malibot | 6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1

Analysis

max time kernel
2240836s
max time network
172s
platform
android_x64
resource
android-x64-arm64-20220310-en
submitted
21-06-2022 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1.apk
Size

3.4MB
MD5

c9ddaa4d670c262bf2621b8299ccf84e
SHA1

8773fe52563b9aa22909e53671d99d1277427f87
SHA256

6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1
SHA512

786e56c8011f179f96b489b7ad8f97185194ae3221f108ca5badb6aef3007d2f54ab3dd3ac4c43290b8dca0cfacb9d4387c7dd8099823a4fdf1b54069abd77f9

Score

10^/10

malibot banker infostealer trojan

Malware Config

Signatures

Malibot payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/6668-0.dex	family_malibot

malibot
Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.
infostealer trojan banker malibot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.wjyfqwzhu.fbqipukbm

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.wjyfqwzhu.fbqipukbm

Acquires the wake lock. 1 IoCs

Processes:

com.wjyfqwzhu.fbqipukbm

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.wjyfqwzhu.fbqipukbm

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.wjyfqwzhu.fbqipukbm

ioc	pid	Process
/data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/base.apk.j6jU8Ug1.gdf	6668	com.wjyfqwzhu.fbqipukbm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
53	icanhazip.com

com.wjyfqwzhu.fbqipukbm
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:6668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/Tt8kFkTi.hFoj

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/base.apk.j6jU8Ug1.gdf

Filesize
495KB

MD5
bc97bcf8dd4f7a5a6bf5ff093cad5f37

SHA1
026e094dee541cd465d0e07b32ccdfd6b1f85cb7

SHA256
4cae15ba01d4a21bcd4ce7a390cd58fd8a325c19ee9069adcc474b97d186535e

SHA512
7373f5c72e9135c70f57db86e940b28e95e51cf57ecb34fe6b5ebf9b8328bec122c3c1d88635906e6c519afaeb3c276d9b3f6a4d50fe018c7a8f83e053f29dcc

Download Submit
/data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/tmp-base.apk.j6jU8Ug8070000500838125167.gdf

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.wjyfqwzhu.fbqipukbm/shared_prefs/multidex.version.xml

Filesize
307B

MD5
25775322b4f9c9595e9071dc55e7ad7a

SHA1
5712ebc23df4329bc3c38a6b9506c700b58752fa

SHA256
989626423ebd49bd5e6a787d23ea9887273b5cfa2587d119a28296f37dfa5d2f

SHA512
af4a49338b30c53275f39af53edb94c88dbbb6aaa0c033fce43a8c8ac2035ff7514d0d13f06428506e0f2ba0c5c8ca9ef3e8afc50d717b362cf1eb0e70167ec4

Download Submit