Analysis
- max time kernel
149s - max time network
132s - platform
android_x64 - resource
android-x64-arm64-20240624-en - resource tags
- submitted
20/12/2024, 07:27
General
- Target bayadoje.apk
- Size 7.6MB
- Sample241220-jalsratphm
- SHA256 129240b79c82258e10643b16f0947b2ccbb88e6fea642176a85f8d21d94a2ab6
Score
10/10
Malware Config
Signatures
- Antidot
Antidot is an Android banking trojan first seen in May 2024.
- Antidot family
- Antidot payload 1 IoCs
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Requests enabling of the accessibility settings. 1 IoCs
- Requests uninstalling the application. 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.kofisahoke.access1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Requests enabling of the accessibility settings.
- Requests uninstalling the application.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
Mu.json
Mu.json
Mu.json.cur.prof
profileinstaller_profileWrittenFor_lastUpdateTime.dat
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
androidx.work.workdb-wal
primary.prof
primary.prof
Mu.json