antidot | f9f4e2276c241659da8988e5f825696f1f4767650aace15d1a942385444f4321

Analysis

max time kernel
149s
max time network
156s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
03/02/2025, 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9f4e2276c241659da8988e5f825696f1f4767650aace15d1a942385444f4321.apk
Size

9.3MB
MD5

83cc7472eb4efc947f3d7c1ebd410e85
SHA1

3a53e523f11f92583a52bdfbf0295ce07b825108
SHA256

f9f4e2276c241659da8988e5f825696f1f4767650aace15d1a942385444f4321
SHA512

a21e74d215ea1b9102d4347c5ac792c2f0b10c6164c9a4f1fd27d8d83b626bc3a8ce9dbdf5128fe69c3d1bad63e044ba853f37b13f0e486828a1c174364bd4ee
SSDEEP

196608:A4lFVbU5pQTOnctr8s0JCASGGS1XVDRAKuQ8bgPTPR/J+JJkQKQgJtj:lX2kOctgsNGGS1XdSKKg7PRgJJitj

Score

10^/10

antidot banker defense_evasion discovery evasion execution infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4272-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.zabogutajo.associative/app_catalog/KMepQ.json	4272	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zabogutajo.associative/app_catalog/KMepQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zabogutajo.associative/app_catalog/oat/x86/KMepQ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.zabogutajo.associative/app_catalog/KMepQ.json	4248	com.zabogutajo.associative

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.zabogutajo.associative

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.zabogutajo.associative

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.zabogutajo.associative

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.zabogutajo.associative

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.zabogutajo.associative

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.zabogutajo.associative

com.zabogutajo.associative
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Requests allowing to install additional applications from unknown sources.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4248
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zabogutajo.associative/app_catalog/KMepQ.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zabogutajo.associative/app_catalog/oat/x86/KMepQ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4272

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.zabogutajo.associative/app_catalog/KMepQ.json

Filesize
599KB

MD5
8d54f2b11dfafc29f7e49d1976515bfe

SHA1
b5a9758dfeb6934b9b5ac9612b36cb32658c10cd

SHA256
75dfbbfb6add3c586de315b6c88797b8a0dd7f77372469c1eb48f2e0d5715444

SHA512
dec76737422c2a507c7f10068f3470bcc6c68ded0d0515f90a3535d1fe176c757ff9957599102c757a42399f4586bb8efdfc1f5f71f3c11f09ac1e37fa79e4c4

Download Submit
/data/data/com.zabogutajo.associative/app_catalog/KMepQ.json

Filesize
599KB

MD5
ee6fffae01e99c3f684288656d8274ce

SHA1
bfbf5aee5fb09427e351bd89f217adc66360370f

SHA256
2f5054d42e939b76ca72093143256869d1ff0a92f6155f1a13d3a1bfc924619b

SHA512
3762b530d5d44658dfc04cd8cec56f63a07fbdb5c7d760fff87523d461938ab8b3f964dad886834bb538940c57611f14c1022d2af8ed9cde68e51b8080889d6b

Download Submit
/data/data/com.zabogutajo.associative/app_catalog/oat/KMepQ.json.cur.prof

Filesize
1KB

MD5
1fd0f14ff6640ec06bad8f07d61b4614

SHA1
fef7c2f1b5c61c479baba658cfdc64f745e43339

SHA256
34e922392a580dc993ca5350c2c6173d4f5961cf3f1b3a75d2b3d5f49cde3820

SHA512
c472eceba7bb1cd53be9ff90ce4da5f7c14fe557117f3b51a2640d1b8c1bc34c04495b15d5e2344220e002c95eaca95b2ec651f8dacf4888210ee5beed8e8209

Download Submit
/data/data/com.zabogutajo.associative/app_catalog/oat/KMepQ.json.cur.prof

Filesize
2KB

MD5
e55d427241f29be2eea2a150eb287d67

SHA1
b1a02a42d97435a37b1cb7df18f7e8a8f1ae3cf0

SHA256
d8be28b0bc4fd57241bd093dec932c04a1197f0b1fa631ac17d4de45d9e30fca

SHA512
0707bccfd14e9e2e6e73df907b8a3e5e57cf099af698037b3c47f16e0770a02b7002232ee9c3d405bafa561f4804c3e848421e5422f67d84ecbd74025f4d7e59

Download Submit
/data/data/com.zabogutajo.associative/app_catalog/oat/KMepQ.json.cur.prof

Filesize
2KB

MD5
d6f1de168bee87a69f8f2ed6eab089ba

SHA1
fa43ccedf606996e36aebbede7730028a8368650

SHA256
ae37225af8a62784c3ea5234332004ec1d67aefec674763cdde3dc74d6bae918

SHA512
d2a176e73c889ee426196570a2eeb916808f7683bfb9e6e4c23370efdf51b2733e52e39b346520ea60c10e6c840b61ad9079e7f89f9e878ecf6316d0e901af81

Download Submit
/data/data/com.zabogutajo.associative/files/profileInstalled

Filesize
24B

MD5
5179beb007ee694575333c6c8d00a733

SHA1
4716a6a4f4d80313a6ff825b31545f0e63cc5072

SHA256
3269778242af124c936bd5ad9ea181f55155ef0d42b2f850bfcfc3f86ca6b1ea

SHA512
7151c9cc04a57a4a36f717ded598eb58c3aef85abbf91dd4744026f1988105b97a7203758c98d6bd95bb69ef7fc259aab32590c71a5b7901fc94c081327335d6

Download Submit
/data/data/com.zabogutajo.associative/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
60a7da6c0859a30888ae347bc5d894f2

SHA1
8af32b1aa7e1266dac85b455f9efdae760ca84c9

SHA256
907abad3fe25d3da824dda049e3bd62fa916a150c292776f598602ea7d278086

SHA512
5bfad38a7741b235eb0f9f67a29957b6ddc1ce685bfc94d64793ccebc1237a9ae0dfba2d2897dcb81d5b9a595eb1de8fee8df593b14a68640d82adaa42c05f53

Download Submit
/data/data/com.zabogutajo.associative/no_backup/androidx.work.workdb

Filesize
136KB

MD5
ae6fa8681ec18824dda13feff2d8efa5

SHA1
affe7c6c95c0cb573fa146b6e4b61ce58357dcf1

SHA256
a962373d978ab29a8675e80d86862e3864a284f7b585ecefea5162c37263864c

SHA512
6abbcc5b513986021a85fcb34381fd6f77111fa10f7a10a163101f76d79009df2b5cacab9c74827ab6639cdd4e5394ccb1a7fdaa0439e671e3df91be600f05cc

Download Submit
/data/data/com.zabogutajo.associative/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
942b61db1bc33fc341e841cdc3df4728

SHA1
d4a8199dda12b9156e51bf2dd7b62880772265c2

SHA256
22901234f3736d74b6dedc9a87246863eddccdab8f515f57c20f617e35fbecae

SHA512
adaebbd3242a6e0be75d7b483cc56817d7175875915f3fc1b06e1bcb25214b5514053c26d9ee315f664dae6cbc92b33e71e0535e37b9fb56fe798b6535fb44a4

Download Submit
/data/data/com.zabogutajo.associative/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.zabogutajo.associative/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
89b375859520d0d599d22944f90eefe9

SHA1
fd986dacd74944fc7accfbf80bcb637e609a7d28

SHA256
b19bf0ffe4411ef9773aa0b015214d9d4f35b174143dcc24f4c9e47751224364

SHA512
f77cf8216d558ca75f5ad2ad7d9ccfa43fbe1583261c965c4d1a4c7690f3ba484bfd3740ff44652c9adeb65feddec253f43b1131d3d22c5e0449783b9df4f53e

Download Submit
/data/data/com.zabogutajo.associative/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
a0a01232cf37a4ee538414c4641fb181

SHA1
b3307e636435aa9955d1af755940bb5f02ad7f91

SHA256
588f6505df4e61f78789f905b0fcf21568a203e5baf695fe827caf50fba7e4f8

SHA512
8f7394153f1fc8dc92a64353557dc9a99c1f32b6b83310dda54ba667593018c511a1731fa565b10c7a9d601211ec45e91d3ad2e94444f81dce27c56999ac0f9e

Download Submit
/data/data/com.zabogutajo.associative/no_backup/androidx.work.workdb-wal

Filesize
426KB

MD5
ef3e7427954354b38236a75d4bbb3f27

SHA1
91c2a5821daed729979084f95a0a253c0c9c0355

SHA256
d3ed3040e2b9706a31d6768a6431041df7fb93a70198ff3ce4b63582809cdd63

SHA512
972cb3cead20ef55a842d5d7bb5bfa595f9d5173d47ed53a77bcb3f57f1752d890a459220b36449dac8fe13d72cb6dab3ca9e504642d9ae8e7f222e9f3146052

Download Submit
/data/misc/profiles/cur/0/com.zabogutajo.associative/primary.prof

Filesize
992B

MD5
af3aebbdb82e74bf3dcf3589571946a1

SHA1
22a45285964cb6ab4bf7769b5130e6667ad2e3e6

SHA256
672d9c161a8c01d29c5112de65386555a10aa29f46eff389ad98d44acf15b0f1

SHA512
aeea4d0ab87586e86841f1ccb83a2c3290404e59f440592666e3a90a7d0ff12ecf373fd237b4ff76ffd7670399be6cbd6e0a30b7722b9af0bddf5d427e011dac

Download Submit
/data/misc/profiles/cur/0/com.zabogutajo.associative/primary.prof

Filesize
206B

MD5
b2797144bd32ab069966321c9e58c013

SHA1
046c8db294f5ea298db78cc7b4e442a362b5626e

SHA256
a8013ee091912efad2bfebe0ebbf62a8745eae145d774e5aa6a1be5e9292b55f

SHA512
28736c36f0c1844e76dde567b50b6c387220070a720a482a1ad87b71d14e24022e9ced849f75c5784d6d99cc8fc448051522e756dad81aee9a3bab448098350a

Download Submit
/data/user/0/com.zabogutajo.associative/app_catalog/KMepQ.json

Filesize
1.2MB

MD5
ff365d753773e4ccd404a08e8dc6345e

SHA1
e62474fc3d5b1d5219115092a3791cb83e56512e

SHA256
92aa90dacb2984bbc743727d4aabdff6388b932261c657c3a60302c706dc4ed3

SHA512
4793bce1e8325d9b3db315964f1a6b5a868f669e5e98350a3d9c6a7a453139e93696eebef994cba0592ec552186535b25be84cd278a6017e98d2925a572c8666

Download Submit
/data/user/0/com.zabogutajo.associative/app_catalog/KMepQ.json

Filesize
1.2MB

MD5
c0e426c298c5e4a91bf535fd1ea8815b

SHA1
cb9a2aef0350fedffaf6c0d192afced329620bee

SHA256
2640de71a9ec4b517cc57d69cb5da2d7bcfb1d7ac9be758e9b78aa6e0af1585f

SHA512
9b0cb113c7839f5fbc8090ff3941a503a5e0622ba06c5ec1ee922497c8f0f9dd84b903821a7f5703840e1b2a72de1fcd2dc4c12f7aa01fba0451715fac699bca

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads