antidot | 12d1fc37fbfa5e0eec3954f5fc31cdbd55ac61ebd84e41c59ff00567d03b107a

General

Target

12d1fc37fbfa5e0eec3954f5fc31cdbd55ac61ebd84e41c59ff00567d03b107a.apk
Size

21.2MB
Sample

241106-cj6e7asgqd
MD5

ed89ee49c2c4a8fd239c707915ce8639
SHA1

be3784acfd0bd38ca33b1f949fde2404e5267f11
SHA256

12d1fc37fbfa5e0eec3954f5fc31cdbd55ac61ebd84e41c59ff00567d03b107a
SHA512

f8ca51e5ca2ba0590d77d02a9730d6fe216b8a7c2af84a73f8e77180266367823fb8d53b93c6ca0334190bffe223d97b060b01294dcc004de11079fe86edf234
SSDEEP

196608:NebKPsZMtkhJwZQaMEQbJs1sgAXFNgI7a7YSu33Zu9yzhLrZiCtUMg2lE7A413+F:0bKsM2nTEQbss3FNgIuc9zhL9lJlE7RY

Score

10^/10

Malware Config

Targets

- Target
  
  12d1fc37fbfa5e0eec3954f5fc31cdbd55ac61ebd84e41c59ff00567d03b107a.apk
- Size
  
  21.2MB
- MD5
  
  ed89ee49c2c4a8fd239c707915ce8639
- SHA1
  
  be3784acfd0bd38ca33b1f949fde2404e5267f11
- SHA256
  
  12d1fc37fbfa5e0eec3954f5fc31cdbd55ac61ebd84e41c59ff00567d03b107a
- SHA512
  
  f8ca51e5ca2ba0590d77d02a9730d6fe216b8a7c2af84a73f8e77180266367823fb8d53b93c6ca0334190bffe223d97b060b01294dcc004de11079fe86edf234
- SSDEEP
  
  196608:NebKPsZMtkhJwZQaMEQbJs1sgAXFNgI7a7YSu33Zu9yzhLrZiCtUMg2lE7A413+F:0bKsM2nTEQbss3FNgIuc9zhL9lJlE7RY
Score

8^/10

banker collection credential_access discovery evasion execution persistence
- Checks if the Android device is rooted.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Legitimate hosting services abused for malware hosting/C2
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1