malibot | b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52

Resubmissions

06-10-2022 16:35

221006-t3xqtshhe6 10

12-08-2022 07:30

220812-jbsyfsadar 10

Analysis

max time kernel
2432186s
max time network
139s
platform
android_x64
resource
android-x64-20220621-en
resource tags

androidarch:x64arch:x86image:android-x64-20220621-enlocale:en-usos:android-10-x64system
submitted
12-08-2022 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

B01B74AAF249D0740F541C081C0C0DE4BF455B4B68F2634FAB6CF8AAFCD95D52.apk
Size

2.3MB
MD5

0533968891354ac78b45c486600a7890
SHA1

4e9bc1bcbeec32ad93762482b9e1295c7f1bcee5
SHA256

b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52
SHA512

cdf2fcb3d7968b113563b602a476e54bdad4bf30548492941d7d18072c4542007c0f29dd2174ce1cf196c0369651788dc01e5d9f8d5ece9fa0aeeeccdf7348ce

Score

10^/10

malibot banker infostealer trojan

Malware Config

Signatures

Malibot payload 3 IoCs

Processes:

resource	yara_rule
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	family_malibot
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	family_malibot
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	family_malibot

malibot
Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.
infostealer trojan banker malibot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.gdwicoopc.mlwmelkys

ioc	pid	process
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	5987	com.gdwicoopc.mlwmelkys
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	5987	com.gdwicoopc.mlwmelkys

com.gdwicoopc.mlwmelkys
1⤵
- Loads dropped Dex/Jar
PID:5987

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/.com.google.Chrome.27BfZU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Cookies

Filesize
64KB

MD5
9b23e6a88d5a95f155f205cb04b93cd0

SHA1
b62dccbbef087a0731f226b96d15d35d8aa5e5fc

SHA256
f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857

SHA512
bce5f25d98e2e8296c4101b62082dcb6a43902f3431ff6f725e41be6b9aece76e887ef94c4818baf4da845708fd76fd51c37fb6915710c870647593868f27482

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Cookies-journal

Filesize
1KB

MD5
991db0001d55e32b715a1107bb530696

SHA1
1b0cef3ccff080b85f213cfa428e25d2ac73d1d7

SHA256
3e60ead4d8bd0dc7a0bee882701be87aa049e2582be8551afdddbee7287077ef

SHA512
2a45f022525db3e823c26b73b6317567ac1342b11c3b66be24cca5a4d66d9f5af6e9d96da56412f06f44d221ec5991308859eafa5f01d444bde2870a8e2532b8

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/GPUCache/index-dir/temp-index

Filesize
96B

MD5
59b4c9cb3f667667ea0fcf0a3a07cf2a

SHA1
4d7d71928ee89b85a506bb311195ffe4bfd8a447

SHA256
cdfd4e33c222e25f9c0752c1b88cdecbce1768245b739291c387836c5db55904

SHA512
f015f488e146f479e4adbf50c44fdaff27148a79711559ea13aee2fe53f4736aabd930be41877ff7e4d690207aecbe5dfcda1ebd1cbac81f1acb37ffb43577eb

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Web Data

Filesize
112KB

MD5
b663831f8cc130493476d94f2d7a5330

SHA1
043a1956ab8e40821d67043f8a9110a8eb36fb93

SHA256
c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

SHA512
e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Web Data-journal

Filesize
1KB

MD5
0dc1f95a882a535d6aa6ca815224d4d2

SHA1
953d6127765d020a7964500af0e7a7160d2f3380

SHA256
d5eaa364fbe8dfef6f2aa276db615e658fed38ddb8d3050049381c042ad84607

SHA512
d572184c646565cfe6eb598072d29420fe22bb6a752116a7057c127556e661d444917baab81906c5efed50757a9e95d83b16f2ea4c7a1d03711fcc07c4b2b81f

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/metrics_guid

Filesize
36B

MD5
5a409724feb22214d9a0bc77b34be6de

SHA1
c700accc37faad176045f8a3e7da291193e840b6

SHA256
64a46e6aac3f885f3da32e41230b3c85a47a66f594b5c289d26a734a6975db66

SHA512
bb1cc81b701bb3c05f6f800374cd24b0408832f0767daf7572d84074339804e9eb9fc9a66179637f3f366e58e383e6b104b73e2a7049e3cd2fbeaac8f9a8a74a

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
5e775671203a7fb278d3e35b60eff34e

SHA1
8c5006ab4b0f5a661bcfde2f33802d5311a13d79

SHA256
ad66e7702458e9f1a1e3b1e252f0dcf4bac7ae4da5c7c316ca5d99181eb482dd

SHA512
ea8223be943261d2ff72c537fb4f8351c154dcbe81eeb1faeec349f1bcc8430e43d4f4b7ad3b797cdf9c4a97e42652ea9289baae5b9c03f4a1a686013bf26129

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/56a80b25d4a8477b_0

Filesize
522B

MD5
95c7d0955062f559d71c6cda421e7ea3

SHA1
7a5012a2703079d036df96649e097eb7b1f5ba6e

SHA256
d2fcc06d83381b9fdfa6e50b0c467034b810040b8d0b42411a1fbe43d98cd1c5

SHA512
ee129475f6694f882e4fc41bf5b44cee315eebb40ade264fb03e91f270fa4522d04212f60b519711032747371fdf781fe12119c0c806fe4bf6e1084cb5d7af57

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
f1b060c3ccab4c0611a3efdf6037d517

SHA1
865983d82442e47d22d2e1f43b5d3fd61ce75f12

SHA256
0c7110a9d7c4d85b32f660d2d357bea972f25d41332a5c203d6c15edfe4d27f5

SHA512
1b8dba7830c5c38383459fcc2636eb635cd98cc90f99d50c31b53e717374aa16372a428dcd54301310075b9e511468675bbc7788961f8ded7e3e1838d7e8cc00

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/c8c6eeecef2c687e_0

Filesize
374B

MD5
f4485c5d7a7bee82a08d052856f8dc28

SHA1
489abef3670fa6ab2ecdde87a9cc78fe117bb3a1

SHA256
072acaa52e949f104d72cf0bb8d49d44d792821324163a05b7b8276ae0719a51

SHA512
20017d472856952e5e09d449438c5c9ebcb006dce00113e04753ba9719222efb7e51df9e54e8bb374a93086066d5cfbb580f38841826e93449b34ee8bbaa50ca

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
96B

MD5
812a59e394711a6bec39200faecb03bc

SHA1
2cd9026155b6b39d42ab472712fa83fdc6e4a522

SHA256
1d75b6f8a95de32e3f0c673691a6334fe7a15341fa3662328e2e49a1ce21a361

SHA512
d42465554154d0f34e1feaed640bf3793ec4f943449f14aeb7964f7668b7fb39f9ee798c2e44d9eecf2b8baa252e0790140f1302dd1a25ea556ea979ec39a20c

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
96B

MD5
a4e0ce03ff03383e28385041fdb848df

SHA1
5a1c6109f1e9fb0bfb07f6e1362d16530109e7ee

SHA256
8e73727ba99bd66a2ac2427edc89ec2c8039c70216809981ef2b4251304fae3c

SHA512
1cdb1bf285952af15a0f6615240cc0d520c3aa60340fc8004336a497143094e7387f0313c0d53d02b2dd29fbc1e5009c2630bdb1d2696cc33c594696d98de207

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
6ef709b8536878951e87c29a1518fc2b

SHA1
24376c70b00152501b3d98df61fa7db435339172

SHA256
10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

SHA512
96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

Download Submit
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

Filesize
716KB

MD5
20523fb5f80852f7d03b9ca83d6d62b7

SHA1
9423b1f76829b6052918e6346b58fd69782612d1

SHA256
dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4

SHA512
0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

Download Submit
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

Filesize
716KB

MD5
20523fb5f80852f7d03b9ca83d6d62b7

SHA1
9423b1f76829b6052918e6346b58fd69782612d1

SHA256
dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4

SHA512
0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

Download Submit
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR

Filesize
716KB

MD5
20523fb5f80852f7d03b9ca83d6d62b7

SHA1
9423b1f76829b6052918e6346b58fd69782612d1

SHA256
dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4

SHA512
0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

Download Submit