antidot | 7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a

Analysis

max time kernel
29s
max time network
31s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
22/03/2025, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a.apk
Size

9.9MB
MD5

0b3acfb4a4d609fdfcaea52f71418a17
SHA1

356490fdb6d169787c9515c02e0699fe48d54196
SHA256

7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a
SHA512

abe971fbcb5fe88d4a12ab200326f4850b61af919c1430510de4c233c6a3aa31bf5cfc40e099849cdbffab5ee6c5d2363e4f37890b00ba9ba185d603633f1458
SSDEEP

196608:9dLrZ7+n1A4GXJai7EvApOUGICoxYErSsik8uf:1yRsJai7EvApXGGjrSm8uf

Score

10^/10

antidot banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4508-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json	4508	com.sahuxe.monitor

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sahuxe.monitor
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sahuxe.monitor
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.sahuxe.monitor

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.sahuxe.monitor

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sahuxe.monitor
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sahuxe.monitor
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sahuxe.monitor

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.sahuxe.monitor

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.sahuxe.monitor

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.sahuxe.monitor

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sahuxe.monitor

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sahuxe.monitor

com.sahuxe.monitor
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4508

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sahuxe.monitor/app_stairs/kr.json

Filesize
944KB

MD5
a78215d56178b1136e6744fe262227ef

SHA1
bb80ade285eef6ad823235e6b9f36fc6e4e9239c

SHA256
bf455e8bd24ce54932b5a5c9c9f318670512b386b88fa455f88f48b064413f25

SHA512
7cc1055c0fd42925e3d935abfb28d636cfa99178dfcf1d20930d7f8907916d99e447e08212596a004ab8100ea6ced729956b19a5c0ba4cbfa84f19fcfb190077

Download Submit
/data/data/com.sahuxe.monitor/app_stairs/kr.json

Filesize
944KB

MD5
4b9152756f6d308459a8a1cae8c7bee7

SHA1
5b180677274b1d7c7f0d6cd3fceb49bc12e0c36f

SHA256
e10483cfd7b7f00d6cd21e149155ae68ef0e9b211d96531201b2fe87488758f2

SHA512
1384c1b3263334aa1b5a72104b7632732d2a752e8a08c4197e691f64fb29819c6310afe93c44d832a4b8355e9841e9814390e4f8558c94d741ef3b58201d595c

Download Submit
/data/data/com.sahuxe.monitor/app_stairs/oat/x86_64/kr.vdex

Filesize
36KB

MD5
c69578951f8545e7c53df12c9486854d

SHA1
3ffb3fa868803a419734ab9c7babb9c4d456c7a9

SHA256
bcac884e3e479eb87380324205fbb68f8b0d650988bdd60a3d77b036bec07301

SHA512
b9dfae2697e9d3d40931003ee8b0f0ffe5043135d27bd8374fdb6d6dadef708fbeea7008d51ee4076d53aee86434a4d76b022a7827f3a5c1f7f11f14d8d34293

Download Submit
/data/data/com.sahuxe.monitor/files/profileInstalled

Filesize
24B

MD5
5a5905fe7e08572814b0b16f88aad871

SHA1
73cbe7e3427fec332903dca168884a4337905c5d

SHA256
e4636214ee3178d83b752913283aac48aa24d453860fb76aed8fb0466aa8556b

SHA512
50bba66201b89d4e1965f030528e92578d69f34cff4e169539aa309c0164024df681b5d08b95f264e3eaf19b6ac15d7052880e6e50e39e99a9f68a1b9f22806a

Download Submit
/data/data/com.sahuxe.monitor/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
d1c3fe85cffac980d78fe52edda1b348

SHA1
54c08e03eb1511259184f9cb73a3a2cbf3afe85e

SHA256
30e5d0dc864a8e9bede63d62cc3c874270f78449a7871f5fe55cb8ed01b36dc5

SHA512
0fbc9bb4d2c8a6a669d0eaf989255fe5a7dad9087773d72ebc7fd361235b1f31e0d881c431bc7a1b71761fe2305dd83d0e33cbaa9e8a2edfca56c06bbb6c49ae

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb

Filesize
104KB

MD5
d3c3a0c5dc6e98c81c24b43cd14ee7d3

SHA1
6395abac34f398f2efdf4c7a77fa48c81d51a907

SHA256
304541a4cec1bfa09ea025868c021ab34e690842424c52dcd0a08e2664679fc5

SHA512
2cfd4f2544d1493e93946a37b7bd9f570848d7187f0494129b3fe4a71b0ab5f372a29c19f3915fc7b8397e55b4242abbf1c7c76d7ea2d7b20f412400a4ee452d

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
3e84c0b56f7bc74e8b73592137affd18

SHA1
f8b8d869fb6db94f00508e2cfd758f76afb474d4

SHA256
d3030f7aeabb695fa0cf58d954daeefee7600cc4fa91940c8c416f5bffe6f3d6

SHA512
9a5090f4e77f52d9d0712f504003460bf9689255064fc0267b2ff95a2196f54c799011739cc2dec1b0e9a1d43bfd1178b5ea44d3a16b3e09fa1a5f56a876296a

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
f16f411040c32473a4aa7e4460d5bc12

SHA1
86337d5406df4b6adb62e0e57a2550891755a01b

SHA256
393ab2fcc2cf12bf602c27d82fe96f1e1b6417cf422f2301c474c2948f7ef410

SHA512
7fc0fe80559475c32775f5723b3f9687a21c9833fdc7e8673ef876adf0178f7aaeae891bff63685a5af50653d807a9af792d835669354a268cbd07a22efdc4a4

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
426KB

MD5
d65eb99aa4dbf9d3a00a566f0cf5489f

SHA1
fa36b1f0a100dc1d540836e220ade7adae4043fa

SHA256
8b89d2a332a1c1a7a13d653a73906969818b08b3542cceb6638ee2a3afced0a5

SHA512
76621b19e88e679df2b086284df2aeb95289ad5efae42c733fe5dff969a4343ee3daed576ae6682129a0f3cf2748dd7b3b5803830428fde638c86c8668939a4b

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
6b535c4a6b277faab19c2ad174804e54

SHA1
1f4ae3325af161121de4db26993b768e99a7b586

SHA256
9355b2357a53dfd3f7507b338c516558c63030160773259f35832cdf93a5da19

SHA512
533f0917c5d53c8878830935a4099d2b8485b25cd64c04920869fd3d19346ae09d6603f1de87f84518acf329260277eba6c67cb253e0223e8a65b42a530518c2

Download Submit
/data/misc/profiles/cur/0/com.sahuxe.monitor/primary.prof

Filesize
1KB

MD5
a2aff8c18f909c8e10923cddf537a884

SHA1
30211ceae89c191b98d6886798e800cb3b9af559

SHA256
a212cfc120bf71b71ad4fc972d2ec11561815b7547ece2418782370535135a81

SHA512
c04c25846bee12b3661f800b323d3a1db1fd15e931e9163536998f13425f34b5625f2cee1e7798e0f69006fc617e2bf11450043863bf6f6ce2901d0d618ab2f6

Download Submit
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json

Filesize
2.0MB

MD5
038f77c28987447b71f464713ff02e22

SHA1
c3f8b16058694de459127f60a1a5b119f829f821

SHA256
4d587c52d031b4e59583edd18a36a276dae50785cf8f03c69f6c02adc61e4a24

SHA512
8d9f44952932e2f224f264a882b0835c63fc02d3b026ede98c6d02252e5efe6f936ae83fb2d753a8111d82ae0f436c317a3858b9d989c31b6ef9a72e94c26660

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads