antidot

Resubmissions

21/12/2024, 23:02

241221-21ca4ssqhy10

20/12/2024, 07:27

241220-jalsratphm10

Sharing

Copy URL Twitter E-mail

General

Target
8919f2c84bccb75b94393010ea857a4d28754354cbaf7043f49d47ff89318f7c.apk
Size 7.1MB
Sample241220-jalsratphm
SHA256 8919f2c84bccb75b94393010ea857a4d28754354cbaf7043f49d47ff89318f7c
MD5 2ee1c7272b7efc3155f00066226643c2
SHA1 86fcca0d8e4778ce3bbda033dbb8e6ae1558b5e1
SHA512 b6ba882ee7cfd1735779d9438c0c3d0660d726a1e0ec8f392dbe316f162efe3b5bfb06a9caa866624df988cfd9c91ad1c2f3cac8a51dc6edb51c4a9cfd72e128
SSDEEP 196608:RUITvGePB7u5D6jc/WT9ZfGmw1Inj4KB8c8akpPq2s:5TvVkDD/KGmhZB8ekVq2s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  8919f2c84bccb75b94393010ea857a4d28754354cbaf7043f49d47ff89318f7c.apk
- Size 7.1MB
- SHA256 8919f2c84bccb75b94393010ea857a4d28754354cbaf7043f49d47ff89318f7c
- MD5 2ee1c7272b7efc3155f00066226643c2
- SHA1 86fcca0d8e4778ce3bbda033dbb8e6ae1558b5e1
- SHA512 b6ba882ee7cfd1735779d9438c0c3d0660d726a1e0ec8f392dbe316f162efe3b5bfb06a9caa866624df988cfd9c91ad1c2f3cac8a51dc6edb51c4a9cfd72e128
- SSDEEP 196608:RUITvGePB7u5D6jc/WT9ZfGmw1Inj4KB8c8akpPq2s:5TvVkDD/KGmhZB8ekVq2s
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

antidot banker collection credential_access discovery evasion execution impact infostealer persistence trojan
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  evasion
- Queries the mobile country code (MCC)
  discovery
- Requests allowing to install additional applications from unknown sources.
  evasion
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  bayadoje
- Size 7.6MB
- SHA256 129240b79c82258e10643b16f0947b2ccbb88e6fea642176a85f8d21d94a2ab6
- MD5 baf3c550534acd7dce3795cb7176d738
- SHA1 2f99a11bedeaa8357b75414e0797d8cfb337aa7d
- SHA512 c3180ee141d9080aa97c38936dfb9bb164a8151912f2b9594275566eb8f107dfbd8bd167e8e2472a7a53562f34b5f3be88ccc501efe37ae404c4b8ddfa346f34
- SSDEEP 98304:so/Krg4JmdxU1g9hZB0/HRCQoR9cKzqtKsRm2ieSyeTgnrSs2a+5nWKCYFWY:sJmdxU1IN0J6zqNBYErSs2a+xH
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

antidot banker collection credential_access discovery evasion execution impact infostealer persistence trojan
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests enabling of the accessibility settings.
- Requests uninstalling the application.
  evasion
behavioral5 behavioral6 behavioral7 behavioral8