Overview

overview

10

Static

static

7

ndQOhY0ypd.apk

android-10-x64

10

ndQOhY0ypd.apk

android-11-x64

10

Resubmissions

13-10-2022 15:48

221013-s89f5sbhen 10

06-10-2022 16:41

221006-t7h38sacan 10

05-10-2022 13:53

221005-q667wseeb2 10

31-08-2022 20:23

220831-y6g7rsdba5 10

31-08-2022 20:11

220831-yykb6abbdk 10

31-08-2022 19:40

220831-ydqy7sagfk 10

31-08-2022 17:36

220831-v6tzsahdgm 10

31-08-2022 17:32

220831-v4htqshddn 7

Analysis

  • max time kernel
    4110650s
  • max time network
    602s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    31-08-2022 17:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ndQOhY0ypd.apk

  • Size

    5.2MB

  • MD5

    ca559118f4605b0316a13b8cfa321f65

  • SHA1

    5ef4d5784738d79f22f9bc5e8db7c94985bc1a3a

  • SHA256

    3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054

  • SHA512

    091f07d51e9d7c924666f28a30b03e5ff887e239ad2ed9a99cbd65e7b9350c6fc89cafdbbe05de27f8ea6dc90ff8484c1b692fc891b58fcc6104fa6878e8f3d7

  • SSDEEP

    98304:+Ld3yR0X7GPzP21DeReIrJ0jJMooanGHNdyc7scnuB5k9MWdU:+LxyR0X7Qz/diMolGfyXcNMWdU

Score
10/10
malibotbankerinfostealertrojan

Malware Config

Signatures

  • Malibot payload 1 IoCs
  • malibot

    Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.

    infostealertrojanbankermalibot
  • Makes use of the framework's Accessibility service. 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.slhytrowb.wfxaicaiw
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:4522

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Cookies
    Filesize

    64KB

    MD5

    dfb2098ca7b3bf16d6f5f1e7d3839af5

    SHA1

    ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

    SHA256

    e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

    SHA512

    fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Cookies-journal
    Filesize

    1KB

    MD5

    066ea6f7f3a8bc2e6932176f84e700dd

    SHA1

    9ee3a37f87940428f87498998b19fc6fc6a6e993

    SHA256

    813a67c799d82a59579b26ebfe18a31a586b455bea0d42477273b1ee52286af6

    SHA512

    b87833ccbd5932aabd532fe9c3f0a78cdca65907a0151be02459be39d053dfe011cd6ed50280c46c2bf7df3a867f9b120f8662bb43bd3e31ebcded6a0866bbf4

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/GPUCache/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/GPUCache/index-dir/temp-index
    Filesize

    96B

    MD5

    d4fbb117f8b8c508863f394c2fe94deb

    SHA1

    869f9f57af320bfbb253e9fc4bd38893bac5235a

    SHA256

    14e83ce97b8a77d5cf08b3f9f4b68dcd961e96434f2c8bd3c9e7c8967ab1cd53

    SHA512

    538fbd39810af9003215d6a7e4c89a5910312b5bacebd78ac6003ba877200fa18f84a36c1208d13c54d757aa5ac9980079a72bb9e3ea505663911518a8d77c0a

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Web Data
    Filesize

    120KB

    MD5

    a48cd9324b1f8754b07f00d863b840f3

    SHA1

    11c6614775b35a58f440971dfc87c8aaac6d6173

    SHA256

    8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

    SHA512

    35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Web Data-journal
    Filesize

    2KB

    MD5

    64fcf7f40a617d10f06240ee4821c1a9

    SHA1

    8bec6d68d170d8ee712d91481c17268998d6e4e4

    SHA256

    0a0c6840fae9d606b03420de9f8dff716c120352945264efaa3a6fb367648f98

    SHA512

    6e3b329c6a1e0f727e562e9a99d00fd58dbcdb547627580334acdb2f3033df233c8dc2fcb3a2ec64965f62f11e39be8e8acad131926de856cd1727cc5cbd5845

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/app_webview/webview_data.lock
    Filesize

    29B

    MD5

    22a7f49647e10c35540543ed48bdad1b

    SHA1

    18362fd6b85af07a8ca1e32e8f73c7fc34abb41d

    SHA256

    a652e4809b8f7853aacefafae10720e9cf8ab7d2e7960e17fca1ac0cdab3310e

    SHA512

    012d936f078b33acd8d776ac9d546eefecdc87b0c0c067561c431cb75f77ad34f17382cbe82e0f2aa2e99c07520d1d2c4b334348b262b02ac312a837f4596f56

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Crashpad/settings.dat
    Filesize

    40B

    MD5

    6997f9d8c1c6b4049060202f7e89ee09

    SHA1

    7fc8ad8c99f9761643d2064ea98467c8ebc398b5

    SHA256

    82217dd08323f41372e97b9ee6c9729e452adce0b5d06c8466f4b58c581cf2c7

    SHA512

    7c3408685b26a78a4bed9de7ec9f19fff6d5019d1ec38b42be13b4dba77384c8db77dfd1b4e874bc7ba96acb7fe2ab9af67d47f78cb5164559aabb1fa9ae1f2a

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/34dd37a88d836e5a_0
    Filesize

    338B

    MD5

    410804548bff6c6a723cce37af8c4a4c

    SHA1

    e595b9812dc186e4655e18bb41a47c951d0ecd5e

    SHA256

    016a2f54ae560aeb60cdf6f66a86f29f63a33aee2247c092fd00e4fdf0e5ca3b

    SHA512

    28ea106cb35bdb2f4a215e716d250df13a1f9d7aafd7595e803590fd766c3d0dccc2ba11b9c36712ad29e41c16bd9aead0d80c1864121364beb600c74b835385

