malibot | 3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054

Resubmissions

13-10-2022 15:48

221013-s89f5sbhen 10

06-10-2022 16:41

05-10-2022 13:53

31-08-2022 20:23

31-08-2022 20:11

31-08-2022 19:40

31-08-2022 17:36

31-08-2022 17:32

Analysis

max time kernel
4118672s
max time network
1100s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
31-08-2022 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ndQOhY0ypd.apk
Size

5.2MB
MD5

ca559118f4605b0316a13b8cfa321f65
SHA1

5ef4d5784738d79f22f9bc5e8db7c94985bc1a3a
SHA256

3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054
SHA512

091f07d51e9d7c924666f28a30b03e5ff887e239ad2ed9a99cbd65e7b9350c6fc89cafdbbe05de27f8ea6dc90ff8484c1b692fc891b58fcc6104fa6878e8f3d7
SSDEEP

98304:+Ld3yR0X7GPzP21DeReIrJ0jJMooanGHNdyc7scnuB5k9MWdU:+LxyR0X7Qz/diMolGfyXcNMWdU

Score

10^/10

malibot banker evasion infostealer trojan

Malware Config

Signatures

Malibot payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	family_malibot
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	family_malibot

malibot
Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.
infostealer trojan banker malibot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.slhytrowb.wfxaicaiw

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.slhytrowb.wfxaicaiw

Acquires the wake lock. 1 IoCs

Processes:

com.slhytrowb.wfxaicaiw

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.slhytrowb.wfxaicaiw

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.slhytrowb.wfxaicaiw

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex --compiler-filter=quicken --class-loader-context=&com.slhytrowb.wfxaicaiw

ioc	pid	process
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	4232	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	4150	com.slhytrowb.wfxaicaiw

Removes a system notification. 1 IoCs
evasion

Processes:

com.slhytrowb.wfxaicaiw

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.slhytrowb.wfxaicaiw

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.slhytrowb.wfxaicaiw

com.slhytrowb.wfxaicaiw
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4150
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Cookies-journal

Filesize
1KB

MD5
ffd9fb5d89fcadba9a90e8a2b97035b2

SHA1
0826fd90125ab970605806ed468bb1c9d7e161cd

SHA256
764f6cc7c2416928f22e44b0f58a8124bd33cd3087e05c64b851ad3a47128b3b

SHA512
b874a3a968354e4381ae7464336b9ac4d016d5cc4f23cc6a5dccd628f3538025e9b310499c94898bfb476e7c8fc2d331854a95ee54015d8db7d65b1930377143

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
858789ba76298b8e47226f5ee2448147

SHA1
1e7c7d8965d3400580fac8e5f9d1ac74d617bfe8

SHA256
b27dd74d0829c3a653ac618f477848ee91a8248e8d333968ffdc3d87305db706

SHA512
7c289129caf973f85f29fb489aea0fa9106e00573b8a59d6e9d1d37b4259b1bdac6d7c52cfce112b14166c401852b5bc47de1b73678e839fc1cf83c229245fa8

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Web Data-journal

Filesize
1KB

MD5
c1f62d7679c0872f030cd73a5373268f

SHA1
e697d74478948277d92969d9206d727b68109b44

SHA256
6b28f605d09f9ab563c478d6077e69799e0a574f9cad84f623125092b5512ba8

SHA512
ea601352c0fddba7d015948907d900fae25c3b80bba1581f9f22d6da249ffc065c6de67fe5045ca93a79112d644fffbfa46c3adff9a3201aee267db09bf13fe9

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/metrics_guid

Filesize
36B

MD5
df207d0d7cb30d59e0ad84e3a0feb2ae

SHA1
094bacb706fbf253dad44c38d6839f98e8a3250f

SHA256
d4dd837f10dc0245ddef4fef12587aea3f0ac3d469c3d4d6c2ad8f29785ec1fb

SHA512
1bacc1be0602f2f7f084a195ec12235b2777d360623eb910bb7b7920511148234ea70deaf6fcc1fd32c944b7a04553c2bde9f26891f4641603a09b6323522d1b

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/12e363d49ccf8b91_0

Filesize
247B

MD5
15a82153a4c9505c12cc470fcf650587

SHA1
d50cf6fc1ab4d70c26df2d2e765469256e4ebd6a

SHA256
c72eb37d898dcd960b6bea7e4335f9635169087f15c7cf9758debfa27bf83dbe

SHA512
50acf7d8ecd2e5aa7b7ec6f77dd2e5fb33ff33586469b70175cfae9c7ceb8d7a14ddf6293247499727d2c15c35e93054fb88f3364359e680b8473f3e3a539882

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/d449800084ea13d6_0

Filesize
158B

MD5
2cb8b37ff7093460aab6c621c8f818b9

SHA1
9c57b205842644cd4adc1e429ed3692c094a6ab3

SHA256
9c0df6d533eb9788aad886584bf997e50881ed6dfc91b5ad3e5ac6661aeddc43

SHA512
16f8f0b6eb94282d86852d68e2651d7f821a3611336888c6ede7439c7e1ec16e9f53d942cbeb694e44ddc4c24af9b599fac55aca28f45044d7dc85ea33c25406

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/dd533a7e05389102_0

Filesize
157B

MD5
04ad8537d5f4fc0939d88c2c58acb089

SHA1
bc6c99338eaaa146f1d33e0dd84fcc4d7ce7b1ac

SHA256
845e11384c61b8592e62f1d7b61af400c15a3806c7f58a35079ed2394a8ceaa3

SHA512
9348c2e038422b88b5cb2a9f769a4ca60910473fb3a8d054c6944b8cd4cf95e498aeb5d73d11c97979f2fbaccd7197b5a9433c8a8805acafe5dbeb184eb3bd4e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
9f3fef1d75444e234304d402a2ec9526

SHA1
1802a6a088ab9d0f607c28a65cea5a8f5f54e3bc

SHA256
8a641179e0a978505725507bf33d5ad231be2dade152d0cd348b0d8ba26c6883

SHA512
88bc0730d0820f634cb1ad30c5dee5eb1b6847a88ede013d2ca853db2f1e9062abbd2d10d9af3c38838f2537e4c011aacaf2587a0fe83f3db3db82119d25912c

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
83e4742fb807599d3658b6ee36fdd5f5

SHA1
2d1c3b9a6881bcf14cc74b35f20420034e909baf

SHA256
a1a9e5a46270bf6414f22283b6b044ed011cf8f40c2f831247d0dcfef054bc63

SHA512
74a1ef64b94f67b407cf818f532c6dd9eba1dad5061f5e1274198e4a8e8abc9dc54f2915b5c38015d110dc556044b43c4cc58e9884fd5bf80826d19b664ca96d

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k

Filesize
1.7MB

MD5
d88de6e7d0da8ed1048e50a65228861b

SHA1
6354701609b3540f2b099a6834ffce83f7cff066

SHA256
4392239b7496e249c652effd92ea73f8f24a2fd0763e28c0420c774c4883ca72

SHA512
afb24a980935ab6c62341bd7cee253092053add3257aaf370854b556405cbf69e0ed3789fa56492ec39a66decbe1588cb69420dad3f5818752001d10fab87fa9

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k

Filesize
1.7MB

MD5
2426b919cdc0753cfda937d3a87d6226

SHA1
f258933ea1ecdb552475032b89fc2b3c83e0e6f0

SHA256
e7c8f9bacba13bdadf4c74cf356dc7734b0a269bf1bf02695fbba37f87eaeb98

SHA512
2cbb1dbee4a7d8bba818b416b7015ba5128cf77b9ba53906fd6efc2940ee71341e62292a79e43eaaf061a6cd4c21a96893354ab4b8b54e35708b768de5fbf21e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/g8yUt8ff.atdy

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/tmp-base.apk.hkyhafI982642892647785229.g8k

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/com.android.launcher3.prefs.xml

Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/multidex.version.xml

Filesize
307B

MD5
36c54f5fa1e78d129d1f9ddfe6b00443

SHA1
779987e94c05ecc8584c0e0ee4e110194b0e5a3d

SHA256
30f1a701154385d4dd7be3b5a23f8f8832d7a602b01a57d2b4045eb53ac81b04

SHA512
48666482b0fdc89f95dabed4164f20d04846fab151aaf9383ed56475a41ad3797c776c23bbb4617ea1b252ee088b7be5751946c7c0a82f4594d24841b6179d46

Download Submit