malibot | 4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a

Target

4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk
Size

5.2MB
MD5

e3281f0f5840038135e319419e3d5338
SHA1

56e7318683cb591051805d6018f619ca2937eda3
SHA256

4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a
SHA512

edc0673a0228432074165c3c52a1dcafa54164f71699f3ba10d47d4f92202137ada0b09ccd72f8b77d59f3e24f64bfe8342d6aeb53611eef9c4aa1ce5c5a1a90

Score

10^/10

malibot banker evasion infostealer trojan

Malware Config

Signatures

Malibot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	family_malibot
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	family_malibot

malibot
Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.
infostealer trojan banker malibot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.kkaxrzqsc.ckiradcii

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kkaxrzqsc.ckiradcii

Acquires the wake lock. 1 IoCs

Processes:

com.kkaxrzqsc.ckiradcii

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.kkaxrzqsc.ckiradcii

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kkaxrzqsc.ckiradcii

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=&com.kkaxrzqsc.ckiradcii

ioc	pid	process
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	5278	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	5199	com.kkaxrzqsc.ckiradcii

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

66 icanhazip.com
Removes a system notification. 1 IoCs
evasion

Processes:

com.kkaxrzqsc.ckiradcii

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.kkaxrzqsc.ckiradcii

flow	ioc
66	icanhazip.com

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.kkaxrzqsc.ckiradcii

com.kkaxrzqsc.ckiradcii
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5199
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5278

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies-journal

Filesize
1KB

MD5
b0e81e0a8efaaac7adc4492689ff7206

SHA1
f34d5f6ab246a3e745bb1f0d0f2d3a78dd1adc6d

SHA256
7b9aa43483d24ee71e820e4b8a928037048db9586149948b33dd4a13678f3d3d

SHA512
be680df2073a1c8e0f4567ca4035a1f621ac5bb6ff2e1772f36e31123ed78c79bbd7429804a6ca766e60d4388f0a8a9bde1c776831d9bbaa325587ef6bcee65f

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
a3c81d00ab88bb2828f6179242dba92f

SHA1
59f625ed6513679ecee0591e02999784951ffddc

SHA256
a9635158eac6147c84a4e038f2fa2f7e0ac7c3d448cd91287f891517488c9579

SHA512
a02371a67341f73561686abe31c2d7e804a87d1d1ce72028016fce3bffe517d8417529ffbdd1ada76d844bd8f1073a750158db85b616c1e855dec0620db8d41e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data-journal

Filesize
1KB

MD5
03d710a8fd9d81f7d969bfdfba22ac3d

SHA1
ef794b9412a6edffdf26811e04c2f5ce9ae01a30

SHA256
a55523bca4f401cb6cedbd5725dc195f4de52e593e1d2b10d095faf3e000ace3

SHA512
7580e0b9a0d43918ae50d5731e595312f07c3f96f7869e4cbfcb5c08b96cb63ce1d67a4a37007f3f890568b6616984ec61369f3672f9ba432d339bbfe8f649cf

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/metrics_guid

Filesize
36B

MD5
77b01aff2cdcf9c5f1a0d23db74a91ff

SHA1
c732892e1201bf6f9d27760e6dc6dbdf8c130470

SHA256
ef587b631daaa95fc6b767358e5a1dbba535b2b58b38a2f0a3741b0b32d6f0c5

SHA512
90d2734857d63153543eb997d8c9b7b128109dae59e105ba2b5d3b23c82d156d5f13cb77f402a006039baa9fd6be562d361ad322ba6e94e4aaa278f0a5f82cd1

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/64d1682260355400_0

Filesize
166B

MD5
7c5e56881ba8a763d33450f18702884d

SHA1
033790592547f87b19c0768749e2d12c31fdb804

SHA256
293f25239653dfafd84622e5a4974f7345bde57454b02179accddffbcc13df91

SHA512
fb2309fdf8fa61a386c2fc6e5869af33afc775353d5fc357452ab3b86beea6951931420b57cf49177dbddeac0b923f1358a0c71874e92523466ab3f9bae436f0

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/a596f01c20a464c6_0

Filesize
161B

MD5
2505efcf21cc7a5f45b925a77dc60532

SHA1
00ff386374702b0168af4cfb468b64d90fb3a6ed

SHA256
61265dfafbc8c8f66536c4c7c4a53b1d5d838ad740739e3af44c7b2502155ad9

SHA512
47a0fd6129b876422eeb5fc98b3faa1edc8b05c4afdedac385c54f4276a133c1751a7867419190942c0d26a3ea7f1fb9a018a9d391c6eddc67df42b3569d95ad

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/ee99804c74e2eb6a_0

Filesize
162B

MD5
bcf9da02b2d07a9c3da0c852319ae70c

SHA1
f64c2e79dd99dcbe558ce97afc128a2331fff783

SHA256
d6c055ee7bf7dc5cdbfad49697775d5853737885639874b0aad01e6399ac00f7

SHA512
1c46c9919275da02d1b33136cd9dda79423620462438d34fc15f30dac219015204c959646cc3e16c2918ee0901f5595e283befcc7126054bb77a1d0f51dc79fe

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
05194fd2f7711d3486b0f2daf0594900

SHA1
0be4ffa49311e547c257a1130a2fb5cdbb77bccf

SHA256
642d7e5cb7be3251cb68f3389f43e6575552a95c8ea22efb43d878fd586b583d

SHA512
66c74de8e42a32f0c2dab0924ff92f13b2dd4e7a648afbd6084d0a3d5d60478f0687bef95bc88ab5301fecdb236716e84ff0d140561cc1490d2888f504a3b473

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
4c691ca4b3dd896d1c83ae68fd327109

SHA1
8efc229b0daddd8c1c34016a17399abc73cea34f

SHA256
78514b90a253526b237cb4bf30f58a0c4a687973fa00abb402538541d4e72305

SHA512
488517fb00a7a681f1a480877ca7c114d8f826935000cb76c8e04b12f6ca1151eacdc3371d5bafdc26d8e94c52465c819334a16ecd1b2c0e9c6e11838eda6920

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/com.android.launcher3.prefs.xml

Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/multidex.version.xml

Filesize
307B

MD5
5088e69eb17f4a3a2009297e1ea826c3

SHA1
d110bf99de9c4bcd565164a8045081ae1244f211

SHA256
c43a43ae8b07c89628f7d3fad1a4d337060b64b9385fbc53c12355a552e93845

SHA512
0f742e9fc54194dfc1b7101c16613ac9ead3bd5b7d7ed6ccedac65818d8a8cddf26f22aab148045efd038aead881c94baddd377d49de19ef3e2a25ec741b2c09

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g

Filesize
1.6MB

MD5
ecec695a6ef0032ff675328d9875ab44

SHA1
4f27095cf94144109425324c5ec7a6d0b998546d

SHA256
9fbeac09b30c4f3f07967a9300c0ee8cbab6b752517fd4fead661ad0c5aa22e2

SHA512
9e00c7fcec7560d64c86a13845d7080aabe2bf00e9a1e5cf83d6c0acd3dab85b6c481b54abc3bb133b45b7ab6109a1f570d881d17a40df2c0c534cff71a658ae

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g

Filesize
1.6MB

MD5
cb24a6c4d91a05002e4396d94936d9eb

SHA1
7391cd105430e2017d9bb22b4823ea400f34427b

SHA256
d9e95c193a3ffa0c2e621425c503031c18afa77f3e90cfccb9ed817458838888

SHA512
17923ca572625866d4aaef2ba57e7965638ab5a09d645f4660f0797a6dc6bf38199320e5d67f8d247e78fa30c0252abbf442baca539333d44a008e21a9b3de9a

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/gUIHgfIk.yTyp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/tmp-base.apk.I8Tuf8H7387334298368503501.t8g

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit