Analysis
-
max time kernel
11s -
max time network
32s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
21/03/2025, 22:49
General
-
Target
f5fdc1672088ee29affc4817986e722765c4f03af4dcde8fc603b25544bae62d.apk
-
Size
9.6MB
-
MD5
e6c96197eb41de926fe43d6721f01aaf
-
SHA1
15fd15f9803134efe6b7c28c86a00a4f0390c973
-
SHA256
f5fdc1672088ee29affc4817986e722765c4f03af4dcde8fc603b25544bae62d
-
SHA512
e36c4a07161d77d98d6e1fb7f30cb42667e9fb997adfdd1e36fd5ac41ef58428c87b0dcc507988614e29a7b9ba93f4f1e42715ac6802916729af51941020e5e2
-
SSDEEP
196608:B3TfkmoN3qOqH51QWqzQbgk4sAw7kCwDkbe9H/yzL3itOrY0obFF6a1SEfAL:BDfkmoxqUXzS4W7krDkbe9H/yzrrY0oO
Malware Config
Signatures
-
Antidot
Antidot is an Android banking trojan first seen in May 2024.
-
Antidot family
-
Antidot payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
-
Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.gatefada.digital1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
626KB
MD589e42973273a071c7810384f13f65b63
SHA19ac4c1043923f75764d56d8f001f6e5fa0b3a4fa
SHA2563ffc2ac802f73a7321451f456a52195f3d733a84c99b22b36cca7505e1ffde66
SHA51235c21b0536e0cff62283585a2a07913467c67a9bde10b4d9c75add5f516da9505509764d86b984ba23fe8f80a69f79b1950336d9ec4fd782eb9b5cf62ae168e1
-
Filesize
626KB
MD59b3ebd3743eeeb9a4ddafd8885393b3c
SHA12d5800f7ccd88d64080c4fcfcf3b2ecf61f38a2f
SHA25661a91d1c88bed936873b60ebc0048165f81ade57579a3f5309bbc3ee11d0109e
SHA51204e412da11cf825a41aba0948570543c8c4fe82a60584a36eedba2dff465f237a73d37f68807e34623886fe4bcb882acb183c40a1313607f4195de801283f863
-
Filesize
8B
MD5df17e8c6cdc5ab0a0e9141da1679b98b
SHA163cd1a1d22f79b1d3c4612929dce83ab985031c2
SHA256cd2fe2c8ba12eaa6adaa9c4f982518e75f24066440a1d74d651191a6c0b8a39b
SHA51253967a84d91884aaa7a9e130de1dc3200bf685cdc9b01d00c26a89ec479b715f32cd0e5f939aa7de04b3b2394046f6d2d415707d2ffe57b4e44dadf76fe840fc
-
Filesize
104KB
MD549a8bb50ba20ae1fc1a84e3501534021
SHA1a91cf91b6443dcb1e07bc557cb2dd4cd39bff97f
SHA25689b4687f22ac4134c6e937337772d504050ce9c27a3c155166f3e03b442471f0
SHA512dd543b8cd0f94d7f452e36edb4707c61abb91aca05f3f5cf3529b020afb70eec4d129168b33be6d6a2b1f3f55f914fbc6b864cf3668ac114865681b9ec828342
-
Filesize
512B
MD50821bc38d53fad62a7abb028d99a335e
SHA19765f9574a94682c2ba760feac38fbb9a0863684
SHA25676fa39a33ff9e22afe548440cb1799b791e16f6568b96ade0e1300dad41d5a84
SHA512fa12349996efc4781af22f75c6091b8cf01c9e00bdb56b2dd64288e405d40c940e98401c55c296c6f3e97365d59dec48c14228adc6825fee0802020875fa0e86
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
406KB
MD572ea443f4c76fe6e669dce2a4b391215
SHA1c03ecb152caad0be471b2f0da2981e0217dcaed6
SHA25615d41949f9cfd95b93c8713da1a262ea69cad01581214fe1bb68c2ce4a56da28
SHA512b922cceff34392f301ba1a03c081125b278afab1abf755c81faae97299e162b1cdb68746507a86cf308d1229245aa4bb99315ae3694c99d153b9bf895b1a4af4
-
Filesize
16KB
MD5a61934a5af527b65f8c5d1cfac912449
SHA1157cce7c71d0943a04fc9ef113d483a0b3995207
SHA2564143d45fbdab7ef1cca7eb6751874542d11356ab21689aca8bea9b2aacb8a928
SHA512332be5c4fed83343471d49cdfd22131d8a452e710583fbe4a444727e463bd576560af67ceeb6081443198348d41a1e972cf92336c7c78107b367c5b176b41c5e
-
Filesize
116KB
MD5603d91cf0672a37d6715435484798a30
SHA15a8138e01bf8e3840f0109b6e1dbee0b0cbeb724
SHA25629b756b564f6e2e1352cd9a4509e398120d529512556978c4b2384c3f6083452
SHA512a62c2233cf59bded9dfd35c319e352698e7fc40366f344f7b79ddeffb03b0807a875cefdff33afea9b760f02779cdbd24a45db07a95075bc61ffe42eae4c4e30
-
Filesize
986B
MD5d2f1160f8584e32aca0a14c939d55ce8
SHA1745ead3ab9ab804c4b35fa8de8aa67e90b134a87
SHA25631e8408e823d20e580d23428b26d350a054b1487fd89658808bb0bc08e9440fb
SHA512c17c8dda09c0fa226041dc06320b399d47000b1b5f28a617c761b67fb642aabbceb436fa90bb94f2b1f434b7b5fe6477703d95d210821e98bfd97c9bdaf45b86
-
Filesize
1.3MB
MD58f58959358243e0b52290d35817ab042
SHA16ec7f62a669b1fc3a5761d27e5fd5d65fa1f49cd
SHA25697da4189934a50294bded0d2b6115807811ad15e0cd50eb6ad7e767c5004da6a
SHA51228c6d8c0f8b49c44b1cb66323ac13449a75a979cf4832672dfec0a0d4a314340bf0c55aa7afcfb5dc1b34330971bec574433ce83f827ae5310ea39a7a0bfec95