Overview

overview

10

Static

static

7

4f9fb1830f...2a.apk

android_x86

10

4f9fb1830f...2a.apk

android_x64

10

4f9fb1830f...2a.apk

android_x64

10

Resubmissions

06-10-2022 16:34

221006-t3fgjshhe5 10

18-07-2022 09:59

220718-lz8pxscdaq 7

21-06-2022 09:18

220621-k9lsgacfep 8

Analysis

  • max time kernel
    2240836s
  • max time network
    166s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    21-06-2022 09:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk

  • Size

    5.2MB

  • MD5

    e3281f0f5840038135e319419e3d5338

  • SHA1

    56e7318683cb591051805d6018f619ca2937eda3

  • SHA256

    4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a

  • SHA512

    edc0673a0228432074165c3c52a1dcafa54164f71699f3ba10d47d4f92202137ada0b09ccd72f8b77d59f3e24f64bfe8342d6aeb53611eef9c4aa1ce5c5a1a90

Score
10/10
malibotbankerevasioninfostealertrojan

Malware Config

Signatures

  • Malibot payload 2 IoCs
  • malibot

    Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.

    infostealertrojanbankermalibot
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.kkaxrzqsc.ckiradcii
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    PID:5199
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5278

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies
    Filesize

    64KB

    MD5

    cb7543c4df600f2af58097cce0e334ba

    SHA1

    83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

    SHA256

    64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

    SHA512

    ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies-journal
    Filesize

    1KB

    MD5

    b0e81e0a8efaaac7adc4492689ff7206

    SHA1

    f34d5f6ab246a3e745bb1f0d0f2d3a78dd1adc6d

    SHA256

    7b9aa43483d24ee71e820e4b8a928037048db9586149948b33dd4a13678f3d3d

    SHA512

    be680df2073a1c8e0f4567ca4035a1f621ac5bb6ff2e1772f36e31123ed78c79bbd7429804a6ca766e60d4388f0a8a9bde1c776831d9bbaa325587ef6bcee65f

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index-dir/temp-index
    Filesize

    48B

    MD5

    a3c81d00ab88bb2828f6179242dba92f

    SHA1

    59f625ed6513679ecee0591e02999784951ffddc

    SHA256

    a9635158eac6147c84a4e038f2fa2f7e0ac7c3d448cd91287f891517488c9579

    SHA512

    a02371a67341f73561686abe31c2d7e804a87d1d1ce72028016fce3bffe517d8417529ffbdd1ada76d844bd8f1073a750158db85b616c1e855dec0620db8d41e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data
    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data-journal
    Filesize

    1KB

    MD5

    03d710a8fd9d81f7d969bfdfba22ac3d

    SHA1

    ef794b9412a6edffdf26811e04c2f5ce9ae01a30

    SHA256

    a55523bca4f401cb6cedbd5725dc195f4de52e593e1d2b10d095faf3e000ace3

    SHA512

    7580e0b9a0d43918ae50d5731e595312f07c3f96f7869e4cbfcb5c08b96cb63ce1d67a4a37007f3f890568b6616984ec61369f3672f9ba432d339bbfe8f649cf

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/metrics_guid
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/metrics_guid
    Filesize

    36B

    MD5

    77b01aff2cdcf9c5f1a0d23db74a91ff

    SHA1

    c732892e1201bf6f9d27760e6dc6dbdf8c130470

    SHA256

    ef587b631daaa95fc6b767358e5a1dbba535b2b58b38a2f0a3741b0b32d6f0c5

    SHA512

    90d2734857d63153543eb997d8c9b7b128109dae59e105ba2b5d3b23c82d156d5f13cb77f402a006039baa9fd6be562d361ad322ba6e94e4aaa278f0a5f82cd1

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_seed_new
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_stamp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/webview_data.lock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/64d1682260355400_0
    Filesize

    166B

    MD5

    7c5e56881ba8a763d33450f18702884d

    SHA1

    033790592547f87b19c0768749e2d12c31fdb804

    SHA256

    293f25239653dfafd84622e5a4974f7345bde57454b02179accddffbcc13df91

    SHA512

    fb2309fdf8fa61a386c2fc6e5869af33afc775353d5fc357452ab3b86beea6951931420b57cf49177dbddeac0b923f1358a0c71874e92523466ab3f9bae436f0

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/a596f01c20a464c6_0
    Filesize

    161B

    MD5

    2505efcf21cc7a5f45b925a77dc60532

    SHA1

    00ff386374702b0168af4cfb468b64d90fb3a6ed

    SHA256

    61265dfafbc8c8f66536c4c7c4a53b1d5d838ad740739e3af44c7b2502155ad9

    SHA512

    47a0fd6129b876422eeb5fc98b3faa1edc8b05c4afdedac385c54f4276a133c1751a7867419190942c0d26a3ea7f1fb9a018a9d391c6eddc67df42b3569d95ad

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/ee99804c74e2eb6a_0
    Filesize

    162B

    MD5

    bcf9da02b2d07a9c3da0c852319ae70c

    SHA1

    f64c2e79dd99dcbe558ce97afc128a2331fff783

    SHA256

    d6c055ee7bf7dc5cdbfad49697775d5853737885639874b0aad01e6399ac00f7

    SHA512

    1c46c9919275da02d1b33136cd9dda79423620462438d34fc15f30dac219015204c959646cc3e16c2918ee0901f5595e283befcc7126054bb77a1d0f51dc79fe

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    72B

    MD5

    05194fd2f7711d3486b0f2daf0594900

    SHA1

    0be4ffa49311e547c257a1130a2fb5cdbb77bccf

    SHA256

    642d7e5cb7be3251cb68f3389f43e6575552a95c8ea22efb43d878fd586b583d

    SHA512

    66c74de8e42a32f0c2dab0924ff92f13b2dd4e7a648afbd6084d0a3d5d60478f0687bef95bc88ab5301fecdb236716e84ff0d140561cc1490d2888f504a3b473

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    48B

    MD5

    4c691ca4b3dd896d1c83ae68fd327109

    SHA1

    8efc229b0daddd8c1c34016a17399abc73cea34f

    SHA256

    78514b90a253526b237cb4bf30f58a0c4a687973fa00abb402538541d4e72305

    SHA512

    488517fb00a7a681f1a480877ca7c114d8f826935000cb76c8e04b12f6ca1151eacdc3371d5bafdc26d8e94c52465c819334a16ecd1b2c0e9c6e11838eda6920

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/com.android.launcher3.prefs.xml
    Filesize

    128B

    MD5

    20837fd8daf2a2de8d6c4ccd8e90653a

    SHA1

    7ac08617bd4585151c239325aea243d9eca586f7

    SHA256

    e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

    SHA512

    a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/multidex.version.xml
    Filesize

    307B

    MD5

    5088e69eb17f4a3a2009297e1ea826c3

    SHA1

    d110bf99de9c4bcd565164a8045081ae1244f211

    SHA256

    c43a43ae8b07c89628f7d3fad1a4d337060b64b9385fbc53c12355a552e93845

    SHA512

    0f742e9fc54194dfc1b7101c16613ac9ead3bd5b7d7ed6ccedac65818d8a8cddf26f22aab148045efd038aead881c94baddd377d49de19ef3e2a25ec741b2c09

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g
    Filesize

    1.6MB

    MD5

    ecec695a6ef0032ff675328d9875ab44

    SHA1

    4f27095cf94144109425324c5ec7a6d0b998546d

    SHA256

    9fbeac09b30c4f3f07967a9300c0ee8cbab6b752517fd4fead661ad0c5aa22e2

    SHA512

    9e00c7fcec7560d64c86a13845d7080aabe2bf00e9a1e5cf83d6c0acd3dab85b6c481b54abc3bb133b45b7ab6109a1f570d881d17a40df2c0c534cff71a658ae

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g
    Filesize

    1.6MB

    MD5

    cb24a6c4d91a05002e4396d94936d9eb

    SHA1

    7391cd105430e2017d9bb22b4823ea400f34427b

    SHA256

    d9e95c193a3ffa0c2e621425c503031c18afa77f3e90cfccb9ed817458838888

    SHA512

    17923ca572625866d4aaef2ba57e7965638ab5a09d645f4660f0797a6dc6bf38199320e5d67f8d247e78fa30c0252abbf442baca539333d44a008e21a9b3de9a

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/gUIHgfIk.yTyp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/tmp-base.apk.I8Tuf8H7387334298368503501.t8g
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit