antidot | 3a67cd052d4489d80b891515fb628bb1055d1d36f1098f2e1f8d531f37495239

Analysis

max time kernel
149s
max time network
150s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
22/03/2025, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a67cd052d4489d80b891515fb628bb1055d1d36f1098f2e1f8d531f37495239.apk
Size

8.1MB
MD5

f33f2bb4a55e8e4d1d0d06b4c1d0a9b9
SHA1

237c8a41e0a5b60ac538e5aa14db0d842348f963
SHA256

3a67cd052d4489d80b891515fb628bb1055d1d36f1098f2e1f8d531f37495239
SHA512

88a5ff8cf47289277e423951d85fe50a03afa33e299c5b33f6a71ba67e7905c6c57541624a344af2db41edfdfe3351d024905a60ea6642233ff722d310241325
SSDEEP

196608:cKw334mHj8u4o1S3oR1h7fSbjTucAW7pHbYw1AaUttl+QUbLs:k34ijwo1NR1VfCxh7b1Ajtlrf

Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral2/memory/5057-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ziwukeji.method/app_dish/aJP.json	5057	com.ziwukeji.method

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ziwukeji.method

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.ziwukeji.method

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ziwukeji.method

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ziwukeji.method

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.ziwukeji.method

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ziwukeji.method

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ziwukeji.method

com.ziwukeji.method
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5057

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ziwukeji.method/app_dish/aJP.json

Filesize
660KB

MD5
eb7a90b4d32f26eb63f0e3662eaac844

SHA1
a1bdeb05d35d99c3aa9e36216aaf161170a4cdaf

SHA256
a7342a34ced20a6143a5dcfe77a2728a6dfb9dc733dc18f6b5c06f3943a3163b

SHA512
19228fd98f1777b1bd462bbec9f829a62e3378bab45dcae643cd838a269e8a5cdc76e11595a5a8346acfce2d5436786ee880ad60e9c2bd8e75b8d55822332c46

Download Submit
/data/data/com.ziwukeji.method/app_dish/aJP.json

Filesize
660KB

MD5
6bcbcfd2021b05b718cfb5056f412cd7

SHA1
1d7252a512ef5bed9ccef15fe56911376c28d66e

SHA256
fd09ebf785fc852dba1290603806fc7654ac4e6627745c20209cde16bda741c6

SHA512
08ee2b38bb817fa09ba575f1f8f969e138b4ff6b4c0dc9cc4270393c1454385ec25d132f0053dc1e5dfcc2612152fd9d56cb85f0588a7a7224b0aa01c0297009

Download Submit
/data/data/com.ziwukeji.method/app_dish/oat/aJP.json.cur.prof

Filesize
2KB

MD5
e5893b794c96434e5f2fbab6f622acb0

SHA1
f4342fb8ae2afe6e075d1993e2ab6ce0ca8a9e9c

SHA256
c27e2917edd6ba15e07a5e81daa5112ce81da04fc9e9735d377dd52e7053ac51

SHA512
9cac814eda47c6d45c2397c9a97986150be467fe7c67d600c0ec3ca6468877bb06a902829e1c9ea99d0349cb226e4dfdfd5a03a6a0eda0862638c6752ccafc26

Download Submit
/data/data/com.ziwukeji.method/files/profileInstalled

Filesize
24B

MD5
fb7087736db87cc9954a73841f00e162

SHA1
50945e2ffc4bdbb083d577e79b6019868413db41

SHA256
28b75b0cfb27cd0771268536299c4d5aa8c6053b018dc2cc0349dbb3de8693c9

SHA512
2cd231e17df144b064691102c1cb54552b56495a68757bd240e947caf7d9d06a7afaa4537493845f63538120dc6c3fe65c0a4a5f7436fca65c949a151e747d13

Download Submit
/data/data/com.ziwukeji.method/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
d5c3c706d23c6afb6e2c5753b6c68c74

SHA1
c4b39c3c9f132b468b0eb1e8f885f6d5be9713e7

SHA256
f3314cccbf0e0634facce8ddd296034ccdc1ffc74dd3df216d46ec311b0b2daa

SHA512
082fabff3b98297a5670ecee030b9be4551c4e5929a497cb4897dbb796e0c0efd8fe67b45fccdb563390f25beb94021f4217b0427dd31c0b6d9250a983eae0a0

Download Submit
/data/data/com.ziwukeji.method/no_backup/androidx.work.workdb

Filesize
172KB

MD5
607e8afc3b3a0a5b251167b8e7e3373a

SHA1
8c5236001e644a717b847f4cf0c09b97d12b09cc

SHA256
7ae597bbbdb23c668a16ffd8e523e12bd7f232034b9035763c33f0a003827b57

SHA512
b4eef5fb44f057c1aa6fed6460cd0168a8d8dbd9285ecde72b3fa05118e790311e341d78bb1dd73685af86402f996b90db7fe409a31540759572348e5665d7c9

Download Submit
/data/data/com.ziwukeji.method/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
58aead1027b31df22546a2a094632f30

SHA1
ea0248825073a21a291c74d417ebaffd0f285a35

SHA256
d23fc3ca9e367ed3bc37dba8ad1631ce4d8a874ee9c8555b5d72a919ed6277ae

SHA512
ae55b7e19fc4cb0bda26d05664e6b73821172ae3aadff6ab14c2005006987887eb616c0cab5184a2e8ee23d11a739077d9b43a4bdcd4c406a8cd0cb4b4f09e00

Download Submit
/data/data/com.ziwukeji.method/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.ziwukeji.method/no_backup/androidx.work.workdb-wal

Filesize
426KB

MD5
366e218747d204eb27617bc534279f47

SHA1
52b0c811729ab6d0ed24410fc9965c20c40b1488

SHA256
2ceb0c6c6feee383e13a28489ed77e7409eafd1bd543ff5bafd2a52a8212aa5c

SHA512
e77d7242d1a7be8503077fa1f8eb990e2ec3e62fb12aa855e67bb7b5f3095663899ab413373ba2f61eadb15775efd940e098c523cb0430eb18befbee31982990

Download Submit
/data/data/com.ziwukeji.method/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
87e2009d05032e5cfa34ff802242ebf6

SHA1
9961809021ac27a197d5d1e15a839b5f7b34f67a

SHA256
6a1efca7f0ab0519d92b5ac0b6d81e5edd04cb901fc2f5c085615221ad2b4a98

SHA512
a2df2a57696e584f3d56e995a130a59f59d4b3c6a895032bec757626b738769835d9fc1ae1f523239bbf4f32f40827d82c6ad68730f35cfdec7cac9af707e854

Download Submit
/data/data/com.ziwukeji.method/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
15750758de44e18057c0582804f24171

SHA1
e4c04f0459a2042723e1d1cbb16aaee01bf167ec

SHA256
ae6eefe34688dd50dda96ed82d5faaea9f1819b6f863154645263e1ddb2a29d1

SHA512
7f66757a57b3c354e1cf4e045d59832d5e6bb0268a7b7533414ad3658e9fd74450b365ae804fd9c9fb83772d822679cc859fd057bc684c6339d34532129cdf7e

Download Submit
/data/misc/profiles/cur/0/com.ziwukeji.method/primary.prof

Filesize
1KB

MD5
222aef0bbf6112f68231a800df22aa48

SHA1
397d92202723eeab7deac45a2f374a452376c4a6

SHA256
fa53913fb9c01c107822611017186642e2ef2e86f862402ee31712704a10c392

SHA512
85ed326e5d66c959856f057ead9ecd8e6eb8237f2941cad458b9f11f39ed91fb627ab717ffc68b42080f9ec363d91fa907a6f248e7c53721c1c86c5f900fa077

Download Submit
/data/misc/profiles/cur/0/com.ziwukeji.method/primary.prof

Filesize
196B

MD5
09852f4387fa65d98749358a1098b4fa

SHA1
87e0e9d037f4082e8b53973749cd9370573c536e

SHA256
0c87090768a18b73251e08c36ea089e2d4e3cb7de8cbf97a2ffa87f67e144826

SHA512
74a24205bc9ec53f42e5d477b2ef3366041b553cef148cd7e31a1a9222bcce919099fb0c9be69bc2e2579fb98c93f06173c17bcb5e895b1d10ca4e5903b00479

Download Submit
/data/user/0/com.ziwukeji.method/app_dish/aJP.json

Filesize
1.3MB

MD5
9b1dc8c345efcd6d665cdc441b0742f3

SHA1
e993a666e7905bfe05a6ec01e5cfbb075d2b032a

SHA256
a624e32b4de5914490569479feca4ab96ae1320f733befe6b15518d560fc05b5

SHA512
e9f2455e6211daf1a77ac28b5bdcd798b5cac71a1694b10794a9dcf78da836e00c68c7dbcab3acce38a2314085c64ff154c1bd1555f58af2ee6e36d71520e005

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads