Analysis

  • max time kernel
    2201374s
  • max time network
    167s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    28-09-2022 08:25

General

  • Target

    b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52.apk

  • Size

    2.3MB

  • MD5

    0533968891354ac78b45c486600a7890

  • SHA1

    4e9bc1bcbeec32ad93762482b9e1295c7f1bcee5

  • SHA256

    b01b74aaf249d0740f541c081c0c0de4bf455b4b68f2634fab6cf8aafcd95d52

  • SHA512

    cdf2fcb3d7968b113563b602a476e54bdad4bf30548492941d7d18072c4542007c0f29dd2174ce1cf196c0369651788dc01e5d9f8d5ece9fa0aeeeccdf7348ce

  • SSDEEP

    24576:JbuUHfXVoL6D8RyE2cZBGUMfYm3At+y6/DA4kf4TyQ0jPwVCnY4DDMpkghSUPFE+:JqKlomDBy+y6/DPkQzuY4OhxdEuX

Malware Config

Signatures

  • Malibot payload 3 IoCs
  • malibot

    Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.

  • Makes use of the framework's Accessibility service. 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • com.gdwicoopc.mlwmelkys
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    PID:4554

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/.com.google.Chrome.TSUcyk
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/Cookies
    Filesize

    64KB

    MD5

    dfb2098ca7b3bf16d6f5f1e7d3839af5

    SHA1

    ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

    SHA256

    e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

    SHA512

    fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/Cookies-journal
    Filesize

    1KB

    MD5

    d605a14976357c4f86e2177b7f448c0e

    SHA1

    4d8285d1d3a022bbd2153fcd9bcfe567b14db424

    SHA256

    a220f04752dcbe5dcb8eedf2af5e79e6b1008ad7fa9a83de0e328fa788e8731b

    SHA512

    59dffb488b094895c216b9503ceb41aa3e4eed8326f7c40d02654f832cbe7ea4b6997db746df3fc9a819d90c3051f5c611a3be4b806261792d2dd0a0ae2cea73

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/GPUCache/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/GPUCache/index-dir/temp-index
    Filesize

    96B

    MD5

    6d1aa65dc9dd0a50fd08aab2c1a70862

    SHA1

    bcd84c1b5d72b9151b80937bc84cd9cf03e53cc9

    SHA256

    a32915d68973205f92f4e36f1dfa7a59c23356d0aac11326ae0197bf3ed090ed

    SHA512

    2a22c272eca283a0ad638b3f750b9c084798fd4e341edf9b5107ba5ad7ce03af01970d9d1988e92ab84803fd9497338ce0b76c3544444e8405dc999c858c4151

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/Web Data
    Filesize

    120KB

    MD5

    a48cd9324b1f8754b07f00d863b840f3

    SHA1

    11c6614775b35a58f440971dfc87c8aaac6d6173

    SHA256

    8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

    SHA512

    35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/Default/Web Data-journal
    Filesize

    2KB

    MD5

    d55a683d698995b59107987fcb8082ad

    SHA1

    f8a5d4c0e3cf2fcbc3bbb1b16e7238962cc339bf

    SHA256

    69fdbd56fba377c6575d156fb81f4ed97b4f61d172c91e91457d1c19656d01c6

    SHA512

    50afb3da1197245c38695c075f18f7bc1c339d5849f360b36caf81527bfad2ab1d2ae22e9de41fa5e5db0883c52de1327f34949934c8eb94259fed6bd526e6fa

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_seed_new
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/variations_stamp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.gdwicoopc.mlwmelkys/app_webview/webview_data.lock
    Filesize

    29B

    MD5

    6796c3c20277a3c0634772133ad329d8

    SHA1

    10bb89965b05c64e3a2845293ea106a20979b2a6

    SHA256

    f0ec93301a983c1786870435eb12b52d47c425c926a5a2c6b4944b48f9ebd921

    SHA512

    efdc5bf5d14a166611ff0971ce2614a1553feb7bff5211696b020eb52e389eb798d8ffaa62d3c205c2e392fc9e3a1e5f0c92d2c19d0c1708b6f4a98acce8ba36

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Crashpad/settings.dat
    Filesize

    40B

    MD5

    3c85285a9080d6d4e72bcf5bc889cc75

    SHA1

    9b3daadeabc051743e8103b0444768d7d4118b1e

    SHA256

    6f878e6adbec3080205186d432708c10c2ffb4f20dd58d2d09a854b71495d4a9

    SHA512

    141cb181daeeaef1ceb9d39af76c250226398b716327caefefd4ffa6c1894a477179b2179699625e2dcc9e401152a5bb3ec1a43d6f51f0dc6ad9f60d024ddd7b

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/566d3a0f1d25ddab_0
    Filesize

    522B

    MD5

    501d9efdbff4642458b7b7020f5ab69e

    SHA1

    ea10d4eb985b9e493356648b1aa9241cdef2c7b6

    SHA256

    10551277a8e54f50b2176dead5e9cc3356d7ea9cf3799438a6f5fe3a15f3694f

    SHA512

    baf371048ab5f07c14d37f42d82c452dd3a3c43f31bee9d2f2914c5e7c0ed7fe0d3e28c5af91dec917bd85bd98669b8b242b268d0395038233fff6c61013c90d

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/Code Cache/js/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index
    Filesize

    96B

    MD5

    19d9f2cb1f260b03bb026801934655b4

    SHA1

    8c4f4d73d0b8604c4528e4ae027d3a8b070baed2

    SHA256

    04555b1b8d23c9fb4c061d0f5e8696d402c2fa5ff10054fe6485c03d8335a07a

    SHA512

    4b8ad3a086175968d1f5184a5934e970e30dfe04b493939394632ce703fbd014913cfcbc7ca7794211759b042c3f29dbc3f8ede0caa8a9f7468c75a4f7ac6aa9

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index
    Filesize

    96B

    MD5

    7a8602a45734b55e19d039be929cd43b

    SHA1

    5a1baa76f12f8dc3c690fe7dea7d6808b0304b6e

    SHA256

    3070c5368d6b35bd3bf88f2a38a9b98e9c1d4623f386174c34f14e4f2d67cfd6

    SHA512

    86075e0e56de350e4ea17ad08d63c4c5018b6b0396d5a20bb37320a09fa85ee2f239de4da571369cba685d65edb9bda5d5c5f5429f776be2ae34c5ae1c9de57c

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/b2b5ebb9f16e4982_0
    Filesize

    374B

    MD5

    0f06e4d83626b37df54b7e24157d91d7

    SHA1

    c521f7e95dbd37e9f12bd7b64b6f2e2948a58a89

    SHA256

    ee9b4aed29b831a6d1ab15cdebc589af2e5adbed580b875a3593836afddf08e3

    SHA512

    1919a9510cd3d126a3ac834a8063da506d3f9dae8be5382fed7f868714f4b22b655ea9cba8752f0b7a6773558248a65671b695a93d68ea04867e873d27e3d4dd

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/index
    Filesize

    48B

    MD5

    6d7d499960179766cd4261d12dacc411

    SHA1

    e6f8553b0015e12b23cc551afe98763f3b1c9bed

    SHA256

    c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

    SHA512

    6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/index-dir/temp-index
    Filesize

    144B

    MD5

    064c2679739550cffcbe8f7356638d04

    SHA1

    686bd6fc2a1218527d66022754ef2d2390a2f36c

    SHA256

    9a5a9b4296fca16829bddf57e5a3f9c226e4c912b58c095dcab8c1b920fdbabf

    SHA512

    aae97ed4cf7b4615feccf9248d5f2073afad11dd77667420114f7bb1f72829743f66e5b98cd7d76c9327826be4dd09539c7fa48e7954a697704096ccca0c53ae

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/Default/HTTP Cache/index-dir/temp-index
    Filesize

    96B

    MD5

    2bb21cb3d9b77f5e673cc67ac4d3a78a

    SHA1

    a1a383d577bdb61bb40af7dde544229c0ddb8f75

    SHA256

    525c1e8b75f45ac29c2d2dece51731aae67ad6e25288f5b6f28199dcf9553a16

    SHA512

    39b5c785de0d93474fa23308ec4bba8935e3339404c8b93e595b790154e6dcf9f86034f3f09a16d7cb12a60c4f6e3dcc20b469dfb842b7659e12f0b542d6534f

  • /data/user/0/com.gdwicoopc.mlwmelkys/cache/WebView/font_unique_name_table.pb
    Filesize

    57KB

    MD5

    f080fa2a56ab5479d58063e5ea871447

    SHA1

    4b3fd57a98916fa5784305b76ba30af26b5253d9

    SHA256

    0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

    SHA512

    8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

  • /data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    97ccd9a2b2063143df56b6937f961ca4

    SHA1

    5e78a91ae5df289ce83443cb7d5589dd3504fb5d

    SHA256

    248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

    SHA512

    86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

  • /data/user/0/com.gdwicoopc.mlwmelkys/shared_prefs/app.xml
    Filesize

    121B

    MD5

    d36a3608c933b8a7f65fbf71cff83789

    SHA1

    a371a9617b8847cd13aa35fee53dbd042518563a

    SHA256

    617a5b8815357a4caab0b9f9d4d1e618709ef89ad7ce5be824e8cf5d181cadd7

    SHA512

    ab53949f41db9e21dc73271dbd0807b503894b7e63d1584fbc85d05d6cdc765997dfe112015913950ff9f10063c813a9cb0b916cb6df44ef5f481c8361a8b5d4

  • /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR
    Filesize

    716KB

    MD5

    20523fb5f80852f7d03b9ca83d6d62b7

    SHA1

    9423b1f76829b6052918e6346b58fd69782612d1

    SHA256

    dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4

    SHA512

    0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

  • /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR
    Filesize

    716KB

    MD5

    20523fb5f80852f7d03b9ca83d6d62b7

    SHA1

    9423b1f76829b6052918e6346b58fd69782612d1

    SHA256

    dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4

    SHA512

    0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9

  • /storage/emulated/0/Android/obb/com.gdwicoopc.mlwmelkys/ۦۘ۟ۗ۠۫/ۦۘ۟ۗ۠۫-k-r-c-p-u-r-p-e-l-s-h-b-j-p-d-w-r-y-s-t-s-j-w-d-m-f-a-k-w-c-r-o-o-k-t-n-g-z-g-z-p-k-f-a-j-k-b-q-t-w-o-p-o-f-m-g-l-a-a-c-j-w-f-g-w-q-s-t-e-x-a-q-t-j-m-g-y-k-z-f-r-w-h-o-k-t-k-z-d-a-r-z-c-e-t-d-x-i-t-m-jfO.sR
    Filesize

    716KB

    MD5

    20523fb5f80852f7d03b9ca83d6d62b7

    SHA1

    9423b1f76829b6052918e6346b58fd69782612d1

    SHA256

    dd71c863722556aa5967e79619f23063138b678d4154b1991f6417547f3a54d4

    SHA512

    0bf7618ce24b4426a8780fb2eeb223a4f65399ab4daf3f9ef6a212709d3c22f745847465490eac4f892e97546d4da98be8774f2421271a51f35c498ca4e7bbe9