Malware Analysis Report

2025-01-19 06:50

Sample ID 241129-pd2ahavkf1
Target c87e9f6e8d1a099e015bffa68ed157792cb0c6de562ccbf20607f30772adb512.apk
SHA256 c87e9f6e8d1a099e015bffa68ed157792cb0c6de562ccbf20607f30772adb512
Tags
antidot banker collection credential_access evasion execution impact infostealer persistence trojan discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c87e9f6e8d1a099e015bffa68ed157792cb0c6de562ccbf20607f30772adb512

Threat Level: Known bad

The file c87e9f6e8d1a099e015bffa68ed157792cb0c6de562ccbf20607f30772adb512.apk was found to be: Known bad.

Malicious Activity Summary

antidot banker collection credential_access evasion execution impact infostealer persistence trojan discovery

Antidot

Antidot family

Antidot payload

Makes use of the framework's Accessibility service

Reads the content of the SMS messages.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Reads the contacts stored on the device.

Obtains sensitive information copied to the device clipboard

Loads dropped Dex/Jar

Declares services with permission to bind to the system

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests dangerous framework permissions

Requests modifying system settings.

Checks the application is allowed to request package installs through the package installer

Queries the mobile country code (MCC)

Requests enabling of the accessibility settings.

Requests allowing to install additional applications from unknown sources.

Queries information about active data network

Requests uninstalling the application.

Performs UI accessibility actions on behalf of the user

Schedules tasks to execute at a specified time

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

Checks CPU information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-29 12:13

Signatures

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by autofill services to bind with the system. Allows apps to autofill information in forms. android.permission.BIND_AUTOFILL_SERVICE N/A N/A
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards). android.permission.BIND_INPUT_METHOD N/A N/A
Required by call screening services to bind with the system. Allows apps to filter and manage incoming phone calls. android.permission.BIND_SCREENING_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-29 12:13

Reported

2024-11-29 12:16

Platform

android-33-x64-arm64-20240624-en

Max time kernel

149s

Max time network

140s

Command Line

com.tidezu.exabyte

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.tidezu.exabyte/app_bunker/Mb.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Requests uninstalling the application.

evasion
Description Indicator Process Target
Intent action android.intent.action.DELETE N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.tidezu.exabyte

Network

Country Destination Domain Proto
GB 142.250.187.196:443 udp
GB 142.250.187.196:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.212.238:443 tcp
GB 216.58.212.238:443 tcp
US 1.1.1.1:53 anmavelco.online udp
US 199.119.138.24:8800 anmavelco.online tcp
US 199.119.138.24:8800 anmavelco.online tcp
GB 216.58.212.238:443 udp
US 1.1.1.1:53 rcs-acs-tmo-us.jibe.google.com udp
US 216.239.36.155:443 rcs-acs-tmo-us.jibe.google.com tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 172.217.16.234:443 remoteprovisioning.googleapis.com tcp
GB 142.250.187.196:443 tcp
GB 172.217.169.68:443 tcp
GB 172.217.169.68:443 tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 udp
US 199.119.138.24:8800 anmavelco.online tcp
GB 142.250.187.196:443 udp
GB 142.250.187.227:443 tcp
US 1.1.1.1:53 anmavelco.online udp
US 199.119.138.24:8800 anmavelco.online tcp

Files

/data/data/com.tidezu.exabyte/app_bunker/Mb.json

MD5 6042c42af03f6b3dc8c2840c46e18272
SHA1 f42972b0ab7020dd7645b29defacdd2b5dbb4fec
SHA256 a0195f11d4a9abe20d00c271054eefb1a5dedf89339e5c2e63f0a64b27af779f
SHA512 79e79e508dd1db847d9e6301250afb40aef0efaacb86c6a4d5710bd1f94e7e91b723fada328591dbe22eeec32a8711ba5dc898ab32d7e359698fd469bd00c00a

/data/data/com.tidezu.exabyte/app_bunker/Mb.json

MD5 c3afb26e7aa1e8d5b22f788ad7ba717b
SHA1 a9073c68b81c0777aad654339d96c504bb2b5043
SHA256 8294c78f37a42e441510d9219d879fc3f716c178d920a36d889c2f27dd32c16a
SHA512 bf317c40bc18691d50311e6331a8ba61369de0890e1e38996abcc84247ebc12362743699f80f4c6ee6c6934479425a978d5822836f3c7ea052f7d1758af6001b

/data/user/0/com.tidezu.exabyte/app_bunker/Mb.json

MD5 0edd7a71e7d6108c5bdb05a1b019408a
SHA1 f1990fe3c97a703f4f47031c2b854144792e97a3
SHA256 b5775b7bf2208a5dbddefd87f65fa13e5002546ef0b2df7921c2c12fb5db184c
SHA512 e78153524c713ffabd25745a903c551ea219c86f5444def6db2742bbd49cdb5e7f04c48684b204713c5b3afc6b9d3bd363a64f72b656e2367cebcb8289c9418a

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-journal

MD5 3bb8aa5594623c782b54d2f7a61eeb03
SHA1 158dc332b1f2dec22c0ad15f36c3a1c886d4b2a9
SHA256 810cf74ed5788ae4819ee0a88dbdfce7e3444f07359e655e42fe79e605ae6191
SHA512 be470ed437a6e408410bfc7676ebab6c795732d9e133366ce2c9fec3992d1090f70b4dfa5436d41465dca706fc1088cf1c553e678a9b8893525086cc3f68017c

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb

MD5 5016c962786a27bd634ef171819f1068
SHA1 5867062822ef57f51f3d9d3d64f5cbf080b745a6
SHA256 48e303c8789f2c92ba447ab323db4f6a2cd4342110d3be46487a4349f4f76f57
SHA512 1e13a5711649a4f4e5e35aa57666cf596a29f3a2ea6773d069e36bf2c5255b708b0192de7e3f7b762ad02348f107b0a2920e4e2b9dab812c7a3bc2a0e93bced4

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-wal

MD5 92957e783930625dd6adc603e92e2d80
SHA1 499f594bb2420b9268da3984553b5566519e2ab0
SHA256 a9b39a78ec2d7e0eb6a7917e74acfcd2afc8194c96fa97ee626c98c5fada2f00
SHA512 4fcac90dc06368870a7935317ba6ffde228c618146921caece11f39981d5bae9b3907edb19945909c8349445a92098e5e2990b2dffd24a87d23f6b4530f43499

/data/data/com.tidezu.exabyte/app_bunker/oat/x86_64/Mb.vdex

MD5 44e600b50fb83d77c1eaa7b70cfabbf9
SHA1 d47a7189f41e1fa51435ecb61080b3ed845931f0
SHA256 c16e329f7ee3b92e6725a03f7ab6a6b4506254245b51103696c17ed35bcceb9a
SHA512 3a055a4c8691e6e5308ecd4b1c615f4191cf2bf70ce134355b33e9896c9da9764f1e39311ec4c64506b886fa175e0eeaa54ed552f19125bc1e90b9b825a5c31c

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-wal

MD5 af69ea02866c10393cbb57817bfb4eea
SHA1 22d7cb403017933e74a12e3da804f4a900c8ebdc
SHA256 2d3c208f381eb8641c28460ef167838fb12c20fa457cb97cf95a7f87cd46affb
SHA512 33e2a52e1c7265a63224f00e40ae57c075615d76339dc0a5c5d04d6e625d590970be2419c7ac8ac28e1caa8be251a75f0ac52e1fb02d415a8207aa0efba5bacf

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-wal

MD5 d2b2bcf50d361873011873bf230da01c
SHA1 cbf5eccc85e5fcf8e4475064fee9c64afd728a71
SHA256 24a0b2514ab01954fe7fb209731dbd99c0b22ddf62ed11566282b8ad20d9853f
SHA512 66637dd34f6717d1438463b3542c9cfc81c8efa951b43001e5ff10181d0c982f26902ca1536018f79169fa075398e07806731f552e580c5e44ec0634fbe8ccb6

/data/misc/profiles/cur/0/com.tidezu.exabyte/primary.prof

MD5 a764a1abd677a2d34fa073c40938648e
SHA1 97c6d76371f2812e487361bff316d1356a37787b
SHA256 e7adc9f59a719113db0c4c5eef461e5edf68444151a862f020bdd1662e7134fd
SHA512 60d2edafb2d3f434069abce1fcc5a6b3a09fa257889144b9cdce06f75363fcaad929b7ef13bc3bc0e4747b478942b1604500befb499d9572dcc573ac1c281139

/data/data/com.tidezu.exabyte/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 7d62cd7c2ea05029da672cc45b3a3c7c
SHA1 9b00d51eae06d2ca7ec52190111e887e76ab106d
SHA256 377405e8dc3a506b510506ef968c72658e9d4dc1c037fcc687c1d78eb0a3e731
SHA512 a53d298a08344d6309d40b32cb190d5c5a1ec20ba478be63dc52b2206e209b6fce761f6fccfc7aa276cb5aceab9f6bc26882192634dbb4e4dbbdcd71d6233109

/data/data/com.tidezu.exabyte/files/profileInstalled

MD5 468892f5c2b4faf0ab59624895a7a257
SHA1 7ecd4d4814084511f4db40d527ec3adca8f3cfa2
SHA256 88669d31d84f6884092a94298b939060a4410cb30b3fae6b176156d4e0e72a0d
SHA512 ecb6b1ff87724d89a5f8dca3153350a7fc2494b54bf182704e8092f5fff16168c0a8c317e064842ce55bbd9b98817e2e36730f543af1ce5a180eb2624e2d7be7

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-29 12:13

Reported

2024-11-29 12:16

Platform

android-33-x64-arm64-20240624-en

Max time kernel

149s

Max time network

133s

Command Line

com.cebugoyi.boot

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Checks the application is allowed to request package installs through the package installer

evasion
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.cebugoyi.boot

Network

Country Destination Domain Proto
GB 216.58.201.100:443 udp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
GB 216.58.204.78:443 tcp
GB 216.58.204.78:443 udp
US 1.1.1.1:53 rcs-acs-tmo-us.jibe.google.com udp
US 216.239.36.155:443 rcs-acs-tmo-us.jibe.google.com tcp
US 1.1.1.1:53 remoteprovisioning.googleapis.com udp
GB 216.58.201.100:443 tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp
US 172.64.41.3:443 tcp
US 172.64.41.3:443 tcp
GB 142.250.187.195:443 tcp
US 172.64.41.3:443 udp
GB 142.250.187.195:443 udp
GB 216.58.201.100:443 udp

Files

/data/data/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 080271ce7feb60cae959fd4d7deff760
SHA1 c998597ff824b12616176ed54accb799d8a3ab61
SHA256 09cafd41f55569d1479180e82f5fc49edc4753b433f1966e29f7741ef5a1e678
SHA512 76479896532a7f44fb23b2dc8ef809c7d534b579e6dddc84a9023c441b505d326c80a402925bc0b10db562af11827635cfda50129a45603abb067e90db6a9723

/data/data/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 5b66d9d1f5c2a9685a266a1e90a08ae4
SHA1 0f466553e006602563fbea49628dc6e1ef16d393
SHA256 5ad06bc979c18c250d45bb10d76a109aa07dacbf6165f999b384466313fd62e7
SHA512 3c6e47c5caaf6b50bb02572b6eb7d7417286b822abdebef15a87f4bd4907dab571e74a33b41dc0bb401a6804837fbd76ac9e939a9f21a60ae818c45d11926dfe

/data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 63fe37a8e582054fe3a02be377b86386
SHA1 adecc8c1c1a3e194bf33263aaf6dd46ebf19575f
SHA256 134a686b6041351fb4911124112977e8d0531c40e3803e5a4557745afa62f7be
SHA512 6f3ebb038d464c6e960777d31c4cb8d974be79db58ca0123bb99ffed09d0eea67f183023579a738bbd4621a3837bc4fc019d5ba5ba4796901f9a7b70e61c5a6b

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-journal

MD5 8ee4dccb28ed729a694975e35e794f51
SHA1 cdf3adb47a4c1f4b08291d081bc371df863abce8
SHA256 af9a9438f37e91a7f685313376df34f61a737a3bc725c81afe4ee1a66d6f8144
SHA512 4999a548e4013b4a99460b0bfed5555f9f175ace92a1c2e6fa486b6a68759d857264f24dffe124a37797c9328782acd1aedee5f887c2faf068c86b9781454124

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb

MD5 dba73700b9c929743a6f8e794304b983
SHA1 fc801a4657f92920ca426ea90f12a50b0834ad09
SHA256 912d447a17d4a41edd74e3e5e3866c9ea43ca6fb13086221f421ed9c430f7be7
SHA512 c8164467a9939559facd00ac775fde938b4ddbd055a87f10603e12bb0c76f925549580347d484a71e987fe54173f3cbcb719e59d35d27003bb19de1676ccbeb8

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 d7090c091de0b4fb0fac8c76a64215b9
SHA1 10ee207917c082984149a58563f452c2e9a39acf
SHA256 e3824766acfcc1e8627a0935295d4f414e3655c543557ae1d264f04a3987c76f
SHA512 bddd63643107ab7cc59d4f9ba7272b3946d2eb9a44668f0854aa92dae64fed72fdba43f7247d5a7c0cdaafea1aa8fc83fac74403a173c645d8ea14aa2fee1c4d

/data/data/com.cebugoyi.boot/app_security/oat/x86_64/qYqbtti.vdex

MD5 562af73f702c80ec1a6a516a0de8a06f
SHA1 083c0ccec4d07a406d465c376de9ec4d7fcc02c0
SHA256 3c488de633e76b564376220533e464809b7a07305ea8a0353fd97706de58d383
SHA512 b9012832048a3034039a76acda737ddcba7b68f846370c31779e9943d1aeb8bdde297b83f2a5af40e0806cccbba1dc08bf3d76bc2047bd44e532a11d5b2fcd5f

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 b9b563ceeeac7d87b3bf0498a9df2f68
SHA1 f3572ded6062b2a8caa299f584e2cbc2737d550a
SHA256 27c5b204c00864aee3fc9eddb9bfdf70c1b2524fc30eac204357ca3659277b61
SHA512 5e253b24c5c2eccf4eb121e65fb9e1d8a333812b8b2ca512d8ff0e382364aee645046005860c2aac637ea9945243ffc5b5ae1aae06229020b449d123ca39b401

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 66f5c02e4244153da3cc8f059b13a754
SHA1 4e9a8d0f4ae7ce0b1ec882501094177d306cb11c
SHA256 cdd6124cdb6256e4a7feb33fa2fb58ec71584620247bd5243fc4e3bded9606df
SHA512 30eee4d7e5ba479cb36df3cd2fa13ff852a997ac90efd9cd6615255376eef3f70e7da13e65740a4a19ef13e3b7d06ff755f1f1ec2f975c6557d3f7b9a405597e

/data/misc/profiles/cur/0/com.cebugoyi.boot/primary.prof

MD5 d2116dd0a6733a5c79866af78474959a
SHA1 b80e2a8cfccfcf7453bb7e8cb3d0d314a8d584e9
SHA256 66e7b1bcd17c1141d39edd06086269cf61e0d9e9868a2545c9e95a58cf956b58
SHA512 9661cbf85e53cd6794889b59f0976289cd85ffcf8f1b11efe5d6638b26ca9f1cbfa5445645c374c2c41996f571681bd556bf5b904dc3cb185e7aea6fcaa18058

/data/data/com.cebugoyi.boot/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 e526be5e2253b82ccac25965819ff8b5
SHA1 bb08c3ee9786625cbb5f3c939176e3b971dcdccb
SHA256 9e22c508bff2bff05be6664528b6cdc364a27bd1344309219232b438b7d4589a
SHA512 4781d18a3a6758153806e8a87bb4939c323be691fd62b37d428fe7490444e2fbfed8799fdcb18de1e225db99b3a316891ce3370780232d4742a473b81d92db24

/data/data/com.cebugoyi.boot/files/profileInstalled

MD5 0c5a922bc0975b19b2a6fa4928169a0c
SHA1 cd974a47c2d04bd95d6928c4295d33279f93b81b
SHA256 cd79ab70ea5c948c2de2c87ca771c93cbaab68dd29f6f290db446ec972d394c6
SHA512 f1392b6d135dac74d471d35e078c5a2a728d37d6688fe58e6b9e91290db70b992eaa0a9eaeda5362aba4b8d8cd6f99e7bab4551916f8ba722ab9270230b96ad6

/data/misc/profiles/cur/0/com.cebugoyi.boot/primary.prof

MD5 f743dce63c082268f98f936f980fd9de
SHA1 a0f07574f4dec95ba5f0f4ad3ae26f01ef3a6b30
SHA256 178eedb172d2bec98042e8c128fb2cb2deedbf442aacc513731351bc83f82844
SHA512 d74f4d3dec2f0576fe64df96a3f6c42d6b605c5a7c19be29c27641762f13ea60294afca272304cab6edf35644bba19d30166e138cde55946378c004b9804eccd

/data/data/com.cebugoyi.boot/app_security/oat/qYqbtti.json.cur.prof

MD5 adb2e4aec2bf4a0443ca82402649e8a3
SHA1 ae186957c5fa08119840b1dc7c5bd3911b2069ee
SHA256 181e4fc5407d046da4c7cfa03f5962790f855f11e938771bc39e67092a3f0701
SHA512 5e73fd0ab2bfc41f0167258e7001861722bac203b4038fc891a3c6269b9da5640cad58f495cef79a975a8243a88687a8abe1ba9d50d139b4895451d28ff36ab5

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-29 12:13

Reported

2024-11-29 12:16

Platform

android-x86-arm-20240624-en

Max time kernel

149s

Max time network

151s

Command Line

com.cebugoyi.boot

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json N/A N/A
N/A /data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Requests allowing to install additional applications from unknown sources.

evasion
Description Indicator Process Target
Intent action android.settings.MANAGE_UNKNOWN_APP_SOURCES N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.cebugoyi.boot

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cebugoyi.boot/app_security/oat/x86/qYqbtti.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
US 1.1.1.1:53 anmavelco.online udp
US 199.119.138.24:8800 anmavelco.online tcp
US 199.119.138.24:8800 anmavelco.online tcp
US 199.119.138.24:8800 anmavelco.online tcp
US 1.1.1.1:53 anmavelco.online udp
US 199.119.138.24:8800 anmavelco.online tcp

Files

/data/data/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 080271ce7feb60cae959fd4d7deff760
SHA1 c998597ff824b12616176ed54accb799d8a3ab61
SHA256 09cafd41f55569d1479180e82f5fc49edc4753b433f1966e29f7741ef5a1e678
SHA512 76479896532a7f44fb23b2dc8ef809c7d534b579e6dddc84a9023c441b505d326c80a402925bc0b10db562af11827635cfda50129a45603abb067e90db6a9723

/data/data/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 5b66d9d1f5c2a9685a266a1e90a08ae4
SHA1 0f466553e006602563fbea49628dc6e1ef16d393
SHA256 5ad06bc979c18c250d45bb10d76a109aa07dacbf6165f999b384466313fd62e7
SHA512 3c6e47c5caaf6b50bb02572b6eb7d7417286b822abdebef15a87f4bd4907dab571e74a33b41dc0bb401a6804837fbd76ac9e939a9f21a60ae818c45d11926dfe

/data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 63fe37a8e582054fe3a02be377b86386
SHA1 adecc8c1c1a3e194bf33263aaf6dd46ebf19575f
SHA256 134a686b6041351fb4911124112977e8d0531c40e3803e5a4557745afa62f7be
SHA512 6f3ebb038d464c6e960777d31c4cb8d974be79db58ca0123bb99ffed09d0eea67f183023579a738bbd4621a3837bc4fc019d5ba5ba4796901f9a7b70e61c5a6b

/data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 8587947cc481d0307c8b675b35c42a0e
SHA1 7031d09c64d46b9dbad3bdf64fa47fb0094db91a
SHA256 3e744502d5ea9b220ad8bb3bfc17221ed234bb8db3ccc66fbcb485a1f5e4209e
SHA512 04d46b66a44286588cd4a09e33305819d410a53f3b4e31adef03b0a8bdc609970479814df9aead2a8bdb6d037aa018ab4b7cb26c19ff93a7f9a5447f17868974

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-journal

MD5 9242e1b8549f715e101139645831ba60
SHA1 3a1628855ceb556d7d59573e392ed5aed810faba
SHA256 9ca8c7c19be075d6f20b14c3cc8ba4ff7279413719e05e26e968b88ef62039ba
SHA512 16065154b047b7351ced284a4e21fdd48f7a82ec4766de1537fce3e50700a716776a9cd26eb44f419daea43dfde63d780c8680b3444d7e873b3a6ec79cbea146

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb

MD5 7acc5aed11cba67b576da392c74b16e2
SHA1 cf0ff742c1309f63eb49e3cac1640ad2fb6ca3ae
SHA256 02517eaf75d2fde90146346507af0275ea58223ce96b6743c63d0d68d37e988a
SHA512 077067199467e9ba5d99f93ce8698a32bce85f00a9ab51ccaef5a906fc7ea421f03ee05db30e1386b5f00bc3e6dadd61f4d60af0e103967ac0de39126b5cee48

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 7c7c49bbbabea5f9d6ca5d426d831691
SHA1 3d9bd36501aa316f7c2b77f557e48dcf2efcfaf9
SHA256 241c98574180580ffd996a12c65ab9613e0cc0074744df1a4b00021230583dae
SHA512 264501b225d4d9ab21fcf669ff57349eaed372aa3e3fd0e269d1484fdade5f5beabe2410d00ee336905898801dbdcc419e95c5ddee78233fab8b959894bf8b67

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 803918b04ca67ddd2cc33591b8bd7bdb
SHA1 47d15c512200255ced66d79c3fb3fa6017cef705
SHA256 e8826628adffc082ffc3f28239536842bc6e42ca514be3e5abf3466cf80bb66e
SHA512 7201ac085632527d57da11be3d7fbef3d2bb5c806d856450b5d5508b4772d1c14a739bacf1d0da74104a296f53047899108f0d78a946035adc57d3ee1c6251e1

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 3d1575048347e29dbaf6daec2b10769d
SHA1 b6332ae7d1d96b24157592698300aab2c5bb6fef
SHA256 b5c7d46c8acef65d8ea855fbe937aa86b2de7dfc145301333609674ff6512b7a
SHA512 c00a6f0ba6f5e5d9f5ea39d15457a3bbdd9ed5d4061fe4e13a60552aa2eee834eb3c215ab3efe6eb3ebb5430e8968aa03366051d535dac126f2a391e201ac2fa

/data/misc/profiles/cur/0/com.cebugoyi.boot/primary.prof

MD5 40daad7d244cefa8aceb8a8626083a5d
SHA1 a4e0363eefe23810f504d91c21208844610a8c0a
SHA256 39ce994e24fdbdd727e4456c32dc1c4242f9a2441125c8806efd34b7d7c4b09b
SHA512 bdfbd1b56f88e583aa02b17740e36697c9b2167bdabd7f51470fdf0fa4ee6c83c349f0e1b9a31982d91d6a02b45efe8beb5f319c91eefbc651b32f049a716e50

/data/data/com.cebugoyi.boot/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 b142ef029bf83c240debb3ee4f7df3ad
SHA1 ca61ce72391af041f40df70e62ea31a3cc69ade0
SHA256 14bdb875d9f3a10b8496ca92ea06b98d0b1c6e32facb534333ee6800570a9eb2
SHA512 97fd1aafa642f3f6da20acf0aed3024a9333429010153cd7aa2510b5e68646d5d2fab9564d75f23d7b121cd7d3fd69c702e041ee2a2b8a6f1da6f39a239e62b5

/data/data/com.cebugoyi.boot/files/profileInstalled

MD5 04b45cab617ac7469fa9c9ab8f8e0a7f
SHA1 c43799b23854381ad4d029872665c553d579af3e
SHA256 e099c9b6e5f3dea6c799d3477b272883d8c0051cf3af1b7ee2a644f2c4f02d54
SHA512 000beeac8576c82d714400dacd7bcfed4328904010e755974f3717010332d8f5b3e8922881d5878c0a6fbfda6ec1670830cc3de21766f80fac923fa6331e089b

/data/misc/profiles/cur/0/com.cebugoyi.boot/primary.prof

MD5 fd00909f637dcad5264cd7771af72bf5
SHA1 e44b7d8c16b0b6141efe8e0b29c2b9e7bc0fc30e
SHA256 d61f650e568d47498a59ddcc3195d52a15901eda18c9d9fa7b1b03aa68fdd18c
SHA512 6d2439c3598befe0100bfe9670e0d82db1af893d1dd27c11354319e5fae0eaeddca3b074041c132d90a181d76dfc902de4571192ff7dc874214bfed0374bb8e5

/data/data/com.cebugoyi.boot/app_security/oat/qYqbtti.json.cur.prof

MD5 704e6e5f0e2fb8e02f0fb856ee32eb6e
SHA1 f2ba1b39363b6a99c208814cf64d13ab9eaf4138
SHA256 5c1b3cf6e18d261397ea6a2b29f6ce82e716fdba8869ae3ce2c65915e0b0be86
SHA512 87de67c6b84a6bae6095bfde3a2562e6aa3b595546408632ec68c5eeb5698c016a2d281396a1fc21e8e4c71911671223c7161aa2eca690f92fec3d5cd0e976ca

/data/data/com.cebugoyi.boot/app_security/oat/qYqbtti.json.cur.prof

MD5 42335261abfe1b74a4398b06eef249dc
SHA1 d1c45933b935514a8b6f48314a1af30cd4ca7d3e
SHA256 732bba900c9f8b8018b134290a11437ac9bf6226ce1185e4a6a3f9f746cb2ef0
SHA512 db459426e6a9ce981dafc07a215ec809f16b09a4b0576701fdebbf546ff9dbd097e71aaf5752579a8b8f2d29cd3e66bfdc159dfabbbce5669df2c5bba109ff45

/data/data/com.cebugoyi.boot/app_security/oat/qYqbtti.json.cur.prof

MD5 537eccb37d92968ed75a89bcd78082bf
SHA1 82a8220893374bf36c518c4fcdc00bfba4bd63eb
SHA256 35ac95b2c0adc507a9819c5d549a7938fa570311689f81d7d61602c1a68060f4
SHA512 3906be845f929c890229aeb0c848996f856039c24379ade44af14d50b99f800e4e3f78c5bda8dbf9233a4979032fa364f634edd2411292ab1931ec5123b892a0

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-29 12:13

Reported

2024-11-29 12:16

Platform

android-x64-arm64-20240910-en

Max time kernel

146s

Max time network

150s

Command Line

com.tidezu.exabyte

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.tidezu.exabyte/app_bunker/Mb.json N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Reads the contacts stored on the device.

collection
Description Indicator Process Target
URI accessed for read content://com.android.contacts/data/phones N/A N/A

Reads the content of the SMS messages.

collection
Description Indicator Process Target
URI accessed for read content://sms/ N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Requests modifying system settings.

evasion
Description Indicator Process Target
Intent action android.settings.action.MANAGE_WRITE_SETTINGS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.tidezu.exabyte

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 www.youtube.com udp
GB 216.58.213.14:443 www.youtube.com tcp
GB 172.217.16.238:443 www.youtube.com tcp
US 216.239.34.223:443 tcp
US 1.1.1.1:53 anmavelco.online udp
US 199.119.138.24:8800 anmavelco.online tcp
US 199.119.138.24:8800 anmavelco.online tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.178.8:443 ssl.google-analytics.com tcp
GB 142.250.187.193:443 tcp
GB 216.58.204.65:443 tcp
US 216.239.34.223:443 tcp

Files

/data/data/com.tidezu.exabyte/app_bunker/Mb.json

MD5 6042c42af03f6b3dc8c2840c46e18272
SHA1 f42972b0ab7020dd7645b29defacdd2b5dbb4fec
SHA256 a0195f11d4a9abe20d00c271054eefb1a5dedf89339e5c2e63f0a64b27af779f
SHA512 79e79e508dd1db847d9e6301250afb40aef0efaacb86c6a4d5710bd1f94e7e91b723fada328591dbe22eeec32a8711ba5dc898ab32d7e359698fd469bd00c00a

/data/data/com.tidezu.exabyte/app_bunker/Mb.json

MD5 c3afb26e7aa1e8d5b22f788ad7ba717b
SHA1 a9073c68b81c0777aad654339d96c504bb2b5043
SHA256 8294c78f37a42e441510d9219d879fc3f716c178d920a36d889c2f27dd32c16a
SHA512 bf317c40bc18691d50311e6331a8ba61369de0890e1e38996abcc84247ebc12362743699f80f4c6ee6c6934479425a978d5822836f3c7ea052f7d1758af6001b

/data/user/0/com.tidezu.exabyte/app_bunker/Mb.json

MD5 0edd7a71e7d6108c5bdb05a1b019408a
SHA1 f1990fe3c97a703f4f47031c2b854144792e97a3
SHA256 b5775b7bf2208a5dbddefd87f65fa13e5002546ef0b2df7921c2c12fb5db184c
SHA512 e78153524c713ffabd25745a903c551ea219c86f5444def6db2742bbd49cdb5e7f04c48684b204713c5b3afc6b9d3bd363a64f72b656e2367cebcb8289c9418a

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-journal

MD5 1fb14991e6f32ff486612636eea86be1
SHA1 b62fa441b4da4ed88356b3f1335a28cc10842c02
SHA256 ed09959187ecf74ad3b3b98f5cc2e1df0fc0234a3d954a569981cae94953872d
SHA512 78a301b746457bdedcbdb780368662fc7411ad41973510633ec26a8dadb04f37a8ec6b71f9b09f71400b9eb40fd36de95a2dee939b65a944deab42af66e4066d

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb

MD5 42fd9f8937aa30d9a704be75733df97d
SHA1 20a7500a6d3cc5e7b3a9ca7f0480fefe4592748d
SHA256 b229e1979d4d8f7c4ef1f1064c2d310ddefce71530470cd4b0b8cbcb4374d3bd
SHA512 c468a45bd1a89786187e6ee5d0f63e1bdbb419a02803792b8051e10e9fd98dc3ef83baf7f9f6d1c3eff1b387b84a8f42c6feace4871a66ab65b55752040e1167

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-wal

MD5 4fd80267d40d62973a8e1717c393ebd9
SHA1 fa80bc8e93fa7ce8a4951924295d1fb25ea1765e
SHA256 06bc8cc1b6669cd00b91b8e634553ed7e351f9c9fe742a6d3c610b50213d3dc1
SHA512 513c50f94604fc6d69dda787f6d2960938cc9fd1cef0dfeef7694e3ee675b840a347841770ea2421f28ecdd953ed008dc69b9bcdd54f9deefadf7d1356e6b77e

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-wal

MD5 485179f73afd8c5d3827590249ce3527
SHA1 bb6ecb1e160f2880e6ea2b7fdb5fe1082fc912a9
SHA256 84621785095731580e60bafe4d1adbe625dfa3498d87d8cb203912ce2a90e566
SHA512 4e08c55529a983aba56ea18e940872d62873a9aac9e8e9708f2e4d87c07361efef66f97ffce25611eb25ae8d5a253ae7069aa8a30c03f591b239fd622c700257

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-wal

MD5 23a19b6f226be15b29c052e9741994c8
SHA1 3ab8ea00167340008fd3c78a14b8fc026b898c3c
SHA256 fd7516491acdb4c2633aa0d6e1098f0cfc62c2b8371ff5246b809a24b02cf8b6
SHA512 18fcf34ec11efe84e4dc9a5f03518557dc67f64cf602095204eec2e432898ec6ad4a333358295b8db7352bf705b80eecca6a6027211bb52b78ddfb92da68fe46

/data/misc/profiles/cur/0/com.tidezu.exabyte/primary.prof

MD5 570aa3d946e5fcddc4beff5585f40cfd
SHA1 4dfc8682eda8a6010894864f86e9f1a26e1b93f7
SHA256 f9a3692909a61e3711e58631ab7607b0e6250e975fd8059b992cbb6ebb298987
SHA512 2de5a6a8b76ce3ba089c1384e93ccab3d0109ca081cd5663822791d2207edca635caaf13ab0105843836bfdd30529a4912bca556385476eb1b624b29e8fd494a

/data/data/com.tidezu.exabyte/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 c83a692808868372eadb78eb313055e1
SHA1 fdd94347e6f6aa2e130b6ac5b962170db06b962a
SHA256 a48d858f9a6386708face6f03b654a9ef1284e067b080466cd51b80c73e336cf
SHA512 4041968b6faf213f12a3297053ccf82915c0b8ddfbe5096631f9c4be06c5c87c12453848a748f5c112fd991f833439aa653ed77f939e68c267fec6371b41b17a

/data/misc/profiles/cur/0/com.tidezu.exabyte/primary.prof

MD5 5894c3d87ffdc4aa14c7b98961148839
SHA1 d603129e3068f8c108952161764e3fcc9055684c
SHA256 268d7575986656b94725715803e8a01454130fbb472590a429d57648f0859310
SHA512 b3270be27f6f0e5deb1f8764be26faba4532dd5e58227e38fb85533746c2a54bc6909ec4c2854e016f3edcd489c1004291efa18e486bc4a684d4ac2eed7a709a

/data/data/com.tidezu.exabyte/app_bunker/oat/Mb.json.cur.prof

MD5 4372e105e9fb3079c4a3b2d6443839f4
SHA1 ae0047be4b9323003957dccbfa74b62219f21f18
SHA256 066b3c7afd5e4c0eceb68a1a365c851360d4374cb1bfd39bc3e322eb6a33baaa
SHA512 56e1b82993d9284a5b2277267434c0bd54929d38e40ce9288ab176ea6c19f767073798b79b8e8b96b5efdbd1be2d776fe1222fdd4a0c2e86b2b94b565b053c4c

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/cKhBTqEFtRkBnQ

MD5 7c6be5a6c5ed525860f9728a8b5b29df
SHA1 a44979c983f7995104942aeb5c1aae4ff1660302
SHA256 b6f929e168284900fe7145d5c269296fe59420c6dab446b33660c84c8df49538
SHA512 655bfa49a3586fedbf7864d6b946876f3305fd506d33fa3a074b7c4be076efdfd6480f78aef98ad50400ba8bd59dc6f7a3d22c39e09763484a413612a742b5b3

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/account.svg

MD5 d1b68e2cd423aba52d74f02573df2d2d
SHA1 9faa2f472eeaa4b61be00b1a0ae2e1de3082e407
SHA256 2041bf4f141ac095abe365c86bb814509ef11dc741ba3b7e70fe60766432110e
SHA512 b1b798397d00943958e8e00cb73243cf40129921efff9db852891b47711f0b32cb616ec1d24a8ccaff939ced0f24399649fcf9c7614d8f880899c7152d9d525e

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/address.svg

MD5 02698a3383765bd3c250471c53a86c5a
SHA1 cf1bb1e4f5dae0c3bb0605b77565bda2c12d75e5
SHA256 a1f675a555609fc86e744fa9d86b35f0924803c10d8d3da2ca01d4171188552e
SHA512 bff93c586263eeb0e70cf8fee862da65d5b28b5590685fae05197f8f13c1567c3d8533c4c7e6c15620f8461b432e9a5ec223d98fe598a52030079375613484b6

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/amex.svg

MD5 4ef2cc1c19c4101a2796ce594e0e7535
SHA1 834159a45ec0f6214a69c989ebcad2b38d35d2fc
SHA256 a8b64f1d1c20dde5f1083f6d97adec85871f517a8515c8541997716edf998f57
SHA512 960e0f4dc9d71f2d25171699ac78fecdafde5e1af0ff46f33b8788d3cac37914fa9f52a8bced580fc9a428cb8c3cf066dae0a57cfa57d674c6cad67ccb260a8f

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/contact.svg

MD5 e28714c71f217892f72b2698ea5cefef
SHA1 e4257063db9df43dcde90920cc3f34978baea51d
SHA256 65845e7cecbf4e88691bff290f72b427b70887e23879f523bbc5b2b032c7609f
SHA512 c693b70d3edcb32daea8bec867bdf34ac2ed491f9cbc4a57a5433f462dc6ef2d0f01a0c17d7dfd457064d13d45207659abf116b09191dfddf38e706fc72a59bd

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/diners.svg

MD5 01e7bd9695ba96d721e4783c6ba4e1a3
SHA1 ac8106708ce31f7c84af48bff2a55e89b67cc47c
SHA256 e5701891ba7b56fa0c339e1f2a4924b1a0fa1ed316221978a050199b03c1a7b0
SHA512 bacc2ee9f69da95153fee3731be0654197f0b737e2b55a6b05c645b9b7f644efa50767526ddbf53d18fbd58618b567092aa7fd1dacaa5682f4e9d5f7cc52ec50

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/discover.svg

MD5 2416e9bff05f99da2ed704ba7a756095
SHA1 a47376b86a8101bfeecd9c8764b83e4940656ab7
SHA256 93464ac55e072d69ca52da614e7cb9409020a548c67100aaec0b1e0b02a285d7
SHA512 1ec32113bd47d6385796acbdfcdb9a859a82fa2494f9405fc48ecd7f0dedee7e250f1d6ee4dc1b2bc03a59ec239349c8b35d7eec788752580e7a37447af6ac94

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/gpay.png

MD5 11b23369789ebe1f42808e05a32229c8
SHA1 dfe8a3828154d7e7f95c4f463402c291ddfeaf9f
SHA256 8f5a52f2f4795d761728c7d65f8ca6c2d6019e9c35a212f8c99a1624c1e9a024
SHA512 94a179d4715f788edbb9461f2556337f6c5164ba4fc94a94af3f90cf2de07ce477aebafb03d5f34437349f9dbeab02a9228564345d4bc3a3ff5256cba87491f0

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/info.svg

MD5 c1b97d74dace7e43a9ccb26841a7cae4
SHA1 83f78c8d77bf9499b7e839345bb94c22a89616af
SHA256 d9de9633583a448cad1268d42ffdf48d0b3c60d2693600b843a7ebe43ad06908
SHA512 b3986af15a3ffb3ab35b8e3c120bc9ba8becd5892cb7c1de0ba5ad08a83499acec288b20708ee834ea43bfe446fd01ada8ca55e0893eebe766241913db11a88b

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/jcb.svg

MD5 3d18424d24a7b251227e9b6987f1bbd3
SHA1 10ed0873d1184efd246c0e3228b55b476a21f9ea
SHA256 b54883a82a539a3cacd87542b555b077c6412948e63618d110f9ae9df448fce1
SHA512 776650b3fcac0ba0537f0f63ee06d68dca3ae78081afa39400b5733f1d1ec8db2d2dc56e4626af9aa7aed243d1dc56180dfe20ab3eca6036bee6481c56c7d559

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/logo.svg

MD5 554640f465eb3ed903b543dae0a1bcac
SHA1 e0e6e2c8939008217eb76a3b3282ca75f3dc401a
SHA256 99bf4aa403643a6d41c028e5db29c79c17cbc815b3e10cd5c6b8f90567a03e52
SHA512 462198e2b69f72f1dc9743d0ea5eed7974a035f24600aa1c2de0211d978ff0795370560cbf274ccc82c8ac97dc3706c753168d4b90b0b81ae84cc922c055cff0

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/maestro.svg

MD5 9e755d978a7472d65917ddb9cbce57a6
SHA1 3cbacaf6cbae4a562c44ac0f46204d085dfb9e9c
SHA256 a0767b76a0ae413400a92b19e02c9c21c1aef23d83b1e97acc7919cea93295fd
SHA512 47125c8d7477152dbc56e744884fa2592121895e76729ae2f1ed080de75039ae09f2f8489ebacd27721c47dceb809034a4cdbbd3d96ced270fdf97f404178886

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/mastercard.svg

MD5 2238ddcab98adf4503001c60167d4cbe
SHA1 8050fb7d63cd4460b926d7d8b3182ce90f8d54ec
SHA256 e50cdea249957d9b947ade44c9df472fabfbc774f2c016e154f897e0f1479e23
SHA512 61bcf239cb5f3fa27839e0c8b89ebb0420dbf856146d95d9455935b8f2e1ef120e41e970bc4c22736a2f08e9db7870d9fcbf5ede64164f5f3253ff316bfc8749

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/monetize.svg

MD5 22cbda60db0d04d1391937f3de1287cf
SHA1 41d34b57971f264e67a14bfe60b37f14caf33c16
SHA256 53608fb0322ebd2eeeabb249123dd295828593ed3fc22cf37b2b3c17afaca64d
SHA512 0c2aec116caee46e1734023e98c02fea908d54e832baa6ef2c2c05d41defd9df8e49f58204c8b479446cf8ca0224f961ea5ea7c26a1a89bb8b08af79a0108aab

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/payment.png

MD5 4561b3bcd407d2c1c8e4f20608345bfa
SHA1 a7064cd1a377091976b32a0c99cd582a80359e3c
SHA256 4a99877468793bce4905da0b7d2ad150e1174c4c994a7c13acba0648346751cd
SHA512 d3c615a1cf83e8cc6ace7ef3b53582c7752ac5d007b66923ceb4260e1150829ee28d33091b67c382dcccbf9fcb88efddafb4976dba2f338f236d6be29f5ec3fd

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/profile.svg

MD5 4f19891c43001db11efc8048f9bc7cdb
SHA1 fb001afc35e6b79d7771dd3893102c14718a58cd
SHA256 4f0d0becd3f8a0496fa98581492b85f53aafdf0cd51e5626b5fd0b6ab2db9379
SHA512 a59528bab7a538e4f221bca27440eb88c873950d1595aa7718ff9613d7ce14ce40cbd29d209b0bcc3c8029360e2bc3740ab723802492e75d13c91a153d7df457

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/repair.svg

MD5 900a793eae04f4bddd675f8d95c4a794
SHA1 d79fe87cc4b220245ab72251dcf3ae4c71108544
SHA256 166eab00b3516b5aeb1bb114fa70d57e0f4e021d4c06735c6969b08c5b7e1fdb
SHA512 e18fc18597424e69987e13e8f4e6e174a56b46c2d1616e203ac9c02efbefb47ccabb39ed999b0df1784cefc0d7444c19e2ddaca30022f45864554f999587de13

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/unionpay.svg

MD5 a65652162457a764a7527f2d0089e534
SHA1 07ab0ceb6d78c27e666277423086111bfb18fc22
SHA256 7c9c351d2a9aa28d60407da1d489d464bea1a42ec154bc76a8f30f6d5057c716
SHA512 700b5600a6daa994f7fe4ff2e5c2ece8c8d7afdd96811f9241e8ae061678f6fb35a66d26a8d0735cbeb1e910ab8572340bd62772aae6b2d4fe5cda334d89bcbf

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/visa.svg

MD5 a7570a902e11170c8cbeb81cc9312db0
SHA1 45df5296f0bf2218fba648ccc21ef1621cd3fc7c
SHA256 44f3387c399f770bed7ba717c63c62f81821a18a1b64cf127d3af0641cf11ff1
SHA512 6905a8e4d35e78d5aa29bb9bd0f7988eabc5bc6c2bb2d92b7dcd5f52ee5232c6f9e9e7fb29c3432233bf2e230c8246f33aa9c778c945d5af64bcd749eaaff097

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/img/wait.png

MD5 5de67c83bd759733af1ab30c6eb198f5
SHA1 5cad48a2fec1a3af6c61b56e9ea2af7cbf289430
SHA256 aec504d9ac9e65022fc800da981f724050e7920af6b31208ccc3a425d11a8fa6
SHA512 41a960f498aa9ced4b64157129d1a9a809a56ff435d249dcfb5b45ccbf7a7834216861081d4ecde09a2f8f579813f13758d107220a8b781023d9b3dde2cd0c86

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/angular.min.js

MD5 57d5ec9bb2a88256b2a8e6e30f6d82ae
SHA1 89a0d3b6f64239119866905507e9bbfe54ccb4a1
SHA256 566f18cb8bc23558701c2cc4f934fe50bcc85629d1aaf5d589f835f2b3e57a9f
SHA512 8e21be2f0241d1b997767e1bc8acd61fac213e99cbcb5a67180fe9dd509714b938209fc5b5f71bdb691ab4f4daa6ddf943a930ae59d185e2ba50f3887498584c

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/bootstrap.bundle.min.js

MD5 0aa8d64e726c4a57adb5c88f9115996b
SHA1 901169527507ff9e662cf64d8e361f359308970d
SHA256 7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
SHA512 ef6583f7684bb3b4f91405e7def90d65f9561baa609540c3a66f3b4de4267d283c2a7af298bd86df447b6ace05993c2182ef47ede4b30c25f79a38ad49e70a9f

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/bootstrap.min.js

MD5 a08792f518b51f0f1422b5c96df9eb8a
SHA1 3f094f010bfb0c022a51b62778d4361d1cad3fd6
SHA256 5c36e28c9a7bd864b673e223db7e1934923227536ffbdf871f58b6f09b9ac8c9
SHA512 6ba72d23ac35920dc9e1d4a39271e3dda58b11b8e2b405c08cb0d1531a36c326260c545ccf6449b90af93372adf0efd3b544a9f27dab032697632d6c8e82a6ad

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/card.js

MD5 6968ba8317f89df6bfcc7e4e8be3c6ad
SHA1 e06a97939b4beba77db9e6b573b9f2837439bffb
SHA256 01f0dd06c9e07e352899f449d22f628a8467c1c21c896aace6b5401e8be984e2
SHA512 6a40cf2ae16850c82254e3c05a701537d925d393b8ddc04d8a1fd348a3b0a8ed6f5175cd7dd2f680a38a96b50bbb9b1705cf923db9b6377a6d8700a129c38cdf

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/cc.js

MD5 01125b91acc77ff11fc966d10da9e2a2
SHA1 c02cc36611d1a7da149e26939e0c256f2061b178
SHA256 967ae1bc5642f6b9eb1b5a8dd790f307006c9e86bd8deeb98313369682bc4112
SHA512 7d904599ac635e45b93e5ef25c31814a91e3a1278bbe66c7eaa7de0cbcaac6d514af0dc93924664226169b64982b3441f601e44289a60e3ac1f6c3fd63e68d8e

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/cc_ln.js

MD5 cf02f00a504f7fdc9a450d866c39adc1
SHA1 3a021e78cdd1b398a422050dac37fa33513db1b4
SHA256 c853fa31a686cdf22ed1281946b1889d89705a0ca063b7e5998ab1f6f1786ee3
SHA512 fd63c9abed8e2555cbcf3739ed36264fe9d546aa7585f64dd8bd005f61b06373b12acccba83813c68911e4a56bfbd0d27312b704b59b47936f309cc4649d8f48

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/jquery.mask.js

MD5 7764eebd3ba64867b2bf91125a52def0
SHA1 9ba23da39ed04c90b294d8ff05cf44800f9e8e19
SHA256 a3f740178522c4412d76e80c3dfcf7571c67f76ddd61d8215f1d8c7a0e3fce9a
SHA512 fcd89569c27ab28a0f59d34b720dc168e048aaf89438bdec5cab5e2ca971e191304ee9fb1b4ee89d2d953384ed2acd4d48e3b379e4e22d87868b2c11f365ccb6

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/jquery.maskedinput.min.js

MD5 7ca9553c56805a72add283b3d73c19ae
SHA1 32729eefa597eddfabe9217e271697d9a0b1b023
SHA256 deb84e22b3cef4ede9c0b7761c41757132def0ec85fe9dba516187fe4fcf9fc5
SHA512 d73990c1a72a1af22b522e6dc6ced2806d8563266b66dc79976ef99b4a7fa5f4a1835f36f6469a698e09dfb06191f408940669182be08232a62da9b667ad8997

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/jquery.min.js

MD5 12108007906290015100837a6a61e9f4
SHA1 1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3
SHA256 c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
SHA512 93658f3eb4a044523a7136871e125d73c9005da44ce09045103a35a4f18695888ecafe2f9c0d0fa741b95cc618c6000f9ad9affc821a400ea7e5f2c0c8968530

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/js/tabsSlider.js

MD5 6e5dc919c9e261a0cc439e5d3df8f5e8
SHA1 716e8e8d8462765f97088153e74a7d95c6e21585
SHA256 a4acf4863fa3d04a0be7fbecaaccbc5606027771bdb870668dad4bae30011fa2
SHA512 ec62de28a77b1a6747d5c1d0cdab4a02fdb1c6e558fed9332145ca7af5fa5f6427448130a9aa481ce7af807e028cfc313ce6a1c182422996c88621d05ba49097

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/animated.less

MD5 08baef05e05301cabc91599a54921081
SHA1 421f2c4e10191f148c13b8a34e5ff3f484d4c393
SHA256 c7035423d5a1e03d36bcfd6465481e4c4d5c91f316fa878a6e5103afe1b0bbf6
SHA512 285de8b339ae691c8c95230462b8760949850ecbd1a4f8b98b0f85347f1187ca7727507a50ba7ee362b57b1ccc94efe57fa99bb501bbea93561ca3104f73084c

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/bordered-pulled.less

MD5 898f90e40876883214bbd121b0c20e9f
SHA1 a2c292137b17406183ad0fdbf4880fd648b9a5ca
SHA256 e3d168a292ba33d4e3215919963a304dc25732a73cebdde6e7ebe4d47ab43eb6
SHA512 666a33697b525aa25d773c94360b96dd6ff833dedf99178af931b040aa93239c5814bfdd433a841d77c2a3addcc444d7ec95c83073b9d30e48ed5fff4e82a111

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/core.less

MD5 fb4efe4ae63737706875bbbfc7b7e9af
SHA1 1a37352286619b789d151a06eb4b7551e4c1aaa2
SHA256 a4a93d598134f656ac6c7a0a5f375afa941e71e348e68ecf3cd6feb7616acf9e
SHA512 88b310200bdd13129f343e8f9b581e3a376fd5aec4c7a604815101774d31ca3fb469d345321aee80303842309b10273885195545f69fb81ea13215e751ef5187

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/fixed-width.less

MD5 5e07ec001f8d21bd279c12ee542813f7
SHA1 ec0c24b97184dab86177660f486b8d08cd636c42
SHA256 0ef853a3192742d207ea0e793dc8bcc6322dcb9e50d41f4b981c4ebac2dac7ac
SHA512 b7bf0de65815043012e95e8b1bac895e85c9a07c047c99ba4f5c132a00ace5aeb3e838f2aac26d8451b38d193fde8199c45d58a2a79931e5bdbda47f15c8822d

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/font-awesome.less

MD5 15cb7faa02437c2f9719351c157fe7e7
SHA1 9ffe7422dc235450a21f019f410ed359ed151f4b
SHA256 2df62305a8a14e09ecad58a155a478f1c8c11318f405360be683219f62b3ea24
SHA512 f5cf809023468a015234142efd754543054f9fabcf06ecb58db792537b8526c5d73098cb059e6e37ddf295895e92ace9005e9c4e5eaab19d33f06ac478c69acf

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/icons.less

MD5 bf95b901c36b646ff457379bdcda94b7
SHA1 0285a999eb1adad868366678c2d9365b77186a45
SHA256 4d585eeee98f4826c547e030a690690ea56a4dede806fc8176342abecd06fea1
SHA512 8735bbdc8c7c9d082c2a1f261c74bed575fa096ba8775ad48ada6894f03a8319414db099395e80f16f6e89d802c988c1a2bbf73252c65acb040c35d40b9ed0f5

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/larger.less

MD5 8cb65280c0f889daf72626c21a7c8628
SHA1 e7119e82dc50540dbc3472bba7d74282815a7ecc
SHA256 dfc79d4325804e9ade21ab65145b23b1c4193d24a893690bc47b5c0739ca3c0a
SHA512 5ba01d3b3c917dfcc0bf20a283397e677d420addb83c74d29f81d77658105c8d9e48784d2e8f5214919877141056a74f06d3081fa291269f92c4506ac089a745

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/list.less

MD5 975571323cf880a4a30601998236b027
SHA1 f53bc20884a1410d950b4a36a330c5181a8b55ab
SHA256 024abb930e6669f215ddee19f58077571f1cabb7aee1274bf96b226c296b73d3
SHA512 a13c48c3ab87469b5e720287f5f1720f0588bb45a0700968879cbba7ba008d070cdcd69b41d374cb504311c0a20bc4e727872855ae5e90fc76b1589104acc07f

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/mixins.less

MD5 fbb1f2f1ab96ba020c7f14208aac72b8
SHA1 3c5b36b0069372b525ed8bbbcf6b3d4d2bed4e78
SHA256 65c4bb7138772043fafd2167b74c0fd7ac15e57ba7877adecde4b0992950670c
SHA512 9fba58dc30953169340a57fcda1b3dcccbe69cb9ee5ad3e29e53719fb185f4b49f9571be248675d5cf5d82f86482086df022283b31b1766090f9954755f7a47f

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/path.less

MD5 a8c41460c42a4fe9e98550f00c8b3f19
SHA1 1afb4a849059631f76ed2a519d7fb1bd0af14802
SHA256 a0dcbbcd3976f59116268c109767c3b98fe358872f6e9fc1a0d26a337d272b8f
SHA512 2214dadd8025d0da912ee4e0366a25b6d521f61ad04cd61c0b13140a9465d7711db8a80e3c83bc5410624eeef8bb2dbd1aba48cc3fa39b75d5eb5e91afbb7ba7

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/rotated-flipped.less

MD5 a8476cdc50c264abd11ff59d6a9dd025
SHA1 95de5de9009714692430b04f9cd4388be8fba8f3
SHA256 d67df95488eec84d2d0caf79727825a8ff4b2df90c604151783e3ec2388dad38
SHA512 a906cde529bac0abc118201866c6e81ceed53ea5859795ebe87e52e1d04f1c32b0ae1dc2a9297e2d6a2cc44a7bbfcdccd01ead571198027430b98190ce5efa67

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/screen-reader.less

MD5 0f881617264587bef0df6ce92253ecea
SHA1 71139132f170ebe7712836210f4d2c4905151899
SHA256 b32ff7821a7b0a649f9202a02eeb8ce88fe671eb52d61ece50aabdbce21110c6
SHA512 7d5c0d28b78b9c24b6af0181f8bf72d1b7bf20c45edbf1594da8b4c8391dd24920b9d0ad186ada7217755cbbabb9bf6ea52acd8ed39f7c9abf4659339eb70504

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/stacked.less

MD5 518e2b2d263982d2caa1e6514b4b4eac
SHA1 f044077bc8be1a989c245254e81eb084d52d29a7
SHA256 3f9de6c3e0f1a2bc71579a417d7c415f82f2a3d3f4792161a8588bb8bdd75450
SHA512 0f07e1507d430c8ade9cbf2460c8148d69fdce6b5b7c659247953e0e0235c5128cec1cd1a329790b9bfa42967cbafd36776d81f6e4ff80520149f8ff4a6ba629

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/less/variables.less

MD5 be3f6eed38aa909483e1bd9ee0876e80
SHA1 8a5c800747705df16117cc598c1b9f512e873bfe
SHA256 e3717422976292d8fdc4b2a9ed02b8d0be55ad50b86e9bff74761e5ccf94b839
SHA512 1691b468571a87081a892621941b3f0f954a3c5a4c588811b329e092bae28a8946f4e0ed5c440c7bd4248d3aa31c3be26867d28771703cbca41cedf5f3f3fc72

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/font-awesome.scss

MD5 8c015559216d1654630a839b61c6b83d
SHA1 dd83648ea5bc832f87c3c1bf956c54dec065a9bd
SHA256 4cb4a00ca08b6e456e09f2fbeecdc5ab13f7c91bcbea263300c814aef3ffcf43
SHA512 e5cd637954db11cc3e86af92ec127847c7476c22dd1e165c56a2816733368f02edff7fb54679ca77574f8fd86778528b6ff51ae0a39701e09b310a84b877580a

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_animated.scss

MD5 39ff4f359a7b81d6585075715f41e5dc
SHA1 8daf189b2f8a404495b8424b6fd1ba630dd1c2dc
SHA256 900e2531ca7544fa8f6e0db9996bd28d3970185ed810717a0a4879da135e5478
SHA512 5d8be64ce5136d02dcc2dc38341491c2cafca5633a8bbcf6bc6931da2ec95e2e29ffddd8a058842da4764620824914f7c7c7048a6c9e54d3e97bd7ab995834f5

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_bordered-pulled.scss

MD5 4cad0df17bf40327feae33fa9a6c6ba2
SHA1 164b6a0a2b307cd293f4a914ab0fcdf643950374
SHA256 d1d28d405b9328313c843f7c1a40951ee1a738d632081beb76a0e072b407f549
SHA512 01095953afd37d399f8715168a67a2e60c23623f3ead4eb4360f8800e30cb9572ee5d90b48ab4d0e07271f75b11da2d4a4cc39115a872e2f001000cfb46a8bea

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_core.scss

MD5 ef059a98cf9de6ca5b77ee6850771cf0
SHA1 55a14a34267edc401b82e5ee41d8bd84fbb5da3f
SHA256 e6e81949b0ac466839c5239a1450967ec32af30eb7c25d1845569621e8a1c8fc
SHA512 78b807ddc8ac17eebfd4f59eb923a7f8bac8e7b76bc83985d593382b1964f1d98539af83c95c4aaf99e3e492304e08d452980879213fc13d9b9f69539f1f74c6

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_fixed-width.scss

MD5 9277ab6964a434d499873687b00be906
SHA1 224417ca266c657849afb2bbcb6dc455894ff387
SHA256 b8b0b3478e04e868ef0cd5fa3fb291524f1932144d1bd3427d156afe369194e9
SHA512 27392694f9bd1a671cd21517721a86c24725c51fcad4acaf09cb75a9e36bea34176af900c82e061eb0ee6b60a1bd0d9e99213119c5175c2f48b6800258ba840d

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_icons.scss

MD5 de9fa842ad0b619a95ac4f42ac6ba930
SHA1 830e0183337d16c07b1c63838f7593a33ee87b15
SHA256 a8f1b5d6a1a1992748ab95412443fb28afc0ab711d86fbdfa7d8a0b00cee3a48
SHA512 b7f5aa12eb8cab73fd506d499f9c871b54d5939058b9ac27b858499f051d9af74a6374b2bc32eb2aecc169f9c2332cb2abd6b56b150d864df1d19ae153f16301

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_larger.scss

MD5 e95931566f6fc6ad5685c4fa9802e206
SHA1 940e1c5ebc690283bfaee92560cf15fabedbf6a9
SHA256 fb4e8e7d5d03074da402f544d36bd6adb6adaed7ad816c4bcb3f53fe03273c17
SHA512 ed6e63e7cdc9bae34810146c3dfd52b912f7b20219555994249f6f3dbd528673af58b69deecd9819f28f71713076c6694f6db0e31148e8e726f714312f404a73

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_list.scss

MD5 7107e80b053928271d5fcf422dc29490
SHA1 4b53ee01513df8b9ce76442b2d8f1851613a435c
SHA256 d5430a6695febcd9e7f5898041aed2b62060d1b8d7b782e0f4975210a0ddf38e
SHA512 d8b110a513c41ba8a00620143aa01b2bca59f21306b64e96cb82e4739ea88beddc0d3ba2679f277a34c89fa5cfa3d4b0f8ac5b16d9beccccae36b2f8450ef75b

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_mixins.scss

MD5 aa2b8f32b403733713d8885f14ab86cc
SHA1 4f3881034a4c11cae8cc915f288477b498a357a2
SHA256 2efe3c665c5fecc6fb3f6acdf185fdc0b1871ad074381fa39b581cafc5fa82ce
SHA512 da84a310d9322e8a4b5e0c739e93a5c66418930930eed7e4a14351b61aa6073465302552642c75553819fe2ea7903ece21b20494761a94daada05bd6fb2e48fe

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_path.scss

MD5 ab5a9e8388563e097b5ce835601f01d2
SHA1 080158aeb1bf6df59ec98b2bbed44da61d9c9ca3
SHA256 0e035e21bbdf7f14f1453fa126aaf39f0b62479471f3cba649a64dd2daa54e26
SHA512 9eaa7d29bb402c790bf1ad40ee849e26743d198bff3cfce0182c2320afd9d47f4377b2bfb147999a057604dcfed33e408065577a516be0f3623fc0df75120912

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_rotated-flipped.scss

MD5 9f5d4bc6fadea89328d2aac26574a9d8
SHA1 ca08a0af3da63c2f2a7d3c27a8747637744cc785
SHA256 ff0686d76acde3581d679be874fbf73a8bcae4110fa7b6c7aa08ab204a7f3b7a
SHA512 89a2a4009628540c88c9375c7f04bade6bb9b901575c12fe22d0031c10011f4c5c3b7834d4caf6b1cfb84501a5a77d5c4e6cebc9a8ff92c8bc6c82ec6bfed40f

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_screen-reader.scss

MD5 8907bd7dbf4799e8120bda5568d76fea
SHA1 2d8563c488f68e75a28d540dd89301ee4ee08c97
SHA256 1c964c84d5ec33fd35918f260ea3503aaaa4b3f1090b342a6e98db6d047d5e38
SHA512 5e3c8df5f64a9ddd9c7dad6f939156090e832a43c4352f7f470169ba22133267931f53100da2a4f4ec5e5528734c5d60c42ebc64fae6a5ee1dbc2e920dc343c9

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_stacked.scss

MD5 5594237226aedfbca2fa1c7f4604c214
SHA1 cf6752ee609af36eb293a7197c88d31ecacbbc74
SHA256 70f33fd079ab708587c63b5884e04b31a3f46fd33923cb046621ff18b1bd99d2
SHA512 25492b5ff68a6d2c8f9ddcebbea75b1f14a7f47d599bea5d75e1f5fabdb5e3d43147e6df2c435c7ea639c094811872e53941ccb79f204026b6fe2cae172df7ac

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/scss/_variables.scss

MD5 dc5261f37a8a01feeb52a746d16c0459
SHA1 0d6d70535104b42e60d7f44ae6ccf9de023a7b8b
SHA256 f2d069a3236338883bc10b68280e0a2c966dad414e26843fea7a35149f95f64f
SHA512 77079c62eb1459ecc6e763e863f02f5faf9289b333cb43b2402bbf822837dba4d6af22d97fcdac68e252cba9758a91386483733ccf690c3d4eb5f1d109794f29

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/css/bootstrap.min.css

MD5 abe91756d18b7cd60871a2f47c1e8192
SHA1 7c1c9e0573e5cea8bad3733be2fc63aa8c68ea8d
SHA256 7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
SHA512 bac54101debafcda5535f0607b5f60c2cda3e896629e771ad76ac07b697e77e4242d4f5f886d363b55fc43a85ea48a6bfc460a66f2b1fc8f56b27ba326e3a604

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/css/cc.css

MD5 d3e8446038c505ae76c852f361d8b562
SHA1 6a23fbd698e72474c6875d88051b800242dbc46f
SHA256 450b3b007ecab3ad5459f46b114b193d3c090eca27d7340aad98ee1aca969c81
SHA512 d62fa41c5fd29d38f2827dd751371e90ba5e5efddfef3f6d1efc77784021abb55999a353bc22554cc2f0354bfb9172639de2738962a85dbea935719e024fce33

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/css/font-awesome.min.css

MD5 269550530cc127b6aa5a35925a7de6ce
SHA1 512c7d79033e3028a9be61b540cf1a6870c896f8
SHA256 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
SHA512 49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/css/fonts.css

MD5 e6929145e4124d3ad81c97b492b6c389
SHA1 bb75fd8b57a6299a1e763092123f7d203e08a50a
SHA256 eba0085017077c5185d33e6d58a43bafb6451377fd75382fc8cf2407ee511ea5
SHA512 da3281e11958b3c7153c77bc1dc4412cb546ebf2964ced9c2ea87a3f3243954bda30d6f922bca6fd127367774fa7f004d4b2fc17897f4a9e43e257623ad4ef63

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/css/tabs.css

MD5 a66f65e9561d14c80544f0818c2ee6a6
SHA1 4c75f03058cb9d6f30d2026cc9b14ab4333d2484
SHA256 9b25ec0e1809299ef4a0c2c1ffeb5aadb673712c283860710c4545e8fb6d14df
SHA512 5749fa2b197eca5a2efbdb7a2ef3537187899973b732486d53ac911ea13afd77103930aae79df409fe50cd5f93dab3025370cdc397a4317c93deda359652e4f2

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/fonts/fontawesome-webfont.eot

MD5 674f50d287a8c48dc19ba404d20fe713
SHA1 d980c2ce873dc43af460d4d572d441304499f400
SHA256 7bfcab6db99d5cfbf1705ca0536ddc78585432cc5fa41bbd7ad0f009033b2979
SHA512 c160d3d77e67eff986043461693b2a831e1175f579490d7f0b411005ea81bd4f5850ff534f6721b727c002973f3f9027ea960fac4317d37db1d4cb53ec9d343a

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/fonts/fontawesome-webfont.svg

MD5 912ec66d7572ff821749319396470bde
SHA1 98a8aa5cf7d62c2eff5f07ede8d844b874ef06ed
SHA256 ad6157926c1622ba4e1d03d478f1541368524bfc46f51e42fe0d945f7ef323e4
SHA512 4f575d52331de91a2e32cc3408dd0eaf0cf25b7244d34b226314e3647e85ce284f86e3b7238c6c8b9022dc4e2787bf51620849290cdcd5d4c4bc905f289d2156

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/fonts/fontawesome-webfont.ttf

MD5 b06871f281fee6b241d60582ae9369b9
SHA1 13b1eab65a983c7a73bc7997c479d66943f7c6cb
SHA256 aa58f33f239a0fb02f5c7a6c45c043d7a9ac9a093335806694ecd6d4edc0d6a8
SHA512 9ffb91e68c975172848b4bba25284678cc2c6eb4fb2d42000aa871c36656c4cebc28bf83c94df9afdfbf2407c01fe6b554c660b9b5c11af27c35acadfe6136ac

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/fonts/fontawesome-webfont.woff

MD5 fee66e712a8a08eef5805a46892932ad
SHA1 28b782240b3e76db824e12c02754a9731a167527
SHA256 ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07
SHA512 9c776dea55a01fd854ea23b3463d9ac716077d406ecbe8ed0c9b6120ff7e60357f0521ab3e3bf9d4e17ca2c44a5d63ee58a4e7a37a3d3f26415a98d11c99e04f

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/fonts/fontawesome-webfont.woff2

MD5 af7ae505a9eed503f8b8e6982036873e
SHA1 d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
SHA256 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
SHA512 838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/fonts/FontAwesome.otf

MD5 0d2717cd5d853e5c765ca032dfd41a4d
SHA1 048707bc52ac4b6563aaa383bfe8660a0ddc908c
SHA256 444dd4366615ffc4a16d012b2fa90137065d3ccb410fa6fd5e4ddd7b5e4ffcd5
SHA512 a3acaaac3a9861ac7a4ba23e52b9115d39b674cb685b45454fb4b80329a4f7370b5ea7dd8b41d630798f8a54082b62411fd63332752296dbf5f2b3b96abb8874

/data/data/com.tidezu.exabyte/app_jNkABTDUdEelU/fonts/open-sans.woff2

MD5 67c2e5e2c5009f6da0ef6b64731731e4
SHA1 5588a9085e554563adf6cc6e7797ff5e550f5703
SHA256 1928af2c2c55522fca08cf7a379948f49fd23927419e463134851996ad4ef5ba
SHA512 7158074f506b2c972bc24860edf410c7a55c87e218251ca2d1a9ead545738b075ec14682742ca7dfcfc1322e710cd0a241840e8775a9f8d41d1d59d6b3fcc3d0

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-29 12:13

Reported

2024-11-29 12:16

Platform

android-x64-20240624-en

Max time kernel

136s

Max time network

146s

Command Line

com.cebugoyi.boot

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Checks the application is allowed to request package installs through the package installer

evasion
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.cebugoyi.boot

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.169.8:443 ssl.google-analytics.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.200.34:443 tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 freeinvoicemaker.online udp
US 104.21.68.126:443 freeinvoicemaker.online tcp
US 1.1.1.1:53 anmavelco.online udp
US 199.119.138.24:8800 anmavelco.online tcp
US 199.119.138.24:8800 anmavelco.online tcp

Files

/data/data/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 080271ce7feb60cae959fd4d7deff760
SHA1 c998597ff824b12616176ed54accb799d8a3ab61
SHA256 09cafd41f55569d1479180e82f5fc49edc4753b433f1966e29f7741ef5a1e678
SHA512 76479896532a7f44fb23b2dc8ef809c7d534b579e6dddc84a9023c441b505d326c80a402925bc0b10db562af11827635cfda50129a45603abb067e90db6a9723

/data/data/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 5b66d9d1f5c2a9685a266a1e90a08ae4
SHA1 0f466553e006602563fbea49628dc6e1ef16d393
SHA256 5ad06bc979c18c250d45bb10d76a109aa07dacbf6165f999b384466313fd62e7
SHA512 3c6e47c5caaf6b50bb02572b6eb7d7417286b822abdebef15a87f4bd4907dab571e74a33b41dc0bb401a6804837fbd76ac9e939a9f21a60ae818c45d11926dfe

/data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 63fe37a8e582054fe3a02be377b86386
SHA1 adecc8c1c1a3e194bf33263aaf6dd46ebf19575f
SHA256 134a686b6041351fb4911124112977e8d0531c40e3803e5a4557745afa62f7be
SHA512 6f3ebb038d464c6e960777d31c4cb8d974be79db58ca0123bb99ffed09d0eea67f183023579a738bbd4621a3837bc4fc019d5ba5ba4796901f9a7b70e61c5a6b

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-journal

MD5 f786b0be28cbab9eef27003a8a7a60e6
SHA1 07d3f14b4fedca86dcd43fa238d450a34a5d36be
SHA256 46fa8d50ef1d97d0a1a0c428ea6d418dc15ce32acca200b387ed896f6b8970a6
SHA512 264f2335b578a302d22fcddfd7d3eaab4013424a365bc63b796513b42859ab502b2fe5b8a8a88710ef5d5a4202c9ba6c4f95d1b7122812f67f511f98f97a2c9f

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb

MD5 fb67b0f318044340a21f23336d06ee83
SHA1 24a247b59c96db33a789aed9db8a7de7cacebb3b
SHA256 41ab099677b30a7f82e053e8230741ed60b7703a4fe2e261eff08ba2efa58f68
SHA512 54d72141eb4ea2c29a8f46da7b28f7103c394623035b22b11a928278d1f1913f6e40d013a7a4d52e734d17c7c7e59098b20de23d7a5c67d25b60c6dfa4cd6c97

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 fc5c002aa2c0dd3efd1c8d23cdb9a289
SHA1 733df72c4bfdbc435f99a9ac4857b925e82fa70e
SHA256 9d69944fea5c8bc870bbb991bed93b17371d0f12953f2424377657583230d539
SHA512 d088c8bd85a32099c2a66f7c8019dbcd5051a4d99b833986457e5e7d2e876066e707b4382df0b048ddfe63a4ccd776df97e0bf79f6ceb60ec6cba4ace67ad4ed

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 eff338745b6e422a98b757cbc8bc2942
SHA1 54b189e4aa41ec48bfe2a11aa50c854e3330eced
SHA256 b679f8aa3b9bb98bf4e9b3283fdaf385dc52af0586ff7a87c70b43bb59da5e3d
SHA512 b19bb3b6d3d151969056a151221e506d39409d28a5c9e1679048bcdd54cb118648f12eb793280922f77cefe21a2c296f8e4736857ef2a5a8cb7713af39ff3aec

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 435f2eed411b2d5924e490916611f7ff
SHA1 8344b173ccc4292a83594d83c7180a2e3b617551
SHA256 22524cc7ec64f00f5fe57f97900dd90bead3019f74736f11717c63b79a4afbf2
SHA512 2ffb5814962c77a93c46d0ce9eebd22595e15f18b71323f4e5abbb5edc023f562c881ce3889b14949775f552fc0e8256021575ce1b825d9963234665dc113e55

/data/misc/profiles/cur/0/com.cebugoyi.boot/primary.prof

MD5 40daad7d244cefa8aceb8a8626083a5d
SHA1 a4e0363eefe23810f504d91c21208844610a8c0a
SHA256 39ce994e24fdbdd727e4456c32dc1c4242f9a2441125c8806efd34b7d7c4b09b
SHA512 bdfbd1b56f88e583aa02b17740e36697c9b2167bdabd7f51470fdf0fa4ee6c83c349f0e1b9a31982d91d6a02b45efe8beb5f319c91eefbc651b32f049a716e50

/data/data/com.cebugoyi.boot/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 9f49f1458d39629031ef3f2d10f3c339
SHA1 ecd8afbf5cead4b390dd8641615e5ea21e19bd83
SHA256 091ae03a97e73158b69e405011e10cc66dfc4df407f3b292a4cfdfb6557db58a
SHA512 e32a70e0aeec806b3421ee4d801bf3f9fbfa9cac46b3ef5eccc81bfdf06abbf87327ba4113cecb7a6f7ea471a948d0b63acfc9cd1168d1afe5d33ca14e22c42d

/data/data/com.cebugoyi.boot/files/profileInstalled

MD5 012153ac5681278678e4def04b92f85a
SHA1 b43f92263a629a7d542612f53125947f2a0d692a
SHA256 093474a90a1a1180fd91d6d4359bc8663387f8ff8c80a96f7446d62641a895d1
SHA512 c66631d05a7210264dd76cf8835a05d247f703dcb83019e84680d8f9b6ae76183525938f6ed7c2e3981f01d49dcf72d64c1f6f717a635113b729784fa6a2cebe

/data/misc/profiles/cur/0/com.cebugoyi.boot/primary.prof

MD5 fd00909f637dcad5264cd7771af72bf5
SHA1 e44b7d8c16b0b6141efe8e0b29c2b9e7bc0fc30e
SHA256 d61f650e568d47498a59ddcc3195d52a15901eda18c9d9fa7b1b03aa68fdd18c
SHA512 6d2439c3598befe0100bfe9670e0d82db1af893d1dd27c11354319e5fae0eaeddca3b074041c132d90a181d76dfc902de4571192ff7dc874214bfed0374bb8e5

/data/data/com.cebugoyi.boot/app_security/oat/qYqbtti.json.cur.prof

MD5 a48b20b1a71d65ae00cea1d4ce58cd05
SHA1 b133edb9367dac47b7bb554d7695eb3104051a62
SHA256 2d159af8dc8d7fcf50ea9dc592749c9c85923bb9ac1cf17e811f8bd3cb012774
SHA512 c39b243c50601a31be7f5dddddc16497117459ce78fbe8c1544b2306047619362bb2513f1525ffa18a9b289404b943ba7b6eb3b047d89fce06194393c29f2fcf

/data/data/com.cebugoyi.boot/app_security/oat/qYqbtti.json.cur.prof

MD5 b7e7ae4892826d4638e0c127595c7941
SHA1 247a7c5f738c3c630811107e3b808917baa1a56a
SHA256 1cafdd1dca773b2e38c43146b63e686fd210cf7badeafe712beefd80d3c02e7c
SHA512 93f1e72ae121a3404cbcddf78b1abac05603ec6fb9a38a18e51907ffb3d8b7eeb776958d459162997db650d3229dd39653dd6eeae2a760edb724d2711bf49a1c

/data/data/com.cebugoyi.boot/app_security/oat/qYqbtti.json.cur.prof

MD5 9f37ec70b4aa6881ff697867f521d69a
SHA1 767019ceb2485ef35b6c6de3b8656b8870d136dd
SHA256 e7f12afcde8b66f6c3ba94a88a3e7f8721062a0c85fe3af774c973a918da37f1
SHA512 d4c98ba8c081b36a7ac82193cba4e13da9e4971cc00cca10725c13c142096c56f9a9b654f86250eea774abfcd958816e51f4eea9921bc67e984a681a87503bfb

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-29 12:13

Reported

2024-11-29 12:16

Platform

android-x64-arm64-20240624-en

Max time kernel

63s

Max time network

160s

Command Line

com.cebugoyi.boot

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Checks the application is allowed to request package installs through the package installer

evasion
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.canRequestPackageInstalls N/A N/A

Requests allowing to install additional applications from unknown sources.

evasion
Description Indicator Process Target
Intent action android.settings.MANAGE_UNKNOWN_APP_SOURCES N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.cebugoyi.boot

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 172.217.16.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
GB 172.217.16.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
GB 142.250.187.196:443 tcp
GB 142.250.187.196:443 tcp
US 1.1.1.1:53 freeinvoicemaker.online udp
US 172.67.195.136:443 freeinvoicemaker.online tcp
GB 216.58.204.66:443 tcp
GB 216.58.212.206:443 tcp
US 1.1.1.1:53 anmavelco.online udp
US 199.119.138.24:8800 anmavelco.online tcp
US 199.119.138.24:8800 anmavelco.online tcp
US 199.119.138.24:8800 anmavelco.online tcp

Files

/data/data/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 080271ce7feb60cae959fd4d7deff760
SHA1 c998597ff824b12616176ed54accb799d8a3ab61
SHA256 09cafd41f55569d1479180e82f5fc49edc4753b433f1966e29f7741ef5a1e678
SHA512 76479896532a7f44fb23b2dc8ef809c7d534b579e6dddc84a9023c441b505d326c80a402925bc0b10db562af11827635cfda50129a45603abb067e90db6a9723

/data/data/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 5b66d9d1f5c2a9685a266a1e90a08ae4
SHA1 0f466553e006602563fbea49628dc6e1ef16d393
SHA256 5ad06bc979c18c250d45bb10d76a109aa07dacbf6165f999b384466313fd62e7
SHA512 3c6e47c5caaf6b50bb02572b6eb7d7417286b822abdebef15a87f4bd4907dab571e74a33b41dc0bb401a6804837fbd76ac9e939a9f21a60ae818c45d11926dfe

/data/user/0/com.cebugoyi.boot/app_security/qYqbtti.json

MD5 63fe37a8e582054fe3a02be377b86386
SHA1 adecc8c1c1a3e194bf33263aaf6dd46ebf19575f
SHA256 134a686b6041351fb4911124112977e8d0531c40e3803e5a4557745afa62f7be
SHA512 6f3ebb038d464c6e960777d31c4cb8d974be79db58ca0123bb99ffed09d0eea67f183023579a738bbd4621a3837bc4fc019d5ba5ba4796901f9a7b70e61c5a6b

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-journal

MD5 4aeadb5ee3665e91b4f272e12db957f4
SHA1 ef4e3131af4efe72595fa33ac7705ce06051bff9
SHA256 7837c5e941ab221f3c8c68483883d2866d2a15a6030246bc750bf67ee7b96379
SHA512 3f2f8d817d493140254f055e9c865492a477f7cc081f0fadf0f60ba9ec032c8d98f0e98490f82501b6eef11638e86073a0662a67ea85c94339e939a6ad481cd7

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb

MD5 b1f3879bf6aaa13f1341d11274d2fb6b
SHA1 9d743309498aa618d2bf26ce8a8d61db04786533
SHA256 1a7eb7de68fb808d9d23bec52df7c691ce6f86de3ffba9be3f8e855502097cd3
SHA512 2f844bbf01fe859de21b82a0b90cce5991c4c162f36ed6796a42ec4a07fa2b1e0aa9cc0943a534e2cc5de3870d6c988f72989c5ed8f8c734095b0701a0eecce8

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 fe8bc1ef761061f78fe9c21980a11e8b
SHA1 cb30dfdca06418ca23063a6ab334d91f20a23f2a
SHA256 3c01832358664b3ce7b8766f6a2579e5ef098690103bbba5c1b3abc42ab64679
SHA512 2b79a4b4ac433156eb1bc631c9d84eb0484ce3ebb82be76b96c7dc74c07efe710cc82aa01f332ef215f626d5b5b24d1ba2aa7ce9b1b9fb77f33855238d036cd9

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 ffc41577ae549a6059271adba71f728c
SHA1 c0d3b9dfe3087fe2fad90a0cbe41b72c65c89510
SHA256 078c0292bf9bf0d93b9dc0f20ade567edc17e459c783926dbb181e1f04d613d1
SHA512 0a042808d4107e52e6e48eb7b6682dab5ecf0702eee9e3e8abd75bb6da01b46b2fdc610bcb0d1e39be36bb821f8aa04ce316dff65237935af05a69929af2edec

/data/data/com.cebugoyi.boot/no_backup/androidx.work.workdb-wal

MD5 b98a53c3dbf6ef54b890209b796c723f
SHA1 4f5212772b11684dd617e13ab24cfd62a006d2e2
SHA256 7151757dcb881763cfb38febfe01d5cf1b75d7f2027ee17c951f13d8e368f254
SHA512 20ccfc9b89b967ccfd7ffc36d4fc539ca0f14084e47d2aa368001f75095b3883d28480b1e95786556c6d737d9ae9d9142c31097cd670019bf665f9c57b3d62ce

/data/misc/profiles/cur/0/com.cebugoyi.boot/primary.prof

MD5 40daad7d244cefa8aceb8a8626083a5d
SHA1 a4e0363eefe23810f504d91c21208844610a8c0a
SHA256 39ce994e24fdbdd727e4456c32dc1c4242f9a2441125c8806efd34b7d7c4b09b
SHA512 bdfbd1b56f88e583aa02b17740e36697c9b2167bdabd7f51470fdf0fa4ee6c83c349f0e1b9a31982d91d6a02b45efe8beb5f319c91eefbc651b32f049a716e50

/data/data/com.cebugoyi.boot/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 124195c037f245c84b51e756f28932ce
SHA1 c5104c4d5de9782bd03904474bff424398dc9686
SHA256 2dd5fdbf9647ae16f4b59d0187e43ebd28c960740d93a402110d9d8d793f6cdb
SHA512 71676ae7ced5baf10bfcf47119269bfe9089201fff7fb32869ae9a501354c3f7227727941a2071fc6f1a5e6c8a7f5eb458f264d90d3c59ccfddde099dd142fb5

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-29 12:13

Reported

2024-11-29 12:16

Platform

android-x64-20240624-en

Max time kernel

142s

Max time network

142s

Command Line

com.tidezu.exabyte

Signatures

Antidot

banker trojan infostealer antidot

Antidot family

antidot

Antidot payload

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.tidezu.exabyte/app_bunker/Mb.json N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.tidezu.exabyte

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 anmavelco.online udp
US 199.119.138.24:8800 anmavelco.online tcp
US 199.119.138.24:8800 anmavelco.online tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
GB 142.250.180.4:443 tcp
GB 142.250.180.4:443 tcp
GB 216.58.201.98:443 tcp
GB 172.217.169.46:443 tcp
US 1.1.1.1:53 anmavelco.online udp
US 199.119.138.24:8800 anmavelco.online tcp

Files

/data/data/com.tidezu.exabyte/app_bunker/Mb.json

MD5 6042c42af03f6b3dc8c2840c46e18272
SHA1 f42972b0ab7020dd7645b29defacdd2b5dbb4fec
SHA256 a0195f11d4a9abe20d00c271054eefb1a5dedf89339e5c2e63f0a64b27af779f
SHA512 79e79e508dd1db847d9e6301250afb40aef0efaacb86c6a4d5710bd1f94e7e91b723fada328591dbe22eeec32a8711ba5dc898ab32d7e359698fd469bd00c00a

/data/data/com.tidezu.exabyte/app_bunker/Mb.json

MD5 c3afb26e7aa1e8d5b22f788ad7ba717b
SHA1 a9073c68b81c0777aad654339d96c504bb2b5043
SHA256 8294c78f37a42e441510d9219d879fc3f716c178d920a36d889c2f27dd32c16a
SHA512 bf317c40bc18691d50311e6331a8ba61369de0890e1e38996abcc84247ebc12362743699f80f4c6ee6c6934479425a978d5822836f3c7ea052f7d1758af6001b

/data/user/0/com.tidezu.exabyte/app_bunker/Mb.json

MD5 0edd7a71e7d6108c5bdb05a1b019408a
SHA1 f1990fe3c97a703f4f47031c2b854144792e97a3
SHA256 b5775b7bf2208a5dbddefd87f65fa13e5002546ef0b2df7921c2c12fb5db184c
SHA512 e78153524c713ffabd25745a903c551ea219c86f5444def6db2742bbd49cdb5e7f04c48684b204713c5b3afc6b9d3bd363a64f72b656e2367cebcb8289c9418a

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-journal

MD5 36a705c24de3b2d289149572ed86bff2
SHA1 f5e441d1e531cb681ab804866ed721ba86e93614
SHA256 7e1581b745257ce0a1505cd2175a22a44e673d66bde45425440a89aabf873e5c
SHA512 3e47ded00aee2f81984c751a034d5bbae4c38e3257b74e2616a2f941bec8c3d8eb140230709f313e09b2c801e31ae5eee0d87f599ee3d0136c477d8765f58428

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-wal

MD5 9fd537485089d41588e8e72ed4a6b630
SHA1 0380adba0121c4050aa76a2453f50a72d9579a84
SHA256 98af3eba7c485e5d706b7486da578a443e9a4abe1f588e73bf3cb214eccab773
SHA512 0ba1cfb98b08d0a9f413f98e9f8835ecf1f2a1bbc1282631d520af80f8d596b1c588dbc11976227cb8f260bbc22d3fc84be1f507ee85bf959f2edf71b33cd0b5

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-wal

MD5 fed3f185d173aac8227b3c7f3b258131
SHA1 963197be97e86b2c60fae5f823af285c43c6aaa3
SHA256 6b6145c3898efc4643a6db95ba642f3f87d19356d9ea75e151462aac600c9e28
SHA512 1e2bb45890a1942914a2d7cd0da7b526d50e6fba51c22469b2a9162e0a85ac52da4ecb5d36cfb96cda98bdabf083eeb58f164143af99fe620ff1de5504bb449a

/data/data/com.tidezu.exabyte/no_backup/androidx.work.workdb-wal

MD5 6c072619ff3304f4920b4cdd34af7dc8
SHA1 f365e47513c857813798678eaaf82d7c294ae48b
SHA256 4143f16ce1f23bbabb9d62ddd007ff25b909322e44a1b9d4c9e3fd770895db49
SHA512 f843d3a8323bf9109d1eb27545d762689fc1ecf9468fe1a9b77c99fe3533a2e6c259fa7860971c24c3f8542bfb4730df42537304637fd9e4c493493ec76c48df

/data/misc/profiles/cur/0/com.tidezu.exabyte/primary.prof

MD5 570aa3d946e5fcddc4beff5585f40cfd
SHA1 4dfc8682eda8a6010894864f86e9f1a26e1b93f7
SHA256 f9a3692909a61e3711e58631ab7607b0e6250e975fd8059b992cbb6ebb298987
SHA512 2de5a6a8b76ce3ba089c1384e93ccab3d0109ca081cd5663822791d2207edca635caaf13ab0105843836bfdd30529a4912bca556385476eb1b624b29e8fd494a

/data/data/com.tidezu.exabyte/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

MD5 8e717ae84c7db32c3e6564c9aa6486d2
SHA1 1cec526ee5a8cdaee26f0f2fd3963e7ff04f867c
SHA256 96840abe5f8af63c2fe716764f53b70bd5dc294183d7eef39f78249807674ee6
SHA512 a9b5331be14fa35d36160be8d47fc53efac77ee145295f9e8ff1dae671901fcd04c9d348ca113d58a6e762768872c21706eb51bb9d6e005131ef259237d296d0

/data/data/com.tidezu.exabyte/files/profileInstalled

MD5 619fcc43bdc8bc3c227d0677a2716283
SHA1 2e903a1f8a3de89906bb351a13b83b533e795103
SHA256 dfcfe29ee2da7cb94bed11a41df1d517242c329b81f85c2efb455d67513b029d
SHA512 9d388b1f7525a71809844b62518121baa6afee077a19dec04eb01f00e4b4bb5b330e9b2baeebbc5c83c5a7609db80d7c053954ffc53b66fc387e1fa509103035

/data/misc/profiles/cur/0/com.tidezu.exabyte/primary.prof

MD5 7b54fa4206d7a3009b25deb19cd5fd61
SHA1 9b0eec163bb2993835d8fc6263f6382ae58ed97d
SHA256 e8e36b61e14ebfa7ca08e768c712dd798cb4dafdcc7712440a0c46ce1d1e7261
SHA512 5fa19cbcd9e2b488c8834a86f91b98e25db002df8311118bf8198c7d617c52de11208ac7125b842037c884c2bd9e733fdd7bed7127e0d83f58bcd27c2745efa6

/data/data/com.tidezu.exabyte/app_bunker/oat/Mb.json.cur.prof

MD5 49dd7d3e8688dddda894f441f82f3ce8
SHA1 53c7c7e48776e1b040a989d9aefa33e057edf0e5
SHA256 598d696e1669e001a096ada11e8e7a4b6e491dd68b8cb5ad1d324040706bb7f2
SHA512 73a2efb2c68e1fabe2df17877519e0cac4e41ba844cd919e53630b114600478604a2f0bbf76fbda0a6831f803888fbc98ebbad41179232e96b249b7faaebd944

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-29 12:13

Reported

2024-11-29 12:15

Platform

android-x86-arm-20240910-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A