malibot | 3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054

Resubmissions

13-10-2022 15:48

221013-s89f5sbhen 10

06-10-2022 16:41

05-10-2022 13:53

31-08-2022 20:23

31-08-2022 20:11

31-08-2022 19:40

31-08-2022 17:36

31-08-2022 17:32

Analysis

max time kernel
4119941s
max time network
607s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
31-08-2022 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ndQOhY0ypd.apk
Size

5.2MB
MD5

ca559118f4605b0316a13b8cfa321f65
SHA1

5ef4d5784738d79f22f9bc5e8db7c94985bc1a3a
SHA256

3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054
SHA512

091f07d51e9d7c924666f28a30b03e5ff887e239ad2ed9a99cbd65e7b9350c6fc89cafdbbe05de27f8ea6dc90ff8484c1b692fc891b58fcc6104fa6878e8f3d7
SSDEEP

98304:+Ld3yR0X7GPzP21DeReIrJ0jJMooanGHNdyc7scnuB5k9MWdU:+LxyR0X7Qz/diMolGfyXcNMWdU

Score

10^/10

malibot banker infostealer trojan

Malware Config

Signatures

Malibot payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	family_malibot

malibot
Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.
infostealer trojan banker malibot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.slhytrowb.wfxaicaiw

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.slhytrowb.wfxaicaiw

Acquires the wake lock. 1 IoCs

Processes:

com.slhytrowb.wfxaicaiw

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.slhytrowb.wfxaicaiw
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.slhytrowb.wfxaicaiw

ioc pid process

/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k 4422 com.slhytrowb.wfxaicaiw

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.slhytrowb.wfxaicaiw

ioc	pid	process
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	4422	com.slhytrowb.wfxaicaiw

com.slhytrowb.wfxaicaiw
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:4422

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/.com.google.Chrome.K17GsE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Cookies

Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Cookies-journal

Filesize
1KB

MD5
a9f3d3f9e0787a1f7db319fa15fe121e

SHA1
74d33479948d60f57f28cc6d4bb3b4f7806ee5ea

SHA256
6ce71ed92bb4c618ee8e578901707396c1c949eae2fa9bd2ca6b9d96103fbc21

SHA512
4a0563af66c0a7246e5389d29097bb10431061a15045e743de39618b07720c32b8524734a60cd7c3efa2a3f14328568097054ac020347bc713577c7771216561

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
708da80d0b3680e3e59a6171031d6cea

SHA1
9207f48c68f0b49da80a941b1eb40d9fda6288d7

SHA256
6698ddd1a40e736dd35c01071fae55c70c32c9ee224bfb5ed097ae9349a78cad

SHA512
a2d6b1c92b872f53cd118f4a9454913a5f618354e1a500aeeefd41c43de96b1360e9f60357311925811dbd0005b14fd99c3c7f3bb3b6774169fbcb37e74b61fd

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
05b0d1895ea4c68e24a1e3089018f27f

SHA1
227ccb0f048e39b0ecec67ce79eebb8d9b11dfd6

SHA256
5f30baf5cce39de60a5d38d41e072ac8ddfc6245391e4c84b2cd1f6b7662aafd

SHA512
a8709b33ad3b230112fc1a61f0993f3e397b2d56e3e68dabe4b42526f927bd5db072d67a47c9bbbdfd3326130e5ec65f22fdf1cdda7456b570f3f55423e018e0

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/webview_data.lock

Filesize
29B

MD5
fc701c10b1b47e33411a469c49bec658

SHA1
9a27f210ad7019336dd939675620c2abff852536

SHA256
b3f2b1e06e8311306354eb1e1ab38234a420e3fc53e43d5730c2e2e0038c665a

SHA512
a290a2d64842342c7c90e177a4805dd2b2efc4062fdb9021553cb33fb022bc17b41353b3a719206c59573482ad36b95d49c036e617fb3689a8a5c9e4aacc38e8

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
f945661606444b6f17d4c88265d2f74e

SHA1
f63dcb8cc8da475d6ba15211ba08e509b37e192e

SHA256
aa834112a72c5d84fd9a6b402f3fe35c5043d379a81895f8b2a80edf31765af7

SHA512
615938443449bdd531fa2f012188eda13b29f2f6736f8d24a28b790511bffb9534d8fe2e878ec40157dcac5ecf4db13998821cd9626ddf1870302e90cc6968f0

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/34dd37a88d836e5a_0

Filesize
338B

MD5
410804548bff6c6a723cce37af8c4a4c

SHA1
e595b9812dc186e4655e18bb41a47c951d0ecd5e

SHA256
016a2f54ae560aeb60cdf6f66a86f29f63a33aee2247c092fd00e4fdf0e5ca3b

SHA512
28ea106cb35bdb2f4a215e716d250df13a1f9d7aafd7595e803590fd766c3d0dccc2ba11b9c36712ad29e41c16bd9aead0d80c1864121364beb600c74b835385

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/6e9739198c241f7d_0

Filesize
520B

MD5
40400ac69e7f3fa9a36a392772b4f517

SHA1
2e5ee597b5ce48d201cc62cafb103e1193d4b9b9

SHA256
ffe58c8a3f6309820d8235e74c6fbcd5813c385f848cf03c031cca2ecc691a90

SHA512
8d80131a81f916c07411f925158ec14f31ba70ed5c3e155ce9937ae60a620ebba2ddc6e96f2c7390d45164ea1543f51c2edbd61011547ebb2c0e7d0b58d232ea

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
18be25f21c2b466cfa3304b2b4bedc8f

SHA1
f5c494488397cd23d65974614a85c8003115d045

SHA256
ab2179551bbc5b932991e60e3452402e07c0cd2ceac1ffcdfb6715e2b88643e5

SHA512
61507363971810f0949b8e2093784acd98c1e3c7961d030de3ecd65e35c8879aa4de7bf0a3d6c6edd19422be2e54a6549ec3113654dc71466c483c10824c8e21

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
41535b2dd0d8e21815c2a53e50ee9860

SHA1
797019880c2d4d6d757baadab516bc5767b3702d

SHA256
1c9095cc2b32af0ec1a0b22754f3accc6eb4e6d336d6dc558abbc33f27e62061

SHA512
7616abb44350301fa5de9cd7615f35576c864f3f7225a6d035779dba46f6903752032229ef20654f0a654a523ead6ad44dc59a14e3c6a2291831bc8b1d1c5707

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/ec384f68bcbe9b61_0

Filesize
340B

MD5
53c748b8d3078e77ba2255d6ca2bd047

SHA1
6c6d53aea5f4eb4a34653b0ecd8a4daeb0563c40

SHA256
3758f4b77fa21acd115ad8711d41320735d07c5b4d4363970444ac9f423a480a

SHA512
b8efc7d6a1e61490dc9515293ca2a7ae28d125dd447ff8b0d8f1e08f2da889148df4f85560316932f41841d014f27a7a7d733d60a344edec90050d96e806853a

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
144B

MD5
f32f796e18a8fce628027eac6251a2aa

SHA1
816293220449b087fc06447f81c2c1ca1764184d

SHA256
43d2c79f98b45cfb2ffe59154f7b7327758a8a65f33eee039edde747dbea1f2e

SHA512
1c23891894454446e5830dd09ce27ea55d3fa7200b038599928d03dbdb5d81e59cd6dadf82afaaca5416cee5d33f5199efffb15d679f5a3c0321343e976c3d1a

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
96B

MD5
f760f61d95c72e0455a72deda0a5a637

SHA1
494e24ce5c6c10d071ff0788732fc052ad478d84

SHA256
8d4c1302d0cfaf92d283e13f4d0d4c589643857aba94926f0b70b8031ff98880

SHA512
1f7478f3d6a104b641f346900b541568a2692793ffd5ea717e98e4792ce3c9859c6ad3a057297008d92e11f752c1a14fffbc738a1a9bb616dc1de9ecff3b77a2

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k

Filesize
1.7MB

MD5
2426b919cdc0753cfda937d3a87d6226

SHA1
f258933ea1ecdb552475032b89fc2b3c83e0e6f0

SHA256
e7c8f9bacba13bdadf4c74cf356dc7734b0a269bf1bf02695fbba37f87eaeb98

SHA512
2cbb1dbee4a7d8bba818b416b7015ba5128cf77b9ba53906fd6efc2940ee71341e62292a79e43eaaf061a6cd4c21a96893354ab4b8b54e35708b768de5fbf21e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/g8yUt8ff.atdy

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/tmp-base.apk.hkyhafI8232230895187793545.g8k

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/com.android.launcher3.prefs.xml

Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/multidex.version.xml

Filesize
307B

MD5
ecda6873fcdc2efcab8a298752820565

SHA1
d925a6419c38bb1b5e22df9afd1834396e0c0504

SHA256
0e6c6e149399b59113cf871ecd97bc8321755af35ff329ca6968156ddd10ef60

SHA512
e5ec13791d1be7dbeb2d97ddd413d60564ed36007b7427523fe8e747b2e1b63cbf6a085df6dcc4c4c8f0f941c29e2c879608148b4c0205ea0fab749f9968faca

Download Submit