malibot | 4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a

Target

4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk
Size

5.2MB
MD5

e3281f0f5840038135e319419e3d5338
SHA1

56e7318683cb591051805d6018f619ca2937eda3
SHA256

4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a
SHA512

edc0673a0228432074165c3c52a1dcafa54164f71699f3ba10d47d4f92202137ada0b09ccd72f8b77d59f3e24f64bfe8342d6aeb53611eef9c4aa1ce5c5a1a90

Score

10^/10

malibot banker infostealer trojan

Malware Config

Signatures

Malibot payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	family_malibot

malibot
Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.
infostealer trojan banker malibot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.kkaxrzqsc.ckiradcii

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kkaxrzqsc.ckiradcii

Acquires the wake lock. 1 IoCs

Processes:

com.kkaxrzqsc.ckiradcii

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.kkaxrzqsc.ckiradcii
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.kkaxrzqsc.ckiradcii

ioc pid process

/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g 5849 com.kkaxrzqsc.ckiradcii
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

32 icanhazip.com

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kkaxrzqsc.ckiradcii

ioc	pid	process
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	5849	com.kkaxrzqsc.ckiradcii

flow	ioc
32	icanhazip.com

com.kkaxrzqsc.ckiradcii
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:5849

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/.com.google.Chrome.LAmY0r

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Cookies

Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Cookies-journal

Filesize
1KB

MD5
01cf23f6eeacf58dd76fdaadbe4a58b7

SHA1
d1a2cce582ebff1cdf952c5e391011ecb37e2336

SHA256
b9b524565ceef4341d511f93f190d31c134778891a526729cf156da8f24aa6f9

SHA512
e821b9cf8d4ed419339bfcac1264585063fbc4431d532657a2e6bf3cad575df5d2e8f0f42e4d40589d48dae6428bb34c50a7e9e9f0178ba69fe49f711c25eb5c

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
1c0e16e045c9bf5f2840a71cdd8611aa

SHA1
e24a020b2e8c24cbc8b83613582d1adc9a0e371e

SHA256
7fa1aabb020f742145cdef9c5684ee869a464e721e8a37e9968dbba46dbed460

SHA512
d65e9616293912be420729d1d39635e89b0aa4a7ae7fd5c4631c5c2ee2240862acee73027bcedc9c6d9181ac86fa477316d27cd678312c5c4038194434c0767b

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Session Storage/000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Session Storage/000003.log

Filesize
61B

MD5
9f7eadc15e13d0608b4e4d590499ae2e

SHA1
afb27f5c20b117031328e12dd3111a7681ff8db5

SHA256
5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923

SHA512
88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Session Storage/LOCK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Session Storage/LOG

Filesize
135B

MD5
aa6da7604fde0db725dda257b51d8c98

SHA1
7cc92fbdd546ed8780853f984340eb626f4658c3

SHA256
43a20a61fe0b6ddc56ac89bf7a338ad59f4a91726703af5c9f185bcdce0c4efe

SHA512
6820ddee55ab2f41c0880ecebc87f3faf0e7e10740b1e24364f81a062fb4cfabb4695e02381a5c0a7f833d4565333906abd9348246ae1c47c8b839c266b75a63

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Session Storage/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
f5a175630dc585e01654da065abb0d8c

SHA1
cdf5c22a505183fca7610d64881d1b6a094fadd8

SHA256
02ffc342678465ab7780094a54531e6d7408ff4c4946319274af51cde6e488c3

SHA512
5fef15c42e2dd98212ba00eaf5e6343464210f4efcbbf59feef49e549780c6cef875f07548e351c4566660408ef0d31d35aaa538fdda6bffad7f1b0d0de0cf08

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/webview_data.lock

Filesize
29B

MD5
593189a4af60b238fe48bdffe015d8af

SHA1
21e2edfb8d1b5aab36942887d4df2af7192926a1

SHA256
e1a7e3ed55456a3e458deb031534287f1446b0099ee5ac87632fa97fd8fa469c

SHA512
fe8978d49e62bd6cc21e05ec78e8d90571192e680ae34187b1b25b5929a66e64b8bdf352c0c0bde906b5c72df9e47cf8ec689a479ab936a9d4edd33c3e50ee38

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
7cc46c76f47a8f6bb1914ef879993e12

SHA1
9e834276baaea4779892e87588812e7ac2edfa44

SHA256
5253278e2f26f04b96305460a466d28d89eef5cb316d6ed7ef9df36aac65fa3f

SHA512
a7695e56c7af20aba13572a506c0da3ca88d3c85c64e584bcded3d99ec02d1af7f75f85b01be3057b1ef639c154d647cb0dcc65fabcf8b3c874de529720d6956

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/8a7a1e6483532c75_0

Filesize
346B

MD5
f14efbbc1ada2d5943723540d5f99f43

SHA1
1e8444362cacc3f913b323ac1730f836cfc0cceb

SHA256
78d20f2fc1d381718c5907d946d95566213916364ea7d99d3963fa1a5a682573

SHA512
c15a9508c9190875b69452a2e2ddb4c00f4495d2297a6254cb530339b786e1bccd407895608e22ce2b8a65f819703c48e88f4959a0bf5693cc3b8abc80e81bab

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/91f180739bd29a4e_0

Filesize
348B

MD5
0dfa3bce48cf25496d1b8c1c96412a23

SHA1
608a18bf3ef7ba115346d620bc09df7308826ba8

SHA256
16179d5d4d13bcf591ce930cf112e5f98da286aad68a3ab0738e6fb10ba8245b

SHA512
5ef61a8544f7bf1bdbc4f7a6605599cd110f713a52132c49081b5ffc7b67791955362e70a62291c2f3c7b4a1cfe8433014d8c5d0bfc61a55250d5e0b70707869

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
427a5f59748b982d9dfd5376e6beeff7

SHA1
aedd4ed3b1adb6c2682e465d33ae29cb261830c2

SHA256
09c3b88c4eba7c5041d0f6b858242b8d81766f93a65906301ff6f1cbf3cb1598

SHA512
79b9ec69543070b3cf1e0a7f87f933a323cbe176b7aa1ac3fff091a5d81d2fed67ff9f9f96ebafcbb67296b8e7193896ff8d5be6890a81a78f270bb6c3b4163e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
24604f4e1b7659ab71b6fbf400807d83

SHA1
6fb21ac8faaf836f42dd4d94f446d538acf186ba

SHA256
dada5133c7c05ed4eab77599d25a8e3160279b6b843f104c22d6860779f99787

SHA512
dbb9df96b74a6bf92f06a348663fbc18a025c9680ae2c9e2c9f88576a660b72a240fb5df71b41fc2087709ebd82a03e8b6bc5325f55de0db3ac58066d7f19fbc

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/f117b15ceeeadebb_0

Filesize
356B

MD5
82b1399c3ad53665edfe3798a9b10cdc

SHA1
35a9a3ca0ba9621d32a6923a9b5b50c459f113c7

SHA256
7edf7d2c9701dc08f0b348caab1b655f575bd85b786148a81e6243d8e8252b60

SHA512
48607eaa3457f1a1ee8c07532fe36e7248e503e16e2eb8e45cd47357764be1969035eed3c315f7d716b6f54e49d1013e0472071e2ebef1191703fb08e3fcac6a

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
144B

MD5
9c7b60bc021e4acee3a23e2bf71eb494

SHA1
083a43b5fec5b7140697db04e9deab1f127d9ad6

SHA256
1f6b4ddb19ba536561161120cee7bf1c959dc08a5061c57bd1d77c09c33904b3

SHA512
d7e07d010d9ce4a95792c10b154f494a65b30c9a0b89c2525f97872cb52669ca24f987e4cd317f97089e9c192bfabfa7b128deab07439aa2f9e7edaf34a39e85

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
192B

MD5
8aa27006c5c318af67d7f10c49c25ef0

SHA1
27aa322172a6b6ae3514c5016eb7568601045f0c

SHA256
3718eb161c4444de0fe367cc22abdc266b36e35850ad5a051386ed314a782ca0

SHA512
ea407a470b47ec10394373a0c0d0b01d36e0c1b870364c74ccd54abf34ec0feb7361a747cfdeb90c33090cf9c0e7a9259cf6dfc5f2bbd638bd7e353d5dc0bae6

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/com.android.launcher3.prefs.xml

Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/multidex.version.xml

Filesize
307B

MD5
0eced2e09215488151943f07b776bf7e

SHA1
cbcdde7e06289eb52cb688ae29727b4b2fd6f7f0

SHA256
f6742916443af767b70cb54d81e60e04e9f984d0f8e5c158c48fb1c87620cd62

SHA512
577c91830944f4148adf5729efdebe17c5943587807e1fd5e599126c2cec2a66c0ca0f5cc1add120d3d779374fa00d180450b5649418b673726191caf82f7d28

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g

Filesize
1.6MB

MD5
cb24a6c4d91a05002e4396d94936d9eb

SHA1
7391cd105430e2017d9bb22b4823ea400f34427b

SHA256
d9e95c193a3ffa0c2e621425c503031c18afa77f3e90cfccb9ed817458838888

SHA512
17923ca572625866d4aaef2ba57e7965638ab5a09d645f4660f0797a6dc6bf38199320e5d67f8d247e78fa30c0252abbf442baca539333d44a008e21a9b3de9a

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/gUIHgfIk.yTyp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/tmp-base.apk.I8Tuf8H1408903542183084613.t8g

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit