antidot | 8919f2c84bccb75b94393010ea857a4d28754354cbaf7043f49d47ff89318f7c

Resubmissions

21/12/2024, 23:02

241221-21ca4ssqhy10

20/12/2024, 07:27

241220-jalsratphm10

Analysis

max time kernel
53s
max time network
142s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
20/12/2024, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8919f2c84bccb75b94393010ea857a4d28754354cbaf7043f49d47ff89318f7c.apk
Size 7.1MB
Sample241220-jalsratphm
SHA256 8919f2c84bccb75b94393010ea857a4d28754354cbaf7043f49d47ff89318f7c
MD5 2ee1c7272b7efc3155f00066226643c2
SHA1 86fcca0d8e4778ce3bbda033dbb8e6ae1558b5e1
SHA512 b6ba882ee7cfd1735779d9438c0c3d0660d726a1e0ec8f392dbe316f162efe3b5bfb06a9caa866624df988cfd9c91ad1c2f3cac8a51dc6edb51c4a9cfd72e128
SSDEEP 196608:RUITvGePB7u5D6jc/WT9ZfGmw1Inj4KB8c8akpPq2s:5TvVkDD/KGmhZB8ekVq2s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antidot banker collection credential_access evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral2/memory/4487-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mocereti.fill/app_immense/MdIfb.json	4487	com.mocereti.fill

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.mocereti.fill

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.mocereti.fill

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.mocereti.fill

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.mocereti.fill

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.mocereti.fill

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.mocereti.fill

com.mocereti.fill
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4487

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

MdIfb.json

Path /data/data/com.mocereti.fill/app_immense/MdIfb.json
Size 647KB
SHA256 36ed39f8f6f10c12d1e75864b3f1a86ac04090e72e055668b94db57cfc131d94
MD5 9080ca780268b1ee82128c85ab15992d
SHA1 8bb3c2f182766a24e00165a0c2c914fc908061d3
SHA512 1b22981c3dc7d268d923e0b5a9279997211bd3026382cca374ece9db26fa3c8dd4dc798fee89a6bfb55315fa5e6fc0562f91cf12ff68c64ecb29de95ae6410aa
SSDEEP 12288:MCSC1wIwbiie4l7G6tLU3iFJ5PoQewdZN3g6D/Ytpr/r3Cb53qfkpORdD6sZbq/3:MVlIwbTek7Z1cYZb/Ytpzryb53qfkpOc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MdIfb.json

Path /data/data/com.mocereti.fill/app_immense/MdIfb.json
Size 647KB
SHA256 28b07087989fd0439b4653c94f1cf2e4afcfa94845a7e96b3aeacfc3c95ddeb6
MD5 65665fc5d83e79c8e4a9598a0918efce
SHA1 ac791de882b6503b494fa51f162c34ef7d53fd47
SHA512 852c00f3212f722db4bedf1b23c6c0a05824057ac5145323331fdbf579d9a267fc7d3b321e5605dc1483ca334115e8d521975f72e3774f4467e48e3ac6f10973
SSDEEP 12288:6Mvi+fzhmWB8Bf6nesMGYd4jwezT5qIlj8T9HINCJm/CecHp32JlzXE:6Mv3hmWBOsMGr8cgSjomNQm/c36hE
MD5 SHA1 SHA512 SSDEEP

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.mocereti.fill/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 e882a49a535c9b0b29a6734d3479c6852f35adc7f8cbb77554f80cd5b5ec2079
MD5 ca03c3dc7889f809ee9591ae93860857
SHA1 64aaa4c1284b468281b6f5c7409edeb0b1d4076c
SHA512 ce5a12fb5677e6ad2fa55d59bb637a6ebc6b9332d0e9082f92b52acb09b906018bd5608304e53eab8b61c79be81204c6de31e3bb53778c99485aef5e6c334746
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.mocereti.fill/no_backup/androidx.work.workdb
Size 112KB
SHA256 c0039d7c461a021ef894d546aeb3e9d69056b6b337b2404db6768641471e6421
MD5 c273235eae0c6a1557dab5d6685a8267
SHA1 c651e2c420bf8bd6b75a45780c1ec525341e7f58
SHA512 e82ef33781fda8f55fb73041527b18f8ddd04146c1e14b53beff1800f109bca3a7282b5cbd358809f0c75dde7061583c35b0224f2bac29cbe33581a5f7d88ae2
SSDEEP 1536:tSzS0ZDIYMY0YiYrYmYKYUYaYVYeYYYzYlYrY3YyYTYDYAY2YfYIYFYvYtYEYJYO:0Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-journal

Path /data/data/com.mocereti.fill/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 5f9df14c625d6357d06da37026d612e9e55356f0f554297c5f2e38cb2bfb5d9e
MD5 97b5ab140d559543dc08702f1b3467b8
SHA1 580ea55bf8e7d215a849885d34626125215b371c
SHA512 ab63f3478d9641ed37e90c9e08604ca46e35dfd7ecba32307fa550e12282a97fa4e3b566cb462726f11ccdd2db8cf1ebd33faf63e35593cf6a3d231c3dd2f34b
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.mocereti.fill/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.mocereti.fill/no_backup/androidx.work.workdb-wal
Size 422KB
SHA256 d3548f79933759f48534507741febe9aadba05e44153af16b78e558cdc102a4b
MD5 6f62d778ecdb4f17564876d242960d3e
SHA1 edf4474534d78ffa8849e2b05fdd00eb6482b9b4
SHA512 57a7cbc965fa0ea82b22817ebe721554078e6c7dfafc91f68dcf19da2cfea2fa62d71516075865107029c57098b50506814fe109e5c5502116d9e998c632bec4
SSDEEP 1536:qYFYvYtYEYJYUYyYeYeY5Y4YFYvYtYEYJYUYyYeYdYyYOYBY+YyYgYmYfYUYyYgw:J4Edpr
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.mocereti.fill/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 c2e69f03fa522c389d67d2f4d99055b06ef3184b5693a042c01933da743c06cb
MD5 d938d7f6dbcbe3a09ff77a022e713f64
SHA1 4f8c8a7695af25f005481967c6359e2212bec7d7
SHA512 a5e7d794a7b343eb97a55985f0a258346c9fddfa3f3e449a1f4a48608d55097673c00e4c09a6d17f72a19c684f84ad439c3089dda669297323bbbb053ce29987
SSDEEP 6:KM4mHP24Mvg9FZde/kPlOERX4PBX4ogLugMBX4suuK+/u4gPWll1PBRKOw2:KlmXMyzdeWRmBEyPbP/3gPGl2Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.mocereti.fill/no_backup/androidx.work.workdb-wal
Size 116KB
SHA256 8e12c096bbe3089a1bf20a78af376ae1709277568d43133bb511b24e0ad482ad
MD5 a8e0c91d5b70034d0eb54226ded5097a
SHA1 aaeb4e7597764dea8aacc3836e25ce15683a1979
SHA512 7df3c0e975e9ba50402e198d1f20a95e41fb3a0975775ab6b65f7af93cfbf0ab0e8bc28116628921187bf780b2332f7b7ef79a7cdd187e5e8a0914d0824eb654
SSDEEP 96:fMHJe6+etidjnZRWzzb8/KeKcK+zSrddKz+ZD86u0ExV:uDtidjnfWzzb83zSrde+ZD86u0ED
MD5 SHA1 SHA512 SSDEEP

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.mocereti.fill/primary.prof
Size 1008B
SHA256 140f8b5a089bec63de2b716250644ab42b581002851be3c1dffa8c9408ae45db
MD5 183e6648d5b0a33984e42a402dd1dd92
SHA1 364b98afd052eeec4813093ff2613c82b1d61509
SHA512 d4ba69c870a95a3b10ac14d1889abe22fed31c14903c00b864bf0c09b34384e82d5ad25412463563a64e29c1ee71237997af9fa0e2c0d221ccc5a9693edf0b48
MD5 SHA1 SHA512

Submit Download

MdIfb.json

Path /data/user/0/com.mocereti.fill/app_immense/MdIfb.json
Size 1.4MB
SHA256 92ba383ed156984ebcdb8c06e29b16b290b26abe0f226a5325775a0eaee7c63c
MD5 ff2a5bc76bd956c9621454e9829ad34a
SHA1 3e41bd7ed5c73e133f753a89800d324d760e74b0
SHA512 35d9df3b1c912c9f0feec823d8722884adbed93275283c87990c793859af1dfb831f9386f03e0a736b290e30734d6961a18c8428144df6a0982c2d2c4054db47
SSDEEP 24576:ZTBZltSFxC8p3VoAs0LIEwDPEJLqCQPX13:DZlExC8p3gLPiQN3
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads