Overview

overview

10

Static

static

6

c87e9f6e8d...12.apk

android-10-x64

10

c87e9f6e8d...12.apk

android-11-x64

10

c87e9f6e8d...12.apk

android-13-x64

10

c87e9f6e8d...12.apk

android-9-x86

10

mizexe.apk

android-10-x64

10

mizexe.apk

android-11-x64

10

mizexe.apk

android-13-x64

10

mizexe.apk

android-9-x86

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c87e9f6e8d1a099e015bffa68ed157792cb0c6de562ccbf20607f30772adb512.apk

  • Size

    8.3MB

  • Sample

    241129-pd2ahavkf1

  • MD5

    bf5284bde7432eed1d3235e8f8c8a552

  • SHA1

    a7435be13d888dfa67a093a8896288effc5c4e3d

  • SHA256

    c87e9f6e8d1a099e015bffa68ed157792cb0c6de562ccbf20607f30772adb512

  • SHA512

    bed6124909fe7c3c668c929174ab932dcb3e576639d594442cffad833e6f53d14bee645a3e0e7dc9d69887249e54e961330956b3c4247307d0ad03f91356fcca

  • SSDEEP

    196608:vIU9mDrvGCm0GcqeVU7/HOUe5iO0VIKp0cpUJ8:l0+CseVU7Wb5iRVI1cf

Score
10/10
antidotandroidbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencetrojan

Malware Config

Targets

    • Target

      c87e9f6e8d1a099e015bffa68ed157792cb0c6de562ccbf20607f30772adb512.apk

    • Size

      8.3MB

    • MD5

      bf5284bde7432eed1d3235e8f8c8a552

    • SHA1

      a7435be13d888dfa67a093a8896288effc5c4e3d

    • SHA256

      c87e9f6e8d1a099e015bffa68ed157792cb0c6de562ccbf20607f30772adb512

    • SHA512

      bed6124909fe7c3c668c929174ab932dcb3e576639d594442cffad833e6f53d14bee645a3e0e7dc9d69887249e54e961330956b3c4247307d0ad03f91356fcca

    • SSDEEP

      196608:vIU9mDrvGCm0GcqeVU7/HOUe5iO0VIKp0cpUJ8:l0+CseVU7Wb5iRVI1cf

    Score
    10/10
    antidotbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencetrojan

    • Antidot

      Antidot is an Android banking trojan first seen in May 2024.

      bankertrojaninfostealerantidot

    • Antidot family

      antidot

    • Antidot payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Checks the application is allowed to request package installs through the package installer

      Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

      evasion

    • Queries the mobile country code (MCC)

      discovery

    • Requests allowing to install additional applications from unknown sources.

      evasion
    behavioral1behavioral2behavioral3behavioral4

    • Target

      mizexe

    • Size

      6.8MB

    • MD5

      736e623e2e85ec7b1360e9df07ab2fb8

    • SHA1

      4825b020d9a719fe275088f39642e0290d0d6b3f

    • SHA256

      6136a6ff061aa378e346bd61a6b90a992c61a5844f7fa47a2678dc262be50a2a

    • SHA512

      e9a529525f2c183d1a89b3060e5b52d76ba18c37ba5a9782f28eb41e718fec744df9df3620c9dec95cc8b390a568e290e58a3a036a33baaeb42f4558affb5867

    • SSDEEP

      98304:2wo/Krsr6OxRnQ0OiBofffd8hbaWBvl2ieSyeTgnrSsGlosFj1ORv:2P6OxRnJ9b2YErSsOos1kt

    Score
    10/10
    antidotbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencetrojan

    • Antidot

      Antidot is an Android banking trojan first seen in May 2024.

      bankertrojaninfostealerantidot

    • Antidot family

      antidot

    • Antidot payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Reads the contacts stored on the device.

      collection

    • Reads the content of the SMS messages.

      collection

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Requests enabling of the accessibility settings.

    • Requests modifying system settings.

      evasion

    • Requests uninstalling the application.

      evasion
    behavioral5behavioral6behavioral7behavioral8

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1
T1603

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Scheduled Task/Job

1
T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

1
T1628

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Indicator Removal on Host

1
T1630

Uninstall Malicious Application

1
T1630.001

Input Injection

1
T1516

Subvert Trust Controls

2
T1632

Code Signing Policy Modification

2
T1632.001

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

System Network Connections Discovery

1
T1421

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Protected User Data

2
T1636

Contact List

1
T1636.003

SMS Messages

1
T1636.004

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks

static1

Score
6/10

behavioral1

antidotbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencetrojan
Score
10/10

behavioral2

antidotbankercollectioncredential_accessevasionexecutionimpactinfostealerpersistencetrojan
Score
10/10

behavioral3

antidotbankercollectioncredential_accessevasionexecutionimpactinfostealerpersistencetrojan
Score
10/10

behavioral4

antidotbankerdiscoveryevasionexecutioninfostealerpersistencetrojan
Score
10/10

behavioral5

antidotbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencetrojan
Score
10/10

behavioral6

antidotbankercollectioncredential_accessdiscoveryevasionexecutionimpactinfostealerpersistencetrojan
Score
10/10

behavioral7

antidotbankercollectioncredential_accessevasionexecutionimpactinfostealerpersistencetrojan
Score
10/10

behavioral8

Score
1/10