antidot | 1f0e2b0a9ede1f1b99764e79b49f9ec8f709da7b0ac501ce3505b7db9fe25caa

Analysis

max time kernel
149s
max time network
133s
platform
android_x86
resource
android-x86-arm-20240624-es
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-eslocale:es-esos:android-9-x86system
submitted
27-11-2024 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f0e2b0a9ede1f1b99764e79b49f9ec8f709da7b0ac501ce3505b7db9fe25caa.apk
Size

10.2MB
MD5

4982e66fcc1ad470d0a93022b3c7dcc0
SHA1

07f382fb173f77be877de9f77fc92b52ba8b270a
SHA256

1f0e2b0a9ede1f1b99764e79b49f9ec8f709da7b0ac501ce3505b7db9fe25caa
SHA512

03a418077f362133c4631aa7f170973b724d1d56ac07fd1d3e5db17d4c23abe56182680de9c309ad92c33bc421aa0875da107a4aec386ab1bcd4a2cacb1e69fa
SSDEEP

196608:0oopuBYsGq7W4tjN2OfH8I1jWMMh7QNNjDNcAGoVQGlRlo1TvWM:MHOW4tjN2M1jkFgjD2+VQonoBvWM

Score

10^/10

antidot banker discovery evasion execution infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

Processes:

resource	yara_rule
behavioral4/memory/4263-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.redewabobo.ASCII/app_afraid/oat/x86/YHfPRq.odex --compiler-filter=quicken --class-loader-context=&com.redewabobo.ASCII

ioc	pid	Process
/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json	4263	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.redewabobo.ASCII/app_afraid/oat/x86/YHfPRq.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json	4237	com.redewabobo.ASCII

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

com.redewabobo.ASCII

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.redewabobo.ASCII

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

evasion

Code Signing Policy Modification

T1632.001

Processes:

com.redewabobo.ASCII

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.redewabobo.ASCII

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.redewabobo.ASCII

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.redewabobo.ASCII

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

Processes:

com.redewabobo.ASCII

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.redewabobo.ASCII

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.redewabobo.ASCII

description	ioc	Process
File opened for read	/proc/cpuinfo	com.redewabobo.ASCII

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.redewabobo.ASCII

description	ioc	Process
File opened for read	/proc/meminfo	com.redewabobo.ASCII

com.redewabobo.ASCII
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Requests allowing to install additional applications from unknown sources.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4237
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.redewabobo.ASCII/app_afraid/oat/x86/YHfPRq.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4263

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

Filesize
609KB

MD5
6d4147d5dc237d47e6047e7c9e143a1f

SHA1
88a3ca6e99ed83b181ac91925ce79a2bf64e29d3

SHA256
a6127a9f0f4f6b4b8e926a67ed03fa06223a5244c1429e71ff4b600d761f89aa

SHA512
f2c4ef369841d60d92e3030c64c495712bd0300d1a82f4d86af44e4f888b216fbea5ac6d082d61413798094ed4fed6ad3e802f2d06b388d7e3fe1753c7d0b469

Download Submit
/data/data/com.redewabobo.ASCII/app_afraid/YHfPRq.json

Filesize
609KB

MD5
d29ff5767cac5e17ea2ad5110aa71597

SHA1
62ad19dbe39d41afae9f78e423eb182da8a89c85

SHA256
70a1ede06d781289b40d4980a35041d9e58504e5a4d55209360469ba70491cf3

SHA512
f8dd1eb911e8f591131d162d38dc2a29b24f87f0e052de2005abfb43a2560c0641ee48c2b587739a4a469322847ecf6c7ec8e2a88aa3af8ec654868443e1b1f1

Download Submit
/data/data/com.redewabobo.ASCII/app_afraid/oat/YHfPRq.json.cur.prof

Filesize
1KB

MD5
51c184e986395f479294c6530d194d49

SHA1
19243cd43aec16b1d04520cef94e7997884fa61f

SHA256
ea812f0f34e6a2d87614425896ba3155febc66e3c4a3fdb943a0061f27921e2e

SHA512
bfe53b1273480783c3cc24aaa669cff6883c2ff2fe66c911a3de2c14d383aed62dbcabba1bcafad98e8ca1d1d65e1cae537ec2d6e2379b233ff2058c755dfec3

Download Submit
/data/data/com.redewabobo.ASCII/app_afraid/oat/YHfPRq.json.cur.prof

Filesize
2KB

MD5
598eaa47b5842c09b7dbe9c8bdab7d83

SHA1
7927f13c9dbc010c7c9cdf71eda2351792cc229b

SHA256
0e213ccaa952547e0a83a9545f348f0a961941bf54218b4708fedd1193650a4c

SHA512
5a3a64d07541f73873abafd4ef7e30be0180f8734649c1235fe97be363dfe00c0acad75d78549b8357da0735268ffb121a5fc17353a87f56e115be4696952ceb

Download Submit
/data/data/com.redewabobo.ASCII/app_afraid/oat/YHfPRq.json.cur.prof

Filesize
2KB

MD5
87833da8cb7c9d13d09575008382996b

SHA1
e19cd8f3a25dbf4ad67fe2622441340343711e5b

SHA256
a68252ab85dc99370039ffdceeaa57616d8c3ba66c09d39dd8d348930917595a

SHA512
8091cea9f4f204710e5ca281c7689576e92e700c21ae932612f73c9e49473bf516be041046d0530f4cbe67fc4d6fe294ea659bbae76d4d8e3e4d3d1ed12a542a

Download Submit
/data/data/com.redewabobo.ASCII/files/profileInstalled

Filesize
24B

MD5
75faa8b509f11f72dad7df3fb590548e

SHA1
fe681e5c5025e987c97f0dc6d96e96672b364e75

SHA256
026f30599fd7aaf72e8fa55d6b6856ad11a0dae53cf0b12f03b4a995e6a12735

SHA512
840c927f37c49d8e1ac42f588f0d77fc232101dd6b79f2558f01f578ba621e5f0d471377c0cb4f2ef0cd7507c7e42dba911cb1f27815de958b9f5e0154046694

Download Submit
/data/data/com.redewabobo.ASCII/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
2cebf3f846b374f28176a323615cc929

SHA1
a6be105a506701cdf58aa10e97a7da4750537269

SHA256
dd6627d1c63418a549d1cecbff005af2a46970e26de6f1ca4cb13bf22933e357

SHA512
d4d839053408055d7c40bcf7271e8986a9fc5cc91f41e4f1cf2fb0569dd23c7b9ed81c9c4f1c26eec275696d959effe750c0d60a409c5365bbfd9ee96874a78f

Download Submit
/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb

Filesize
136KB

MD5
3a17bdaf1acf8fdf235924c34aac7934

SHA1
aa52a841524b228f1cb52b2a5b0c46bf651c9901

SHA256
ff4e8771260d6c3e2f129e84aa785b001ccf458ecc21a3023f546d6188588633

SHA512
ffd2074eac16bfe77d4001fd9b69dacdeb961394aebed74fb5434f05e48bcf69d0c182b1032e10bc4d22f926a70759c41d8f34aa3532d6ebc7ad9ce68f7cb1f0

Download Submit
/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
71effa245dd144b7e2efe71711122201

SHA1
8070250d3ed0550ff1f9934b45209e03355e9cf6

SHA256
aafb1e1b3631f4c714e019a11f96b4013d401a19ff8d272188ea174534f9c17f

SHA512
3d9c592d517aad6dfe8891107a044a7a5e60e8232582aac51ae793dced26b76764de9731e16864085e39279487adaf615581c5eae8fff3b699c1236f8053b2ec

Download Submit
/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
983cf65ed98678bc7e69a17c012077e2

SHA1
209f26e021e95514aa5ff21ce89018ff21003283

SHA256
3b048397810b63e0265b1441a045c93a0eb3ece34f1776f965cbd4d591663871

SHA512
3b8d43447ad5b405cf7ae3e31226032fb3ff76b1e8b2be51ea87502744fdba1f2fbe959fd0842c10603e59cdf6102b9be8f15b9a2b5c1a550c6585da0bc86c3d

Download Submit
/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
b18376dc30c8267533bfeff882cd1cc6

SHA1
65df620bd62e8b88b762698aebb256cde68e221e

SHA256
c36d02eefeda22c21fdc4b9dec334e72b69eca83f0f322267ec50499b22f34be

SHA512
775c6b28ef579d16f1b0eeae8ea9981d3a580c9c7635fa683e5d742a055f67f283ed43e7b2b39556ed448f44533b7323d813688ddde6d0700f6ffe978dbcbfab

Download Submit
/data/data/com.redewabobo.ASCII/no_backup/androidx.work.workdb-wal

Filesize
422KB

MD5
a554edcec30549a86a6c9792b9011936

SHA1
038d282becb84792a3f3a03fc19eea8ef8805cf9

SHA256
22757319208c710f0219ebcfd2f4cb13d15269982dce7178aa479e899f02a393

SHA512
a3a944d24f40a0c0df7b6590c9482735496a73302d6081d290a2a33fcde430bf3e12ad9ecfb92ba985844c0248a20e2c7cf92c9a818a7f05487311d06643025c

Download Submit
/data/misc/profiles/cur/0/com.redewabobo.ASCII/primary.prof

Filesize
992B

MD5
f9fb0ef0764e987c965397688b5e58ad

SHA1
5b2c1dad6b5f1a301948924fcdf8b574dae57a4c

SHA256
531ba96667421fe63883c0f7cba6ccb49ff301192bc9467224f7be0fcee74181

SHA512
2a6e6637e2cbd978314f773a91613779bfdccd3b7bfd270f6eadd3b698969ac6cd8ea553d8eb7d3df4cbe905fdf61f5f745602173023cdf9795b10edb32e31e0

Download Submit
/data/misc/profiles/cur/0/com.redewabobo.ASCII/primary.prof

Filesize
186B

MD5
288124e55f183a7d8d93d81e350dbb15

SHA1
711653db9a47b45194991d3bc7489e4b8f06b5cb

SHA256
0245a9e5673e7b55c89d20083d1866d17728fd328f5998f3670042a0289a0063

SHA512
bca79a5b5c62fbd41a50cfd80fd70577586a55b728f6893bd4b17385a8f737985d15f8e56b231260a74860b4a43d578e54a41a19ac39738389a0ea20338eaeaf

Download Submit
/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json

Filesize
1.3MB

MD5
0c74ccdd2e952f1fc963e7469a366e59

SHA1
f5377407c4ae99dfbb943669badd1e881ba0ef1f

SHA256
c4983f0d13b7020d35e90e349428781d98a4375ede58742966b57643da5c60fc

SHA512
9dd1dfc44b7c389b5054ae76d80086f6f974cccdcb45ee16c99cae7c926c163654f851f88db41e55c96dd486429ab3044d75b28f71d11d5014cf289ad82e8ae1

Download Submit
/data/user/0/com.redewabobo.ASCII/app_afraid/YHfPRq.json

Filesize
1.3MB

MD5
c32af470fb777428515b5c01369fd81f

SHA1
72e65e062280b2a13b4792630119392bfd451860

SHA256
8c110fecd6d2f3d6b22ec6885d03199e64bba8e79d6d0acc8ad16f6cfb4a05a5

SHA512
bb40e7eac8d0861a060a37632ce6d679503972309cf510267ede98e7d9e0b14b252bd222300db3ed1e696e69d6f47c852129f8d52eff29fb34319cefc1dbb500

Download Submit