Resubmissions

06-10-2022 16:34

221006-t3fgjshhe5 10

18-07-2022 09:59

220718-lz8pxscdaq 7

21-06-2022 09:18

220621-k9lsgacfep 8

Analysis

  • max time kernel
    2240838s
  • max time network
    163s
  • platform
    android_x64
  • resource
    android-x64-20220310-en
  • submitted
    21-06-2022 09:18

General

  • Target

    4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk

  • Size

    5.2MB

  • MD5

    e3281f0f5840038135e319419e3d5338

  • SHA1

    56e7318683cb591051805d6018f619ca2937eda3

  • SHA256

    4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a

  • SHA512

    edc0673a0228432074165c3c52a1dcafa54164f71699f3ba10d47d4f92202137ada0b09ccd72f8b77d59f3e24f64bfe8342d6aeb53611eef9c4aa1ce5c5a1a90

Malware Config

Signatures

  • Malibot payload 1 IoCs
  • malibot

    Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.kkaxrzqsc.ckiradcii
    1⤵
    • Loads dropped Dex/Jar
    PID:6197

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/.com.google.Chrome.FfCOMS

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies

    Filesize

    64KB

    MD5

    9b23e6a88d5a95f155f205cb04b93cd0

    SHA1

    b62dccbbef087a0731f226b96d15d35d8aa5e5fc

    SHA256

    f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857

    SHA512

    bce5f25d98e2e8296c4101b62082dcb6a43902f3431ff6f725e41be6b9aece76e887ef94c4818baf4da845708fd76fd51c37fb6915710c870647593868f27482

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies-journal

    Filesize

    1KB

    MD5

    5748be98129b764c8854ba72b9c47181

    SHA1

    11713e7c6ccd11450b5cac56d39565a7c2780ab4

    SHA256

    05967d82e26227353adbac48d0fecc4ff389351e855de2352c5bf27497678798

    SHA512

    02f189dd980e92cac42b98fc8ccd8a22826fda044875c722a852e393cbd8d20bc37d34240e350e009d5abfa7f314b340b77280d9985f1723c6887982fa3a2c11

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index

    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index-dir/temp-index

    Filesize

    96B

    MD5

    d8cfa3a45cdb914d83e40d7706ad4bde

    SHA1

    b324cd80532d5823c4499512ee066b7e3e475ebf

    SHA256

    b4a67e24b4971e47ce97f9fb9e01ed9e1bbbb9a6268edba647e7b572e402f139

    SHA512

    b9445c7cb47bf257e102f1c109b2dfced7ce03f0e3f9890b94b169f8500479f9667eb66cca39d27e6ad067a098828a335ae7ef72d959d5b0361eee2c4bd8dc25

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data

    Filesize

    112KB

    MD5

    b663831f8cc130493476d94f2d7a5330

    SHA1

    043a1956ab8e40821d67043f8a9110a8eb36fb93

    SHA256

    c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

    SHA512

    e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data-journal

    Filesize

    1KB

    MD5

    4b7ab3f5a89fd2a72aaa9ad4751be9cf

    SHA1

    0b7b1b0e3d1a8cddad874c219b36494c95ac9c07

    SHA256

    0b72c96e6d4225a9a36b8fd89933516ffca0f14f79b6ae3d2013ddd4184a9b20

    SHA512

    325c21da0467344d6a020d77d04d2777838897b38628cdc0e8d7d38bdccd431a5609113850adc2cc747722f6b60855179e030f0bee914e20e75ec5609fffec50

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/metrics_guid

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/metrics_guid

    Filesize

    36B

    MD5

    f0e6c29e0ee3041a48db80464882cf98

    SHA1

    90508b93c1bead74c84ad578101c8d456c973735

    SHA256

    6a271da98be6ea00afcd92e2f82e057b44b8b52c2387522d0af8e940c3c58737

    SHA512

    da6f21836661f2492f6a2f05493d81c2efb954bb60c492df563ff34585d26697ef16a69abe6310c16bdf99ec65cea40cbc008092d8efe021f5955d88bde040c3

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_seed_new

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_stamp

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/webview_data.lock

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Crashpad/settings.dat

    Filesize

    40B

    MD5

    0c4603d39841b324246c8678f0d44150

    SHA1

    3bc1fd15345807288dad40d24acb11a5c60d75e7

    SHA256

    757baf812d6f881b3639c85b10a8919b8d7e9b0075b981138d891083ccd62e9f

    SHA512

    0dfafebfa15829463e29dc290b722a049e967f743934f1049a9726e8bf09277d9eef0894d9d6cf0539fdd0d2e80f908b176b17a78875bb8100c9f41ea71a9f95

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/2cc91994e9846fd5_0

    Filesize

    346B

    MD5

    8d0b9fd00eb13641fbfba426c81927b5

    SHA1

    92c5e3a9bb76afb0201d4a556e887aaeac63c211

    SHA256

    6d762288dbc94fb054313c42a6eafab7a2d30ff9833f079144911f16a2fa8365

    SHA512

    f65e3166b078481e5c0bde0b9023c85076dee101cfe5306142e01fd9752d23076c1bb087f702d6fac8038701991cda8573320c688a223a925a40da6ff85dbbf7

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/97679d61c8ddcf88_0

    Filesize

    348B

    MD5

    77e3acf2d34ac38de9ac9c3e5f25e039

    SHA1

    e4364372604b93e7ba0490ce50f7832e04f790d0

    SHA256

    3f10832ff2890da35223ce774bda0eeb230daf3e6a05601dba49a80704130100

    SHA512

    dc9fca407d1d8481f0a8c0c52cef51e95b0953e6c9839edeb089a3a2950056ee9eedc23614a5537f92cc7b81de1522ab7847caecffb936c93f9e821ea89afb00

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/Code Cache/js/index

    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

    Filesize

    96B

    MD5

    6041faf922b435cb888d0f67a6d6ea19

    SHA1

    125031f0bf581aa99d7a1f1966acf96316eee473

    SHA256

    b0497a85494197b419882edc573f4eeb7471dffdb244535444465bf9c65b482e

    SHA512

    deef8eccb68edc8348dab070274a0089f24a6b5c2b25bb14173939440e8190000c2b57db0b14b6e3543c812718e5d083ad1c37916d35c12f6c123f1901332ec0

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/dc125dc52556426c_0

    Filesize

    356B

    MD5

    9345d62f644677fa5de1b44f6b8a12cc

    SHA1

    6ca78d9809a7c286ff424a937fb04a4b80d9989e

    SHA256

    941c71804988d579753967ed49e09e024fa20530e879013dca084f4ae0342350

    SHA512

    e4c94e82ab8ac3ba597f45771a8f5fc2972928a8ed712a1a523eda15dfc152fe3b49e39ed9cd95020253111c2c01d0052b7a861f5f7d11d850ffeb9c9a1d06c8

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index

    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

    Filesize

    144B

    MD5

    0b3028959e5b1cf5de931c5e6e9fed08

    SHA1

    d428c0d6329810c537003acb3d3a69df792adff1

    SHA256

    ac29ab482b64db452c767bf3f9e33d29451a5bf21b284eaa05ccded27af99715

    SHA512

    2c0c10872c3a48385ce1c64b208052914afa1cf9724d3e3039b0fc561e7f40d1f79df5ec3c03ef776aa86be48a3c32d15f478f0020ab923dcbf97d1190ed58eb

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

    Filesize

    96B

    MD5

    3ca6a5f309f222f81c7d9dd3753636ee

    SHA1

    3baee323d145e51bcfca403277397d8834c0678f

    SHA256

    19adba6ba15a0f361da5f4d46c567585bd6046e4b60119a5f937331395e98c0b

    SHA512

    2d390f96020bc0c0557aa25f819f87525395610381a51708444402a0994c01e08e2bde1a570b71758a6f2e8457e77e58bed767522bbb9eb545c673b8c4dd0a5e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/WebViewChromiumPrefs.xml

    Filesize

    127B

    MD5

    6ef709b8536878951e87c29a1518fc2b

    SHA1

    24376c70b00152501b3d98df61fa7db435339172

    SHA256

    10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

    SHA512

    96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

  • /data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/com.android.launcher3.prefs.xml

    Filesize

    128B

    MD5

    20837fd8daf2a2de8d6c4ccd8e90653a

    SHA1

    7ac08617bd4585151c239325aea243d9eca586f7

    SHA256

    e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

    SHA512

    a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

  • /data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/multidex.version.xml

    Filesize

    307B

    MD5

    c880ffa0a2c14d70c9f13c86d3b2b162

    SHA1

    977fb43155da77fa975fdc215a526eed68825d8c

    SHA256

    a2e4f0bc1e4811f897295854ac132b982fc3cd2ed500d4c0189fa410ccf3ed9d

    SHA512

    7d4e6f7ddd7d7a734333775ba732edbc6403d1def66bf76e2f3edead9499303279c038e8d40c315ab72d117e6ec3105497a6992e6671ff021c8478c3d6cc243d

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g

    Filesize

    1.6MB

    MD5

    cb24a6c4d91a05002e4396d94936d9eb

    SHA1

    7391cd105430e2017d9bb22b4823ea400f34427b

    SHA256

    d9e95c193a3ffa0c2e621425c503031c18afa77f3e90cfccb9ed817458838888

    SHA512

    17923ca572625866d4aaef2ba57e7965638ab5a09d645f4660f0797a6dc6bf38199320e5d67f8d247e78fa30c0252abbf442baca539333d44a008e21a9b3de9a

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/gUIHgfIk.yTyp

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/tmp-base.apk.I8Tuf8H5754936317617755376.t8g

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e