antidot | 58911b7dbc485fb5e8bc3967de002ab5cb898023223d7a41e5dd7e1a074e40b1

Analysis

max time kernel
141s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
26/09/2024, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dogexuzo.apk
Size 9.7MB
Sample240926-ssk4lsxcrc
SHA256 5c6d278d5791748650065233697419a744a1d12f50960dd56b9f86b59dd052c7
MD5 ed1dd47ee8ea4b6bb0d06837c5e96d70
SHA1 1bce41dfb97da1cd4cd51026df78d33c78bb66be
SHA512 df139dffe6aea4d05a03ba1bd7e9352f02f1e6914c427219a209d6fbc7150bc757ab8aa41c4ee2f3542f2c3c99183b5e6947145652dee9b7e078649035aac4eb
SSDEEP 98304:Fmv/Hh3MT/Jfr+c/byhZMzYWV2ieSyeTgnrSsVo/KrL1QeWLn4H:Fmvfh3c/JfrZbyhZrWEYErSslQeon4H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antidot banker collection credential_access discovery evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral4/memory/4479-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xusayu.platform/app_wild/irEAq.json	4479	com.xusayu.platform

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.xusayu.platform

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.xusayu.platform

Requests uninstalling the application. 1 TTPs 1 IoCs

evasion

Uninstall Malicious Application

T1630.001

description	ioc	Process
Intent action	android.intent.action.DELETE	com.xusayu.platform

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.xusayu.platform

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xusayu.platform

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xusayu.platform

com.xusayu.platform
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Requests enabling of the accessibility settings.
- Requests uninstalling the application.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4479

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Indicator Removal on Host

T1630

Uninstall Malicious Application

T1630.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

irEAq.json

Path /data/data/com.xusayu.platform/app_wild/irEAq.json
Size 940KB
SHA256 f6a0c5d765695d00a57656f5b240149d6b31655de7666a8702aaa47ae76895cb
MD5 385941dc8f483a9029d3a9abf89042bf
SHA1 067e090202ea50f15681e62cd082b5238fcb102f
SHA512 59835e9fc8bb2443596d0f4d23c30fa158bd766c5385908c753560994ee729a3ebd0b4d60e9252ee2691c39868a9be53758b270a566bc180ae7ff613ba0c4f62
SSDEEP 24576:nSxHtjXIPxfzqATHG3sHAf5/4FsAc4xT8HiN7Du/16onp5mI:nS+BzRTHatyHjNHu/1NHb
MD5 SHA1 SHA512 SSDEEP

Submit Download

irEAq.json

Path /data/data/com.xusayu.platform/app_wild/irEAq.json
Size 940KB
SHA256 21e9b8a4d0e1a2ae9eea407971361357558b4c78824af55b2205bef865d7161e
MD5 5428d4b818b6a2ffaa39d6d346ab649a
SHA1 d7084f3dab6e834d16750eab9772a1e3bb705f0d
SHA512 f5af1bdb2539d697075d557bb8c46b77c2d18094adfbb41f407cee2aeffe35bdb10c73d298bd7d18995957ecb9dfbd53362fdae791623d003b6e07e6c84cd040
SSDEEP 24576:gVkg8eSEqhCmNA7bwykvry+rLfeMOwpajD1B0sCLso:gVkg8elmO7bAjyYLfk2aVB0sCAo
MD5 SHA1 SHA512 SSDEEP

Submit Download

irEAq.json.cur.prof

Path /data/data/com.xusayu.platform/app_wild/oat/irEAq.json.cur.prof
Size 3KB
SHA256 3b98c1f0f11706d9352a66dc70181682d12dbb2c89770085a7000cc57fc51473
MD5 f734f4d425e129664c0cfee62757c71b
SHA1 e843f3da3cd9de2b0c30e8726d5fdcac8410b55f
SHA512 a27b0aed87d0d145143f5e74b8e2e61072aa34ed4157147c6f87f627acef561381b789b780bbbe4cb79a10801a26579cfce953caba4813d056e4bde78fc684f0
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.xusayu.platform/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 b8aa6a81e4936b24fc0a0f725cb3eda57f42cebc7bcfc669f16c715466c11712
MD5 862a45222065a78d3a3cae9954e912fc
SHA1 896ded87071f19fb472ba26633ea8e50151ce97b
SHA512 aafeced259e7e23d8a1204323b51c6d466f54c9fd8da38a0017fac47b9592629715f916065de6f1fe595b51a8ade7cea6bc5f8070ac34180879fee5dbc5f47d3
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.xusayu.platform/no_backup/androidx.work.workdb
Size 104KB
SHA256 07964d7345fc09b14db6983fa51a0a0e9129c817466cb4a8f04d28c2983ce06f
MD5 8cce07f5b04fcffb255dd991cc8c086b
SHA1 822b31846d965b4b397e8649f7597e4079b7b2f5
SHA512 c1187ec4008efd8a294870012b2ad8a24c15045764bd87c7ce93a6a34c347f440a8f35dde1444937d3e7b541ccf17d215dab7d65817d82e22ef7ab898e1958e0
SSDEEP 384:+tYotY20tidjnfWzzb83zSOdhZD86u0ED:+tYotYKfWz03zS0ZD86yD
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-journal

Path /data/data/com.xusayu.platform/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 9c5acb52f4f2f68ffab2b7826f4b88386e6ee683fe607e4a7d8098bfb3c3bb4e
MD5 6b0d5ac0f6ac43916042573ca26585b2
SHA1 b5eb52355bd0090833fbe4e7e33c8ef928c749c8
SHA512 da4b41e6efdb9230f1a10fb3e662677eaf183ead41db4de27ef843ef2c7b0e683175b9290d60ca97102e9b87da0a5cdec6367e90ff6045f5154dd63108b3dfc2
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.xusayu.platform/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.xusayu.platform/no_backup/androidx.work.workdb-wal
Size 406KB
SHA256 8e469742b7a57c974eccb54197ac3ec4c7ce51b05d7ad6a7696a5ae447a8a42c
MD5 1b383701a781e6c9296d46ed2e812353
SHA1 60cd44e920e5ba3ee2280972af5251a87c72bdd6
SHA512 fb841c5447e5758bfbbab25dcf7b842e9f8a46e6653c289bd016e6533afe943785dd802c359b4eb51f917b70adab8d80181a78ceb67dba8014c739f694472903
SSDEEP 1536:fY4YsYxYzYGYfYUjY6YKY6YyY9YxYaYaYcYaYnYvYnY1YkYQY4Y0:cB
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.xusayu.platform/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 d5f1d32facae2a136e9e55f9583c839f2309d71a3b2431658e51094f9c9e34c6
MD5 7308f3272911a2edb455df7fd41baf99
SHA1 642ca42d73b0b4bfc09aa8d328b828fce59a9d01
SHA512 4d02832cf64369719e3139e703f3ca0883fd6d0f2daa6e217442b4ca7576e8587030cea172e860d9bb45cc48351a44da8eee511c2610e0b99899bd02b989985c
SSDEEP 6:KKKw1jg9FZde/kPlOERX4PBX4ogLugMBX4suuK+/sqCAo1E4bJOw2:KKD8zdeWRmBEyPbP/shAoK4tOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.xusayu.platform/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 e9ea50eddd8ec88503456b35db0916286b58e2acaa20729ce7a787962c616bd4
MD5 e885e23d9d4dc9ecd256e907e54fa8c2
SHA1 2e16e73a55fd690b0a040b1e0d0d894af6e6ab81
SHA512 98ce1ae011403ca36edfdfd2cd422c50b8a156d0ca8a72af2e1518a6f6b18bcb8bdc0cd8d15b9051fe6e5978d4bfce6bee986f3939f32981d4d60e0a31041857
SSDEEP 96:4s43r6+etidjnZRWzzb8/KeKcK+zS4ddKz+ZD86u0ExV:4s43QtidjnfWzzb83zS4de+ZD86u0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.xusayu.platform/primary.prof
Size 1KB
SHA256 fb04e3567f64a2e02db82faf7bf8bf3af00cd0f2221a00d15220e36cff3ef7e1
MD5 5ffb95a7ef49501708190512c87982bf
SHA1 996beb3fddde1c0ad8d8adfa0af109e4c1a148f4
SHA512 5a7c1467c160ae8d09a77de82417b9ad0856ef571e34603b54c74ef40bcb365136eea6a9dc51664cb2c630360e565b807ac2f4f667ff3f28ea666e2ea25639b5
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.xusayu.platform/primary.prof
Size 216B
SHA256 190182d9d88e54557c96c4b307067947368f2eaf4cbb93b006dc613dda3d2db8
MD5 735a48602898179ed0076b85a7b6cac1
SHA1 59a2a4efbb64c2ff48524a490594a0632a0dfb6f
SHA512 44ae060d6fbbbc12c161eeccd0ebea4e84cb51735dd8bbf37bf97926f46e159b580f41d24936c10a6be4404cbd0c99f562b9fa2f0c0b5381576f54ec717a2f8f
MD5 SHA1 SHA512

Submit Download

irEAq.json

Path /data/user/0/com.xusayu.platform/app_wild/irEAq.json
Size 2.0MB
SHA256 adb7455932ebb70a3b165a8003164883878c6e91bb96086fb20d3751849d364b
MD5 907dc8f5c73ce932bb6acf8b564de3e4
SHA1 4712b98d9161cd6c40e625d8426c15d2746d45a9
SHA512 c1a03691ba0d23694748f295d1e216d10294514ba9a9aaf4ae3fbae748a8d7e7dc65220f0fb1c4510d915230bc8c6ec72945c6634b35b9ee40744b2983e213e7
SSDEEP 24576:0ZJDV4WCFIE0XMx98pWXmTw0wddXINAvnm/HOPh1mJPtc+HoJUI8GiDE:8V4fJx98pKmMWWiPm+IxeE
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads