antidot

General

Target

de7f3752a820b95fd58fc0099eaf6bb5a825d3d561e03dd5766a64cda456338d
Size

7.8MB
Sample

250322-adn8lstvds
MD5

e89c4dceb41be42fe5b85863c53445db
SHA1

48c364929a8fe07c1bdd52438dd0dd031f426b20
SHA256

de7f3752a820b95fd58fc0099eaf6bb5a825d3d561e03dd5766a64cda456338d
SHA512

593735a5f3c4f34509ce735039345b1b53c986a0c8145db55eeecc8ae99ccee36a13ce191f8a4c7c174eb1d1deea560f5f1df078ce8e7cda5eb66614d450e4b1
SSDEEP

196608:v0Z5yUCT+IOCBZGz3urg/QVrHHjvvMMe3ko4HUUOPenRBz:+ZwtbkOrfrOPefz

Score

10^/10

Malware Config

Targets

- Target
  
  de7f3752a820b95fd58fc0099eaf6bb5a825d3d561e03dd5766a64cda456338d
- Size
  
  7.8MB
- MD5
  
  e89c4dceb41be42fe5b85863c53445db
- SHA1
  
  48c364929a8fe07c1bdd52438dd0dd031f426b20
- SHA256
  
  de7f3752a820b95fd58fc0099eaf6bb5a825d3d561e03dd5766a64cda456338d
- SHA512
  
  593735a5f3c4f34509ce735039345b1b53c986a0c8145db55eeecc8ae99ccee36a13ce191f8a4c7c174eb1d1deea560f5f1df078ce8e7cda5eb66614d450e4b1
- SSDEEP
  
  196608:v0Z5yUCT+IOCBZGz3urg/QVrHHjvvMMe3ko4HUUOPenRBz:+ZwtbkOrfrOPefz
Score

10^/10

antidot banker discovery evasion execution infostealer persistence trojan collection credential_access defense_evasion impact
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2 behavioral3
- Target
  
  doceniyobino
- Size
  
  8.8MB
- MD5
  
  b07c3dad4ebf2fea0be071b21d3a35b9
- SHA1
  
  055c9c361f242fcfe37d349390b407fbe5fb38c0
- SHA256
  
  185c250c0d6db60ddd9f16c48e733e358b81c9fc277710c20a236cbcdc8a86e7
- SHA512
  
  120e6892445604b1561555b93c15a4f204f44d2f2272d0ba28b9efc82ad25001fef427d8212ceae1259129cb41c94762edae9eb2d2c88a9b956b1e5cffdd2452
- SSDEEP
  
  196608:GF9loJeYwPGzyIr9FTLjvsI7a+s/4sTeCXuXT:G6yPGzN9L2+UuD
Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests modifying system settings.
  defense_evasion
behavioral4 behavioral5 behavioral6