbe6b6173158ade4

SHA1
645a72fefa9bffcd4e13661105f0bebdb7f0d101

SHA256
4e513134a5e0643423ef2a030011db18985d596a23dcd90db8628b5521b938ac

SHA512
f972200404b9ee4b5451dee182b715627c22047b9e764abe857188252f82129a03b3d76f3f281ea76a70ef423786aa1d606a6c706ff2f93d930f2c6161483e18

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Crashpad/settings.dat
Filesize
40B

MD5
07745203597acf366280acb91a5ae307

SHA1
263f24e9e437164951dd28b83ea705633f0241dc

SHA256
3efc6d51363f48470956166af090e15b75e50a3eb20366395d8f3f1f458a9f70

SHA512
581d7c7c855ad6fdafb0187c25ed5de004f677e5edc731ca6c42d6b516060670b609d26ac55c8c7e3cc0dc58dd8b36bb6e78a98c27f0f0ffb37fefa66da886b2

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/5ae47e20b48046e0_0
Filesize
336B

MD5
81c340b2e5d6badca7085a2ef7df61e8

SHA1
b680f9a5ce7903da3241ab3a775992321f9cd497

SHA256
147ed47ab8a2b0915e8944c9427ecbfea4148b3b02b1a26da98ef7b96a514dd1

SHA512
a49834d20e82a223c8a9d3e02e86480fdc4a7d51f7e41077b2a818f81a9f517af9e9c67e2c61d6b23a9be4a24f1831988e7fc3a034dd561c58b3a42de1a41057

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/9d6bac5235b84dbf_0
Filesize
326B

MD5
7dd71409b16561f48209b1ab5953da36

SHA1
f39b571b35f7b7f152e7dbee83357964b44b2d59

SHA256
de84af2ecad0802d46976a6d31717e35c8398b488b2eda1e34783c8958e360f3

SHA512
4bbdc7778ed2e7664cc845c856a2c4b4c4cb26b66e6f7153bdb96029e2fa1dec2f1fda6ef06733d273af2b72be9fe4ccf7a97a0828b37cefe5be26860f0c7493

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
9de98ec72edd1bb468b885936a50537d

SHA1
64423bf4f031c4aa78ed2545243c7c16004fd7e3

SHA256
573e2b854ef87441a73ce80825b2c65b10b7f3a6caaf3e312840d91a8de35031

SHA512
150d32698b04f6318c2328defab8fd78fb3de78a941fbf08682b624e1c5c1e5e5cc59c2c799b5251572244b4416685c7dddad834514594cac802a2abb9f025d8

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
Filesize
96B

MD5
6cad47af417cc8cb6475818d4a8c42cb

SHA1
bb1ecd410db9b65f0ff8797ce6cfd1ba2b5fe980

SHA256
de166268dba330f6937bbd267599c00d818890bc8df4c92982c4ae05d383c37a

SHA512
4c96577e43b18c0924fed5953fa4927a30cb58db84676546f9d98566cd3ae774fc86b504cf04a153c8da4dcf32eb2e94665ac5f089f87ed339a34ba6f85cce95

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/a7a429bcb306b171_0
Filesize
328B

MD5
fd4e832af787f73c5a38c39b5fc1bee5

SHA1
a270c7e5fba1a5bc762b9e1ba10cb8ea0ae2cd81

SHA256
7997f44d690b89a4056da4ec4931ac7509faa7c04fd37938e2cd4f3cc6c1a2b6

SHA512
cadfd8954131c2387cf21bcafcefd2a03159c4cc5415ea103c432fbb5ccd41f2574fba4347d82850548df8775bca426f8e791e6d4f52fbab0ff30c2d1642af7d

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/index-dir/temp-index
Filesize
144B

MD5
55bb1a70eddd2db70472618e56114568

SHA1
0b09a14a7c2860d6d1783fd20710d46905fa5df3

SHA256
71224a40a35424c0d188987a2cde7962497657d4b16e2f295d454c4d3d44fb31

SHA512
0cf396c1bd54ca4f5e9b3f304a03c3037a12fbebcede6bee9aee33d64753e36eaf8d893c0e217a25d5fe667eaa00f3079e6d37cbe32fc0daa1fa8a9fc28f51b0

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/Default/HTTP Cache/index-dir/temp-index
Filesize
240B

MD5
2572b2aff50934d477b43dc27a770bdd

SHA1
59ba9393cbe1176199a801d044119b69ceff4438

SHA256
b2a072b49100ff752f571cfa682800044fc01f50e8b5d69f2a7686a358ceb146

SHA512
be60356339526d31208a41f8abf6601bb3a4afb234a68b32f34d4332eba98f6a1159ae4f232759b649a533700371197479a6f36c424b640b27227b95985458eb

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/cache/WebView/font_unique_name_table.pb
Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/base.apk.w88gItg1.pUU
Filesize
1.6MB

MD5
4b3be813c34424efcad30d504494195d

SHA1
abeedbd2027a0665d6bd4aa5183c1e6b1cc8eea0

SHA256
775f33a8982d6cd926c7caa95c7d11f497e9e7c3b389914f7812a1c2ded58938

SHA512
33f42ab3e8286682117a75216bfa34b22371805a8a902caaaf77d73fc3e89347f0a382e3de3c73803978f8ea5830f92b219c95cc553485a3e636c2be8520f2c1

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/gghydtf8.yotI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/httkGtUgfI/HUgItyj7It7Gauf/tmp-base.apk.w88gItg827163379540825629.pUU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/shared_prefs/com.android.launcher3.prefs.xml
Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.vvozewzes.zbggimdsu/shared_prefs/multidex.version.xml
Filesize
305B

MD5
1b179a2cccfa92bd9cbc78cc785119ea

SHA1
bec12ab343ca8fca5cc969cc352e4c2512120648

SHA256
b0a5936e9f063fd0e225bd093d625864aabb7771e6b081e96a4cd646fe23d294

SHA512
12a8dd2c808f2195c7af7b6a126d61a70cf4213322865865513651a5855d24587ae4f431b4f1c436ce4709106f2527870dd70dfc4b1d53619b82d6912f38fee2

Download Submit