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/6e9739198c241f7d_0
    Filesize

    520B

    MD5

    40400ac69e7f3fa9a36a392772b4f517

    SHA1

    2e5ee597b5ce48d201cc62cafb103e1193d4b9b9

    SHA256

    ffe58c8a3f6309820d8235e74c6fbcd5813c385f848cf03c031cca2ecc691a90

    SHA512

    8d80131a81f916c07411f925158ec14f31ba70ed5c3e155ce9937ae60a620ebba2ddc6e96f2c7390d45164ea1543f51c2edbd61011547ebb2c0e7d0b58d232ea

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/js/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
    Filesize

    96B

    MD5

    e0e12a7024c6af19e00931a24bb75485

    SHA1

    9066e2e2a97376424893d5e5a017cafeaa779ea4

    SHA256

    0e88f7d17ee9e786239079763b68cf93d8c9ac9d4c9a84b1d3ecc8dd41db0045

    SHA512

    b4431149a1e7ceb8365503376a06c2b97e66148495ebfa7f3058be0b302491e4ef6442f103c298d68745ff466bffb8fbe0d987a7ba6e3165b36bd4ffb18493a9

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
    Filesize

    96B

    MD5

    e0e12a7024c6af19e00931a24bb75485

    SHA1

    9066e2e2a97376424893d5e5a017cafeaa779ea4

    SHA256

    0e88f7d17ee9e786239079763b68cf93d8c9ac9d4c9a84b1d3ecc8dd41db0045

    SHA512

    b4431149a1e7ceb8365503376a06c2b97e66148495ebfa7f3058be0b302491e4ef6442f103c298d68745ff466bffb8fbe0d987a7ba6e3165b36bd4ffb18493a9

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/ec384f68bcbe9b61_0
    Filesize

    340B

    MD5

    53c748b8d3078e77ba2255d6ca2bd047

    SHA1

    6c6d53aea5f4eb4a34653b0ecd8a4daeb0563c40

    SHA256

    3758f4b77fa21acd115ad8711d41320735d07c5b4d4363970444ac9f423a480a

    SHA512

    b8efc7d6a1e61490dc9515293ca2a7ae28d125dd447ff8b0d8f1e08f2da889148df4f85560316932f41841d014f27a7a7d733d60a344edec90050d96e806853a

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/index-dir/temp-index
    Filesize

    144B

    MD5

    0615e3f0ecd48a5512e42a31f2bc6c51

    SHA1

    4631f6c7edadae0539d9b34cb7c0e4aeaafce0f5

    SHA256

    4994311ac79ecebc9387763f090da40b78a541954b9378328563c7de62299676

    SHA512

    e0bc495d35cdf1d8569d059e852ea96d93907173b033f7cc24e40ae947c3a8971ff2ebe7083d17ea717de65527950df62fdd4b63d593effc5ee170dd5ceb46cb

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/index-dir/temp-index
    Filesize

    96B

    MD5

    2361fda1a6c5909d0787a022a747f572

    SHA1

    f886a0e9873fc4211754e9e8296b638e64830c57

    SHA256

    b45f6922262f64959d91eaa23c6a4ee392e968a15ca74ce3a1f57492da7fa04f

    SHA512

    9df127de3414adc3946ff092d33bc4021e128773db54e6fed07364fe4cac50c0c485c6ddb525008a3f4bb8360173e2f19fc29d982808d9ae32339e4173900778

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/font_unique_name_table.pb
    Filesize

    57KB

    MD5

    f080fa2a56ab5479d58063e5ea871447

    SHA1

    4b3fd57a98916fa5784305b76ba30af26b5253d9

    SHA256

    0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

    SHA512

    8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k
    Filesize

    1.7MB

    MD5

    2426b919cdc0753cfda937d3a87d6226

    SHA1

    f258933ea1ecdb552475032b89fc2b3c83e0e6f0

    SHA256

    e7c8f9bacba13bdadf4c74cf356dc7734b0a269bf1bf02695fbba37f87eaeb98

    SHA512

    2cbb1dbee4a7d8bba818b416b7015ba5128cf77b9ba53906fd6efc2940ee71341e62292a79e43eaaf061a6cd4c21a96893354ab4b8b54e35708b768de5fbf21e

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    97ccd9a2b2063143df56b6937f961ca4

    SHA1

    5e78a91ae5df289ce83443cb7d5589dd3504fb5d

    SHA256

    248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

    SHA512

    86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/com.android.launcher3.prefs.xml
    Filesize

    128B

    MD5

    20837fd8daf2a2de8d6c4ccd8e90653a

    SHA1

    7ac08617bd4585151c239325aea243d9eca586f7

    SHA256

    e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

    SHA512

    a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

    Download Submit

  • /data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/multidex.version.xml
    Filesize

    307B

    MD5

    04725f9de0eb4d4a1197cf98dcfd9541

    SHA1

    1dfddc08e60ca61bcd6674c2ebd8e5cc9b3cb4f6

    SHA256

    fcf2fefa96c1a0620a823b5e325dda4cbf266ea8e02b0c262fef0b301008a943

    SHA512

    206e8cf192b432e07e49d416d7bcf6a3ecc30da83a29e5f2268b285c1280bd8366d27bb66339aa0f9f61168f3081dae747b120bd766ba6d0b36c174469b699b2

    Download Submit