antidot

General

Target

176c15abd8129000e3aca8533e284861787a531e33ea0880de5653769ebaa218
Size

8.2MB
Sample

250321-vf5nlatsht
MD5

55b16a8cc81fca626083e08630c79f73
SHA1

cc4446fc2563a72f3a1174ae950a8de27f7a72c9
SHA256

176c15abd8129000e3aca8533e284861787a531e33ea0880de5653769ebaa218
SHA512

c909ccacfee40f677ed89407248832e53fdb0c135e5dda375201b45782fdf357d411fbe5f1609926edb3283c46c16a3905479a68fe3589e9a8ea59ac78564a14
SSDEEP

98304:IT3Azfy9xAcCJla+YmAtgOJvIK2RRb8OpRTqiaWG9Mt8sraryz9Hhuww/IC/vS+G:pfEqJoLftgO1Qj98Nz+zzuwi/q+96iK

Score

10^/10

Malware Config

Targets

- Target
  
  176c15abd8129000e3aca8533e284861787a531e33ea0880de5653769ebaa218
- Size
  
  8.2MB
- MD5
  
  55b16a8cc81fca626083e08630c79f73
- SHA1
  
  cc4446fc2563a72f3a1174ae950a8de27f7a72c9
- SHA256
  
  176c15abd8129000e3aca8533e284861787a531e33ea0880de5653769ebaa218
- SHA512
  
  c909ccacfee40f677ed89407248832e53fdb0c135e5dda375201b45782fdf357d411fbe5f1609926edb3283c46c16a3905479a68fe3589e9a8ea59ac78564a14
- SSDEEP
  
  98304:IT3Azfy9xAcCJla+YmAtgOJvIK2RRb8OpRTqiaWG9Mt8sraryz9Hhuww/IC/vS+G:pfEqJoLftgO1Qj98Nz+zzuwi/q+96iK
Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2 behavioral3
- Target
  
  sitiriviyapi
- Size
  
  6.9MB
- MD5
  
  37b18d5c27edaf96d3d23f0dc6db55e3
- SHA1
  
  c1c9d6f407eeb159ec90c1601d5486375aa9314e
- SHA256
  
  65e49b30e5a3ed351a2e9fd2ec40ced992136a19451a2af6322c7955f64458af
- SHA512
  
  070b2349ef41ffe17788b801d18296fc74308003e86fbc392884b9631f3dd359a1e03098326776f5966b04cf35411f079893a27b2b5de50c934c3f0a5624b79a
- SSDEEP
  
  98304:sD7Gt0stmNCpTrVJBQ8vDo/KrZLeRxGm/ttVJyCw7OR9:U3ApFJ1eRxGm/ttV47O3
Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests uninstalling the application.
  defense_evasion
behavioral4 behavioral5 behavioral6