malibot | 3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054

Resubmissions

13-10-2022 15:48

221013-s89f5sbhen 10

06-10-2022 16:41

05-10-2022 13:53

31-08-2022 20:23

31-08-2022 20:11

31-08-2022 19:40

31-08-2022 17:36

31-08-2022 17:32

Analysis

max time kernel
2827482s
max time network
1803s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
05-10-2022 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ndQOhY0ypd.apk
Size

5.2MB
MD5

ca559118f4605b0316a13b8cfa321f65
SHA1

5ef4d5784738d79f22f9bc5e8db7c94985bc1a3a
SHA256

3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054
SHA512

091f07d51e9d7c924666f28a30b03e5ff887e239ad2ed9a99cbd65e7b9350c6fc89cafdbbe05de27f8ea6dc90ff8484c1b692fc891b58fcc6104fa6878e8f3d7
SSDEEP

98304:+Ld3yR0X7GPzP21DeReIrJ0jJMooanGHNdyc7scnuB5k9MWdU:+LxyR0X7Qz/diMolGfyXcNMWdU

Score

10^/10

malibot banker evasion infostealer trojan

Malware Config

Signatures

Malibot payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4137-0.dex	family_malibot
behavioral1/memory/4098-0.dex	family_malibot

malibot
Malibot is an Android banking malware with the ability to bypass 2FA/MFA codes.
infostealer trojan banker malibot

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.slhytrowb.wfxaicaiw

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.slhytrowb.wfxaicaiw

Acquires the wake lock. 1 IoCs

Processes:

com.slhytrowb.wfxaicaiw

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.slhytrowb.wfxaicaiw

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex --compiler-filter=quicken --class-loader-context=&com.slhytrowb.wfxaicaiw

ioc	pid	Process
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	4137	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	4098	com.slhytrowb.wfxaicaiw

Removes a system notification. 1 IoCs

evasion

Processes:

com.slhytrowb.wfxaicaiw

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.slhytrowb.wfxaicaiw

com.slhytrowb.wfxaicaiw
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4098
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4137

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Cookies-journal

Filesize
1KB

MD5
c660ea78e936d017299d042c0ece925f

SHA1
87e1612a4ed27fbc3cc666d3c1c7a037ea3ef31c

SHA256
9a71e7f3474ad3867939e4abcf0de48dfffe00fb9228d522ff7f92b381eeca44

SHA512
1d052889283d55abf0c05059341d27f63b0ef4b927ac5c64597ed6c722ae56ef087d7449f499200a5812afb522445e0ceb822dec5e654b6f4c26113b8fe4109e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
f9c386943ab5bea9bc0fd77083b63ec4

SHA1
1b6e9dab4b2348199e92dcb7d43ce6a748d99a20

SHA256
5621fcee35efbeeea44845313e7cec3abb08b6e6aa171dae1e60d9f9025aab84

SHA512
824db59f0f42f00eddf99c7f5dcd9c46c54c9c502c44cee394421f7989d1e54ada262fd516024ad74a0392149f0bb2808a5e022a8bc2bc562434b7601174ffde

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Web Data-journal

Filesize
1KB

MD5
0e06d6a9cc93f471113ec94566d04c62

SHA1
01aa2e27314f70d1930fdf177313ffaa40d90a84

SHA256
d920f7c47d334ebaa4ba3b0776f2ef8b08986e82e391ad6de283ff7f2dcf1259

SHA512
bba848fdf42fd9722b5aee3e6446976858088455edcf8eb62b2791c49e703ef9194cc9e09a993ed378700c28b6bfaaf7ecd5130e3fb9ec3a7e82d2397c776cf1

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/metrics_guid

Filesize
36B

MD5
b087518f3aa0bc017234d0e95234950b

SHA1
7eba34a3453fa6a04974b34aeea0ebf902424ebf

SHA256
5b4a246d54562e55aed94c769414e7cb0c811057fd2b2d28f8dff88fb55f9029

SHA512
75aacf2cc8652f127e9664acfefca1443164e02ec2b1f0402a19978537435c0d4eeaca1d8b7e4b1628eef3c7d9b71821d74cd31cd50ef7f9156b594beebe5274

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/12e363d49ccf8b91_0

Filesize
247B

MD5
15a82153a4c9505c12cc470fcf650587

SHA1
d50cf6fc1ab4d70c26df2d2e765469256e4ebd6a

SHA256
c72eb37d898dcd960b6bea7e4335f9635169087f15c7cf9758debfa27bf83dbe

SHA512
50acf7d8ecd2e5aa7b7ec6f77dd2e5fb33ff33586469b70175cfae9c7ceb8d7a14ddf6293247499727d2c15c35e93054fb88f3364359e680b8473f3e3a539882

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/d449800084ea13d6_0

Filesize
158B

MD5
2cb8b37ff7093460aab6c621c8f818b9

SHA1
9c57b205842644cd4adc1e429ed3692c094a6ab3

SHA256
9c0df6d533eb9788aad886584bf997e50881ed6dfc91b5ad3e5ac6661aeddc43

SHA512
16f8f0b6eb94282d86852d68e2651d7f821a3611336888c6ede7439c7e1ec16e9f53d942cbeb694e44ddc4c24af9b599fac55aca28f45044d7dc85ea33c25406

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/dd533a7e05389102_0

Filesize
157B

MD5
04ad8537d5f4fc0939d88c2c58acb089

SHA1
bc6c99338eaaa146f1d33e0dd84fcc4d7ce7b1ac

SHA256
845e11384c61b8592e62f1d7b61af400c15a3806c7f58a35079ed2394a8ceaa3

SHA512
9348c2e038422b88b5cb2a9f769a4ca60910473fb3a8d054c6944b8cd4cf95e498aeb5d73d11c97979f2fbaccd7197b5a9433c8a8805acafe5dbeb184eb3bd4e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
e072fc8dd6977c428ed65d8246c048fc

SHA1
279649a45927094114c8283a451d0b26d7bbe285

SHA256
8f0d44a75f045e683e01e476e68096b6e909536fa18ad199119cd599c28b560a

SHA512
9ff01cfce45af11b0ea431574b89496d3ee91d2b1642f947302d31c2d2ff03b8318626bb3849e8ec07d5a6f4a6bd9b3fe75387030cc9a35fd3f1842eacad9ee3

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
17e880a88e03a5cc23f6576fdcce1505

SHA1
7da00209172fa665b7705c6b7c3b2b35cbb0a688

SHA256
91a78dc4861c19343d5e87ac0ae5a23ba2345ef5c650890ed3199a3fe0ba86e6

SHA512
6a342f1426a1e16f8d5ed6fee0f796e278168ccf11ef1731d9896b54c197b8d14dc7ce51948cc16aa092fca52f278377c93ea4547a69c00fd4fe84a7607d7197

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k

Filesize
1.7MB

MD5
d88de6e7d0da8ed1048e50a65228861b

SHA1
6354701609b3540f2b099a6834ffce83f7cff066

SHA256
4392239b7496e249c652effd92ea73f8f24a2fd0763e28c0420c774c4883ca72

SHA512
afb24a980935ab6c62341bd7cee253092053add3257aaf370854b556405cbf69e0ed3789fa56492ec39a66decbe1588cb69420dad3f5818752001d10fab87fa9

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k

Filesize
1.7MB

MD5
2426b919cdc0753cfda937d3a87d6226

SHA1
f258933ea1ecdb552475032b89fc2b3c83e0e6f0

SHA256
e7c8f9bacba13bdadf4c74cf356dc7734b0a269bf1bf02695fbba37f87eaeb98

SHA512
2cbb1dbee4a7d8bba818b416b7015ba5128cf77b9ba53906fd6efc2940ee71341e62292a79e43eaaf061a6cd4c21a96893354ab4b8b54e35708b768de5fbf21e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/g8yUt8ff.atdy

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/tmp-base.apk.hkyhafI270892298168230985.g8k

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/com.android.launcher3.prefs.xml

Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/multidex.version.xml

Filesize
307B

MD5
6b905b66a241f24db1494b2956d0b9a3

SHA1
4342866667d2b6f87d3ce77d1d469b6d2ad1760c

SHA256
e7bbd5f7f5816b5f702bb71daf8431dcf0a24faa3936d13b9cc6226cbc1a155a

SHA512
0f797858da00648469e72796b33ad1e9e8126d1e8f5c285f3daae1fdeeef6802fb3208cf993e2a4b7ea5dbaac1bcd5b78648e9e7feef7c5216b44293c271a349

Download Submit