antidot | 58911b7dbc485fb5e8bc3967de002ab5cb898023223d7a41e5dd7e1a074e40b1

Analysis

max time kernel
59s
max time network
135s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
26/09/2024, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qcojes.apk
Size 8.5MB
Sample240926-ssk4lsxcrc
SHA256 58911b7dbc485fb5e8bc3967de002ab5cb898023223d7a41e5dd7e1a074e40b1
MD5 df2e25512953821661b4ab8a5688a9c8
SHA1 7f60852fef126e5fd8e71266a65ed153b6094d40
SHA512 a9d57579442311c693af3c4c5fecb4ef8cd4d68c2ddbb4a6734eb892ba6e5cca58fa4468f07a47da7433d2329a75d948696a652341fb05be30e4a448eb61c127
SSDEEP 196608:G1mTS0d6slb4lDlPUfTDfu/cggd0CRCYSIB2euR2kSdr4l:G8d6slb4lJPuTDfu/cICR9B21R2P4l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antidot banker collection credential_access evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral2/memory/4323-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.wafukizifi.server/app_addict/NFGYpTB.json	4323	com.wafukizifi.server

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.wafukizifi.server

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.wafukizifi.server

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.wafukizifi.server

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.wafukizifi.server

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wafukizifi.server

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.wafukizifi.server

com.wafukizifi.server
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4323

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

NFGYpTB.json

Path /data/data/com.wafukizifi.server/app_addict/NFGYpTB.json
Size 602KB
SHA256 623bce07ec9cbfda83dbad1ce35f3a6c9a018d2018ed4c3749c106010caf036c
MD5 4ea265a5115ca4553a2f49ddd4bc936c
SHA1 98ef66230d578b1439d8ff95f45279e2f22c6454
SHA512 c1f6ebe4adf58a4ee69173309921699b577b761b9491d35d0e16563a3ca7a6aa76236b0f9a8dba82a572c4b8a4d7f17d4a34b8214b3a4f3005a31f47610361a0
SSDEEP 12288:Orr6qGSXjQvKTwxYo5THryhWSEK2SdWfw0pG7ZP48:OvvGSXcfYmHrVSmro0pGv
MD5 SHA1 SHA512 SSDEEP

Submit Download

NFGYpTB.json

Path /data/data/com.wafukizifi.server/app_addict/NFGYpTB.json
Size 602KB
SHA256 3c278b862d2689ae0f8cb6021ab3860035f9088b6b84f2b90b2f54ce9a3771d0
MD5 b0e5ce664d3b72ce27fd936ba50fc9f4
SHA1 5c003e9f84b972124465b1dc0500cb5e44644a61
SHA512 b8e79f9abe0e1fe568ddbd2d0c0010c0ea797a02a106fce6f64d8ea1bd03c7cbb6559637ae4dd487026b9fbdab8c967dca77aff719735d7a6f5337c99cce1164
SSDEEP 12288:xDIUOt2FdySSwTr1v/ypNj25sejaWWirPrvXOfM9V39nSWnQVWlHxm9:x8hYISHV/ypd2CeuWfrPrv+fu9VnQeRU
MD5 SHA1 SHA512 SSDEEP

Submit Download

NFGYpTB.json.cur.prof

Path /data/data/com.wafukizifi.server/app_addict/oat/NFGYpTB.json.cur.prof
Size 1KB
SHA256 56126fe4eab9ad7382aa8ef48b50896816e5c99fdfd9260d0ed5dd70b4325c4b
MD5 0172e20a8835dbc6976f36dacaed8dda
SHA1 0714ae8f11c8d5e3fc6c4de50859d3fb44307caf
SHA512 83a1afd72b963a19ea1f30ae77f48dc9a13b83a0c5f42de4115be9470483281db0b99441385ec0618e6acf63ab2cd6a4dfd05418380125ce57c002e2b170806f
MD5 SHA1 SHA512

Submit Download

NFGYpTB.vdex

Path /data/data/com.wafukizifi.server/app_addict/oat/x86_64/NFGYpTB.vdex
Size 29KB
SHA256 41ffad5254ce64757deb48d727f8adfebf0204999a026fe4ffa26dc69f1601c0
MD5 7f0b5a4d1ff63c47304a9768638c05b6
SHA1 f9875128d51becf0d1858363c8597e669539e0e4
SHA512 60d09a2a2a6c98883b8d367f54a68bfcd906afdabda21bb6b186b0d79d7e6febe24c8aa4a10ebfabc14469b2e0f6f05d26e5786b6835a556b96a8c70a8e42f40
SSDEEP 384:+mJKAwdGt8GrT+q6Cl9xln8VdO9ezYWQRleEaS6kas7S4O1AUdMkB03:PTwd+vazCl978j5YWQLGS0hu0pB03
MD5 SHA1 SHA512 SSDEEP

Submit Download

profileInstalled

Path /data/data/com.wafukizifi.server/files/profileInstalled
Size 24B
SHA256 092f8f30c1b51d7436b224c8878b21c3098975c021d8c5c2fe53529e0b7f58d6
MD5 e4ea1125758cce682aaebb25cd356edc
SHA1 27637be32911f4dfc4233bfe17b5b421c54e4397
SHA512 dd8c378cc3b8a345c4257504789a11c9de3b0d1021dcb5f8527d6c9410979f3780993cdd3d68c3b8526cb5f92409332477c7ea6876efec1b3df54f519ca5431e
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.wafukizifi.server/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 6e0f606942d259c39d2dcbc0f691e492d793fd4e3165a87ecc93afb13107006a
MD5 bf65909f79a610eaff268044686eb6c1
SHA1 af7f54c7fa5c01bc0cc004132db8851cc9d26a16
SHA512 f816c7f3436653c0af7a0a74ef68f84ea827abca316ed4fafe49adda042a77df25177b0ded53a87e84bc5fb8111b70cee451a4a6cb51af40633f6bdfce0f9a59
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.wafukizifi.server/no_backup/androidx.work.workdb
Size 112KB
SHA256 04959c30ecf4dd8707cc7d02fb225c3099dea1a1fa5330563bd09610ec6a0817
MD5 3c8dc60c021c45aea7481fd1665121ca
SHA1 0523005a76339f9e13514121d7e4cd4521dd3ec5
SHA512 6bb251c7994ebe8092f3c7b6f2ecd14379e6ec208deb61bc8489d452603979574bc69698ffa67be52017efc9bd5beee8c64af6829b1611092af85ecd36079de0
SSDEEP 1536:UwrrhKJiDgvSzS0ZDwYlYzYUYVLYTY6YDYXYIY4YhYaYfYyYaYcYrYlYzYcYiYID:tvcugmL
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-journal

Path /data/data/com.wafukizifi.server/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 b77815fea7adfcb43e678670b970c601465bc8193ab27d114c757c2d6e0e58cf
MD5 711059ee05ad9ca81ced42120c5bdd73
SHA1 bbc6bcc66d5063286ca43b6ebc59a216dbc17bd3
SHA512 dfe0cb6e11ab57620c013f5cabd7869124ae621838f55a34c6ca4402190ef1879b929e457b4becbe26eec7a058d14885e43638701e50dedc55685dc065c101c7
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.wafukizifi.server/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.wafukizifi.server/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 959c905cdeffa30d376e81500d4f299f3c22adf9af5de1357ca9ac7ce6297ffa
MD5 9599eb3445ee7b404a27933609d4228f
SHA1 8a8e90b8bfcbf42211e8f6c12d24bb9754247fbe
SHA512 3a55e404fcf17d5f1c23293b61c3cd81a3225acdd5be69bad033751ce9612cf880452fc1dab4d36e1fc7095eee9b68ca68d690a1495ae5a6958cff18ed4a128f
SSDEEP 96:fIrGo6+etidjnZRWzzb8/KeKcK+zSvddKz+ZD86u0ExV:fIrG5tidjnfWzzb83zSvde+ZD86u0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.wafukizifi.server/no_backup/androidx.work.workdb-wal
Size 410KB
SHA256 4c646506d27a516c28493c1e077d9752cbd5d6ef0bb1152e19059ef895759ec0
MD5 7faf32c713d16f680f2c91591c92f037
SHA1 fbb8f84f39a3f6168058cb657baf8d02328c5c60
SHA512 0166f32f40ae03f6a8a3c82bfe7eb1d4fbe1f5e477f4c21e23f32f239d890a01ac2e74839aa6a4247bf4fdd4817c967cc3057f4676a082bdfad62afb2834a214
SSDEEP 1536:5YIYpYRYVYkYmY/YTYmYIYpYRYVYkYmY3YmYIYpYRYVYkYWYoprKMQYmYIYpYRYa:ygmL
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.wafukizifi.server/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 30221b61148cf27679154a0505ebdc77cab1249cb747d67956db3949115e65dd
MD5 d8918248a8f74d9dc4bef970013051c1
SHA1 09146fad1e7b10df78c72b43bd8ddf9e3649f599
SHA512 d05b35257f0d7f3963a300a3c0e78abedbb7e18edfbdcccf62ed699353431394db3fdd71db7f18e703649f1a7c7b2026689b5bc2fc31a0026dc2faf509828bdf
SSDEEP 12:KWySshS4yzdKBRmBEyPbP/QHKVRWY4Ow2:KzSQVyzhGSP/qKVRWYC2
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.wafukizifi.server/primary.prof
Size 1019B
SHA256 7e622028e84bd79304df44ce2b77e834f90e8119245e74e89b9243b54066d1e6
MD5 19d973e122532f1f3a2bc19b62d3b400
SHA1 e800e743e40fe887bf7c7c9c16ecf7702bca5dd4
SHA512 343b4a784947699fde791a784cfa131bcbe7b79d167bf1288415bf1f71b6d004656e50f126e4e5427d41dc229312770aa41816095a8f440f706d2d0f02081568
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.wafukizifi.server/primary.prof
Size 269B
SHA256 3703a2f55d6805fd82cb4250aea17a9d478493996af1c4d3920176b0be411035
MD5 d345e0c97d42a3e5bba024c659522e49
SHA1 0e9f72a57d1d11e0dc0896b58bda6e44f48aef1e
SHA512 46657d82ffc740cf22203c1bf843f4c0423d92990431f460961ec038fd7502b7c2fc32f4aeae04c54bad1b61d354a23a1c4f0f49979c664562f68633359c883c
MD5 SHA1 SHA512

Submit Download

NFGYpTB.json

Path /data/user/0/com.wafukizifi.server/app_addict/NFGYpTB.json
Size 1.3MB
SHA256 ffd4d13e1f12225aeb58b15f8f2348b6be7e332d5f90bb8d218fa4ebf3510e05
MD5 c9aaae1e74411b132d2394bb0be61477
SHA1 b88481229124c0def855b73e2046cddacfff3e08
SHA512 695e2033b15f7d7463599a8567b097757bb241ec155b027a56daf0bd2a69b5884ae3b8af79de2df98e217deff9bd474549babfccacb8f6aaef2df7eb872c1b0d
SSDEEP 12288:dG0DkOTeLYf2xC8p3/em3xj7em0UIoPxjHV25WFzd1SGBoAb0F4kGuhfAHfL5dp8:dG0DUYuxC8pHpEAb0FKuiPmQrD9O
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads