malibot | b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52

Analysis

max time kernel
2201371s
max time network
157s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
28-09-2022 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52.apk
Size

2.3MB
MD5

0533968891354ac78b45c486600a7890
SHA1

4e9bc1bcbeec32ad93762482b9e1295c7f1bcee5
SHA256

b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52
SHA512

cdf2fcb3d7968b113563b602a476e54bdad4bf30548492941d7d18072c4542007c0f29dd2174ce1cf196c0369651788dc01e5d9f8d5ece9fa0aeeeccdf7348ce
SSDEEP

24576:JbuUHfXVoL6D8RyE2cZBGUMfYm3At+y6/DA4kf4TyQ0jPwVCnY4DDMpkghSUPFE+:JqKlomDBy+y6/DPkQzuY4OhxdEuX

Score

10^/10

malibot banker infostealer trojan

Malware Config

Signatures

Malibot payload 3 IoCs

Processes:

resource	yara_rule
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	family_malibot
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	family_malibot
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	family_malibot

malibot
Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.
infostealer trojan banker malibot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.gdwicoopc.mlwmelkys

ioc	pid	process
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	4750	com.gdwicoopc.mlwmelkys
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR	4750	com.gdwicoopc.mlwmelkys

com.gdwicoopc.mlwmelkys
1⤵
- Loads dropped Dex/Jar
PID:4750

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/.com.google.Chrome.CZ5rwM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Cookies
Filesize
64KB

MD5
9b23e6a88d5a95f155f205cb04b93cd0

SHA1
b62dccbbef087a0731f226b96d15d35d8aa5e5fc

SHA256
f2f3c3c0c7f085399a6f9a464c1ac30a59ceeb5a4b7026286fa5609e6e8ef857

SHA512
bce5f25d98e2e8296c4101b62082dcb6a43902f3431ff6f725e41be6b9aece76e887ef94c4818baf4da845708fd76fd51c37fb6915710c870647593868f27482

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Cookies-journal
Filesize
1KB

MD5
2f5d22d520d7b94549b86af519fdc790

SHA1
7ad88020a1ab6ac3b734b944805d2814258d79bc

SHA256
fca8f5252eff064d4331765dbbdd552cffe7452c2f61350123b11d24db5f7e2e

SHA512
eab86ae689e52a6b105d90fe1f498c0080d3e9a7315955c26867b75893369c5545940de7d9589de31c65e5eba84e6b03cefe4f26ebebdea0cc9582e7f9ebea77

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/GPUCache/index-dir/temp-index
Filesize
96B

MD5
e0798fae5defa891c3d26695111d6f3e

SHA1
a4cb64a8e1ae7fb19caec5b84ad52f14606055cf

SHA256
1c2468d123bbc74edcafdf4a5fd3c774d9460ce72dc30982a8ea9bdac5ea0836

SHA512
57b5e5991fe729d1ccc88d36da7a4bdb70b603d8e1c5950fb1c11819f1e0acffcbc8d545fada63819147d0785027ff48df0db4cae5669e952f98131b66899a7d

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Web Data
Filesize
112KB

MD5
b663831f8cc130493476d94f2d7a5330

SHA1
043a1956ab8e40821d67043f8a9110a8eb36fb93

SHA256
c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

SHA512
e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Web Data-journal
Filesize
1KB

MD5
1f49d6b0bd05e41f98a2ccaa84ec547d

SHA1
8bee2163fa24769b7b362e2aba00cce89057714a

SHA256
789e157dbde37738d75e77cda73185e4182794d924ea6cfd8dbf1ab6bafb98f6

SHA512
bcf372489a3b2a3b23f4b94983e4b0560f6accdb816a47159d8a17898d3bb5430003e7cd958b739c828176a524d4a2d0f4ed5fd2be382ac98b7296352875c70e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/metrics_guid
Filesize
36B

MD5
e5347b971b934fd43543f299b047a7d4

SHA1
9332dee55cab12d10a8d1be54329ed41ad9f43e1

SHA256
f54dc8c9ed129e2de964c994cf943d816542bfb21dee3d5376e5e32ffc6a6ef5

SHA512
26a38dcf73da48d687d26b707f941cdeee20ae3df258dbd371acdf050019e25707d8281d9ac02993624a95166b026fce5073b26ccbdb3a38a6a0227eae0cf31e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Crashpad/settings.dat
Filesize
40B

MD5
e5d10812438f9e4e0bc0501a0c702e3a

SHA1
a476985a93f11abe5139d2d1c3dd21ac12dc924e

SHA256
0ff7c0b19fcffc63200904c5407f60030e37efb2bbb730e20d8f3e388cb4ef24

SHA512
7a38147197f2a974df6fed78912d34614315a328464db80c5f993845f28fd00843db1758abf5192627029d8618953f9c5e560e09a5ae2dbf5b32f0be41d046cd

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/6f03d1e54403232e_0
Filesize
374B

MD5
4ae4e2a79baa13acda809fc8e2813945

SHA1
de74bb7635c0dff0959a0a1ab18a4c8b9b7a0f88

SHA256
d0b914732b5c3470250eb7816f58653d3a5c979eb83b5a361480d6bd2cd9a51b

SHA512
3aaf704bc65ee5cfc7026a920d1dddd9143b10b5f7edb17964094fdb81e3a5e4fba178987c6373ffcfad2d9e96a07d30ae647a3863c7d6005ef9c77a238a8e81

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/6f618348479ca997_0
Filesize
522B

MD5
e9795547cc00ae409411e82ca1903f10

SHA1
5ed9899380d9cd15f1f500a45ede21ae652c162d

SHA256
585271e019a36961156dbee396c65fff31c87c30b59b082607958f8b7aa31a17

SHA512
ed3f425bb718a2636c3df681d25772658c0eef8be19506a5741fb16f543e09fbc70d25f45a8a3980a2f5c7b35b52c6f7333d40bac32a8c0641ca955966367e7d

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
314f90b7f00e4154d789870811f7d0d6

SHA1
a1dfad934a041a42e716330e48bb118e554ed57f

SHA256
2ded1e391c84fe1bb8f3b61b7132853ac05a7c0add5198aee0ea2110b35d71e4

SHA512
8d2cc3baf8d305129a2db5e4c9122af6e9608a461b518fa8e15f0333672033c69c9c841d2ac0a5e933500bbef6a2d55114bea995ccbf636a673f5e249c7e8d40

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index-dir/temp-index
Filesize
96B

MD5
548ceaffe863ffe5419e9cf6f50c0dde

SHA1
aa919730e5f2d6cd252d9f52d5ab829aca5c0e6b

SHA256
eec6f55f47acebb54f67681f9ea8363d694a0a13eed567976cb05d7f103373a2

SHA512
a3940e0c7f3018b3e037251617c1cfcb74c095ec1510418be1d11535c1cec7c4e8ba499a487af12558880cd0f4d9be7f679bc59b6a5a4588dbd5ebdb4786ff50

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/cache/org.chromium.android_webview/index-dir/temp-index
Filesize
96B

MD5
6964d14eb271da652cebbbccc6f6e141

SHA1
9e07b42efb6c9626b95d0737e3fa8ba4b2b69be9

SHA256
a425608560b36fb0d8dde0dec2d44832f916e6a64c634443c50eb00b69c04c1b

SHA512
148df55095530eb049b0ef899e5dcb4843e48f8b39a300fe8f3994bc56164c92f5c559de0dab66032dde64e24d8b93d21d8fe7d63729d5ba2740dcb9aafad890

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
6ef709b8536878951e87c29a1518fc2b

SHA1
24376c70b00152501b3d98df61fa7db435339172

SHA256
10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

SHA512
96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

Download Submit
/data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/app.xml
Filesize
121B

MD5
34cfb8689ac2e07222398a7f8c2a5409

SHA1
f344e34b44c9b0e5988d57b98e24eee633f1f784

SHA256
408a9d58aaade561ec8a541919f4704768458775cff2277cd7c91cf2aa71b2e1

SHA512
f4d3e5b9d614e23558ff36645a89a1661bb2567a9480146f198b1e85c4e6d4fdb59cbb0312c74c8fa9fe27bcdf017be1fd11dc52a7c5a2e3874a338b8d5f307b

Download Submit
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR
Filesize
716KB

MD5
20523fb5f80852f7d03b9ca83d6d62b7

SHA1
9423b1f76829b6052918e6346b58fd69782612d1

SHA256
dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4

SHA512
0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

Download Submit
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR
Filesize
716KB

MD5
20523fb5f80852f7d03b9ca83d6d62b7

SHA1
9423b1f76829b6052918e6346b58fd69782612d1

SHA256
dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4

SHA512
0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

Download Submit
/storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR
Filesize
716KB

MD5
20523fb5f80852f7d03b9ca83d6d62b7

SHA1
9423b1f76829b6052918e6346b58fd69782612d1

SHA256
dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4

SHA512
0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

Download Submit