antidot | 176c15abd8129000e3aca8533e284861787a531e33ea0880de5653769ebaa218

Analysis

max time kernel
149s
max time network
156s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
21/03/2025, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

176c15abd8129000e3aca8533e284861787a531e33ea0880de5653769ebaa218.apk
Size

8.2MB
MD5

55b16a8cc81fca626083e08630c79f73
SHA1

cc4446fc2563a72f3a1174ae950a8de27f7a72c9
SHA256

176c15abd8129000e3aca8533e284861787a531e33ea0880de5653769ebaa218
SHA512

c909ccacfee40f677ed89407248832e53fdb0c135e5dda375201b45782fdf357d411fbe5f1609926edb3283c46c16a3905479a68fe3589e9a8ea59ac78564a14
SSDEEP

98304:IT3Azfy9xAcCJla+YmAtgOJvIK2RRb8OpRTqiaWG9Mt8sraryz9Hhuww/IC/vS+G:pfEqJoLftgO1Qj98Nz+zzuwi/q+96iK

Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral2/memory/5094-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.fonajo.encrypt/app_giraffe/PhfdZ.json	5094	com.fonajo.encrypt

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.fonajo.encrypt

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.fonajo.encrypt

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.fonajo.encrypt

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.fonajo.encrypt

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.fonajo.encrypt

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.fonajo.encrypt

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.fonajo.encrypt

com.fonajo.encrypt
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5094

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.fonajo.encrypt/app_giraffe/PhfdZ.json

Filesize
593KB

MD5
85f35c08e102fb2a9d1451a408d5d973

SHA1
88b9244d1f245ccee803a386db9ba1e09a2f49c7

SHA256
23294ed9676ecb2a60c111176c39cb49c177399f6ce0cd5e3a3fb6584886bf17

SHA512
fee9ce329e3c4ec6e8cc8338e99c2a16e9e5d9578c46e7949a7e13233b6a844177be84cdfdebd976613af1b80c15bc4f01b9c4ad70164b2f749d9e371752fb1c

Download Submit
/data/data/com.fonajo.encrypt/app_giraffe/PhfdZ.json

Filesize
593KB

MD5
329d7b99cecd798fbe4e4885296b14c9

SHA1
10c820e42ae340b3df4ecc31149402169b62dbd4

SHA256
607ce1608b77c6cb99af104864408c0d76e7541ef35344f174d74e9034f2aa97

SHA512
50ce84b9aa3915a250a8140e5d28a09c6e43c97013dc4d254fda70ccbc1f5b70010c93aa7c8f4fa5bfd6a6c5d94d523f7167d4866a0fcdce298f06539038d626

Download Submit
/data/data/com.fonajo.encrypt/app_giraffe/oat/PhfdZ.json.cur.prof

Filesize
2KB

MD5
438d24b9eaa82107ff9d9af589e2b760

SHA1
10f0e11137178e8ba4a02cce067e01e0d823de86

SHA256
416d3d895b908215deb166d64a20ad27d6a1c660087b42fa2821f6ca17127094

SHA512
91251547dd8e608bbaef26210c7564ef7717d583daee21fa7b9cae60e3a9d9be50ea5a2d4420417b50b6958393211b50cd7a9c0ef6aa17fc512a5c7a4aff5538

Download Submit
/data/data/com.fonajo.encrypt/files/profileInstalled

Filesize
24B

MD5
60cc39fd931eff583c8bd39ef475fc72

SHA1
a49b4253fa64f2548cc901f0af49828666f5f7d5

SHA256
cd9978d759aab895cdf3bf639c78c4b703b286904d4f54e358add8bf5edbb84e

SHA512
95c900a85e1ef6ec7b221db5f9379e6b2774c15d3286cebe4335af89e150c297ba3e1418217d082986776508b6a20fde39885a1d3561e1be37a31d6d8e743786

Download Submit
/data/data/com.fonajo.encrypt/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
5da9f302b691aa9ef66f833cd64dad7a

SHA1
ca6770b4016dad9aec588dda0a8199c5a525367b

SHA256
9df8082b76d15572fdfa24e8eb93925f5e63624414f1fc973e3cbb1580859622

SHA512
4fee62f854bc65b8bd8da1258aade5f3baa619bf25432c317480b482186824e034ae6875ccf8956fa4cc4a424714cd5361f70506f4389d24d2ccc96ff178774f

Download Submit
/data/data/com.fonajo.encrypt/no_backup/androidx.work.workdb

Filesize
172KB

MD5
d46b540f7ba0a7af23d713ddf9d65145

SHA1
a5cee664e42c8ed1dde307ae3e85d1312657d679

SHA256
e3e6b8706058e232da8812bed0066619493e08150caf9351db5a0269b7bc796e

SHA512
47b857b2c074eba011c938dd1856f7cf425e9bd0ac7d230491cd93750cf8274d0b4a364d44a675c4991fa7f2b4f9d7eaccafe13eba8090c300132feb9f9fbc76

Download Submit
/data/data/com.fonajo.encrypt/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
3dbc53433cfc3848fb51347eab41998d

SHA1
fae083a275d5af3589b9db3d7252b21114d9d905

SHA256
e3db9bfb0f9e2994e02957ca9880878d6d0548cbcb414c0948384ee3010e96b1

SHA512
8cec42c1cd8ed4c925839582a8f74dd326e651239ffd4460a38123c35a50a24446d20e592c50c9332fb619b7fcfbba5e6c8611c6c2d9f8973483d9fa01f4a793

Download Submit
/data/data/com.fonajo.encrypt/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.fonajo.encrypt/no_backup/androidx.work.workdb-wal

Filesize
434KB

MD5
27d47a3b97f001d36636f74a22e49cc8

SHA1
69099fa9be775619c7e20e53a6881894f2835871

SHA256
9a083c3fe97ba180f369fe86e3306dabe2a4cea17fec86b2758be944286b819c

SHA512
87997e2389f895633b474b8ef4e2e264156925b8868a9848d84b0689a2a027c4b5e257ed7ecfc48a1ac7646a907c343c22ca200ce3d5b215b1e0e916bd578186

Download Submit
/data/data/com.fonajo.encrypt/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
5a3a7da9566e9ca91573b08c02eb05b6

SHA1
275f53096d8800a32636fdb3527da2179dcad39c

SHA256
b09ac9c82da2e199b6dd67eb726fcf1349d177a665564794f2daca074fdf07fb

SHA512
66bcb3eaea84ff157fe910a5b29909408cd8c0edcc5f36e1149bae118f0ba6350146234eee5e8a322b00d3233e8d3fd0f8f027e82ff7a0f1f13d2358f5198459

Download Submit
/data/data/com.fonajo.encrypt/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
6726b5bebb1d1128a181c7d34411dd63

SHA1
3dad53784a9f38afd9ce46d2cb901ffdf06c3b9b

SHA256
9f6e67022009a695b5008545f588d28fdf277faba82ccd6ede537d641eb0b109

SHA512
be5bd30aed699ea1c6e10a789a664c69c59cf86076b6f19f1728fa54eeab983cc0cfbbbd960a0eb851116dd78015b7469d6049c88f84ad749c70a9ac0558ade2

Download Submit
/data/misc/profiles/cur/0/com.fonajo.encrypt/primary.prof

Filesize
1004B

MD5
210bf258dd5d3b323f5d2d0c092e630a

SHA1
b78713669eebd9b495ce45ec5847e13ed517ccf3

SHA256
970530fbfea991d8ff48c10cd2947b8973e4902086f08d80f793262bd5101eed

SHA512
0fec4a63f9f051037f609c279b11a610c0764d76d33217b1b87450131c2b090830d66300f0b0916ecb22a9824f2ddd12e1916bed60081f5091773b35b57738f5

Download Submit
/data/misc/profiles/cur/0/com.fonajo.encrypt/primary.prof

Filesize
182B

MD5
7407a1a0060b012099eabd0e9032d9c7

SHA1
af24cedfa4561b44c586593f9bb9e0772fb2b1eb

SHA256
f9e3485372db845330f58eb7f3da2b204a17701f3d05020b7587e9864a515dbb

SHA512
3b38ce8097c8e8d047642fbbba86272a0dcaf0a9eb51b371bbb4446a3e1ffa346f936df18a4cd995eec2da7ef93a33957cf128aa6152883f8ce25fdc5347d92c

Download Submit
/data/user/0/com.fonajo.encrypt/app_giraffe/PhfdZ.json

Filesize
1.3MB

MD5
57184c2ed638d075817a9821087f71f3

SHA1
14057a7f5bb31232d4a7ad8307e3dab740b8bc96

SHA256
c62f01e5df2309e9f4ad21cbcbcc7868e73085fc894ac9d6860a931c4adf4b4a

SHA512
d2383bf284b3231f977005f66d777592500e21916bd938b5e36ab18a6e27c36a713ec636615750c10bfd5d9a2ea7186ef2892df1cdb36ba794ebc1a12f96a768

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads