Overview

overview

10

Static

static

7

6d1566ffd1...d1.apk

android_x86

10

6d1566ffd1...d1.apk

android_x64

10

6d1566ffd1...d1.apk

android_x64

10

Analysis

  • max time kernel
    2240832s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20220310-en
  • submitted
    21-06-2022 09:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1.apk

  • Size

    3.4MB

  • MD5

    c9ddaa4d670c262bf2621b8299ccf84e

  • SHA1

    8773fe52563b9aa22909e53671d99d1277427f87

  • SHA256

    6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1

  • SHA512

    786e56c8011f179f96b489b7ad8f97185194ae3221f108ca5badb6aef3007d2f54ab3dd3ac4c43290b8dca0cfacb9d4387c7dd8099823a4fdf1b54069abd77f9

Score
10/10
malibotbankerinfostealertrojan

Malware Config

Signatures

  • Malibot payload 2 IoCs
  • malibot

    Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.

    infostealertrojanbankermalibot
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • com.wjyfqwzhu.fbqipukbm
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:5137
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/base.apk.j6jU8Ug1.gdf --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/oat/x86/base.apk.j6jU8Ug1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:5166

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/Tt8kFkTi.hFoj
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/base.apk.j6jU8Ug1.gdf
    Filesize

    495KB

    MD5

    872f9b80fe333bf5071776c87a9d4823

    SHA1

    d5ce703ea75c52d83b429b77dc19f4fac31b7b87

    SHA256

    1d53bf4587bba9c6e17feeb45b9406d881658d2f052e09af5525ae95c94a1077

    SHA512

    37765af20da0e6f24778fbf7a1651139fa9e491941386c2d4a605df575580a699499bebfbbe4a5ce39483c6c66efe7994a32fd3e8e1e508384e19ad141dbcbff

    Download Submit
  • /data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/base.apk.j6jU8Ug1.gdf
    Filesize

    495KB

    MD5

    bc97bcf8dd4f7a5a6bf5ff093cad5f37

    SHA1

    026e094dee541cd465d0e07b32ccdfd6b1f85cb7

    SHA256

    4cae15ba01d4a21bcd4ce7a390cd58fd8a325c19ee9069adcc474b97d186535e

    SHA512

    7373f5c72e9135c70f57db86e940b28e95e51cf57ecb34fe6b5ebf9b8328bec122c3c1d88635906e6c519afaeb3c276d9b3f6a4d50fe018c7a8f83e053f29dcc

    Download Submit
  • /data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/base.apk.j6jU8Ug1.gdf.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/oat/x86/base.apk.j6jU8Ug1.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/oat/x86/base.apk.j6jU8Ug1.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/tmp-base.apk.j6jU8Ug7210518521168857769.gdf
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit
  • /data/user/0/com.wjyfqwzhu.fbqipukbm/shared_prefs/multidex.version.xml
    Filesize

    307B

    MD5

    f58b08cf3333a600f3fb2e7fe9671329

    SHA1

    f3e0b34e18f6fb2fed0b17799e321a7f7083acc8

    SHA256

    e111cb291563f03b2c26d56402832fa1791cca07ca120d1fbaf7453591dc9774

    SHA512

    c106159116e4b0374f9da1861b5d6d27571f06c725f2273e0077108551c0a91c5671cdb636cdd7dc623486f7ccf8973b03cf8d2335a5b52cc70ea8d761c6f23d

    Download Submit