antidot

General

Target

3a67cd052d4489d80b891515fb628bb1055d1d36f1098f2e1f8d531f37495239
Size

8.1MB
Sample

250322-ajhm1stwcy
MD5

f33f2bb4a55e8e4d1d0d06b4c1d0a9b9
SHA1

237c8a41e0a5b60ac538e5aa14db0d842348f963
SHA256

3a67cd052d4489d80b891515fb628bb1055d1d36f1098f2e1f8d531f37495239
SHA512

88a5ff8cf47289277e423951d85fe50a03afa33e299c5b33f6a71ba67e7905c6c57541624a344af2db41edfdfe3351d024905a60ea6642233ff722d310241325
SSDEEP

196608:cKw334mHj8u4o1S3oR1h7fSbjTucAW7pHbYw1AaUttl+QUbLs:k34ijwo1NR1VfCxh7b1Ajtlrf

Score

10^/10

Malware Config

Targets

- Target
  
  3a67cd052d4489d80b891515fb628bb1055d1d36f1098f2e1f8d531f37495239
- Size
  
  8.1MB
- MD5
  
  f33f2bb4a55e8e4d1d0d06b4c1d0a9b9
- SHA1
  
  237c8a41e0a5b60ac538e5aa14db0d842348f963
- SHA256
  
  3a67cd052d4489d80b891515fb628bb1055d1d36f1098f2e1f8d531f37495239
- SHA512
  
  88a5ff8cf47289277e423951d85fe50a03afa33e299c5b33f6a71ba67e7905c6c57541624a344af2db41edfdfe3351d024905a60ea6642233ff722d310241325
- SSDEEP
  
  196608:cKw334mHj8u4o1S3oR1h7fSbjTucAW7pHbYw1AaUttl+QUbLs:k34ijwo1NR1VfCxh7b1Ajtlrf
Score

10^/10

antidot banker discovery evasion execution infostealer persistence trojan collection credential_access defense_evasion impact
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2 behavioral3
- Target
  
  wilacayuzeti
- Size
  
  7.6MB
- MD5
  
  42bdb83e42a9fada855b991c7cbb1c86
- SHA1
  
  d363089380fb259c3fc071ad04cbd2662ffd53a2
- SHA256
  
  f5de4bc0a114ad6e47beb3ed90df7071326d87976b9bab6670ecaab6222e6850
- SHA512
  
  c1d01c7a393ca2b936da476bad5abe3faea517a4683fa48275e4c70d28814050a00c379c944576651b830028f99c17cf40fc640b0103492ba81c1b1d68ad8cb2
- SSDEEP
  
  98304:qo/KrTKdFp/WvLPzQlNmxbi3K2ea76TIyIIiB2ieSyeTgnrSsnrBQaOVTXMyebi8:/dFp/KLPzZBUgIydYErSsrixdwiaLt
Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests modifying system settings.
  defense_evasion
behavioral4 behavioral5 behavioral6