antidot | hxxps://tinyurl[.]com/TiviMate8k516

Analysis

max time kernel
56s
max time network
59s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
10/03/2025, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tinyurl.com/TiviMate8k516

Score

10^/10

antidot banker infostealer trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_antidot

Checks CPU information 2 TTPs 3 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome
File opened for read	/proc/cpuinfo	com.android.chrome
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 3 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome
File opened for read	/proc/meminfo	com.android.chrome
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4634

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:5157

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:5377

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Download/.com.google.Chrome.DXBm4W

Filesize
25.9MB

MD5
405ba0f8d387867b2be1d1c51eca7eb2

SHA1
218c63a01015179f043ebdede3db0fc2c9ab30a1

SHA256
6d48e7536afad2a56d91756273144fb8133883c0dc605a3ef17303ef5ab80878

SHA512
7d958dd9212f642b44aa7ff31ee8cdc8c9343240309f08a6e73acd2b9caa968e0b582405eda1fd5e4326cef74efaefd9801425808a1a9126fc99f586200f67d0

Download Submit
/storage/emulated/0/Download/.pending-1742172898-TiviMate-8K.apk

Filesize
56.0MB

MD5
36e75ddb582553baae731cda45dc1752

SHA1
5e851d4a88db145d29bb32e89edcdbd07179ef4d

SHA256
098163d73c6604016d41b9130f6eccf33b89cf3c88389143551306f3c1eccd12

SHA512
ec7eb7baeac25bc36bed18509a42dbbcfea4036a09e5e778c644f6b6dea47c0e92f7605908be6f01748ded7d657b5e0ae0794f91b2f5c2604d68450e5868904b

Download Submit
/storage/emulated/0/Download/.pending-1742172898-TiviMate-8K.apk (deleted)

Filesize
551KB

MD5
f67bd09f1d9e074b4a66c1ebcb0ff9a4

SHA1
ef15a390ddfc58bf73b38c750fa8a590ed02ea3f

SHA256
401e8bbb6d2bef9dd8b3113ccce256b5277c75ae65967025ef16947ed70f8a6e

SHA512
b3a5f7ece92ed7d3a3b7ba9889d16e5cc87b086c218dd3f4cf7a42935ea7bf32bad82e5c43e1465d2aed02781e29784da4cd3d681b4fccfdbf7eda89f967c240

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads