antidot | 7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a

Analysis

max time kernel
149s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a.apk
Size

9.9MB
MD5

0b3acfb4a4d609fdfcaea52f71418a17
SHA1

356490fdb6d169787c9515c02e0699fe48d54196
SHA256

7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a
SHA512

abe971fbcb5fe88d4a12ab200326f4850b61af919c1430510de4c233c6a3aa31bf5cfc40e099849cdbffab5ee6c5d2363e4f37890b00ba9ba185d603633f1458
SSDEEP

196608:9dLrZ7+n1A4GXJai7EvApOUGICoxYErSsik8uf:1yRsJai7EvApXGGjrSm8uf

Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4362-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json	4362	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sahuxe.monitor/app_stairs/kr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.sahuxe.monitor/app_stairs/oat/x86/kr.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json	4337	com.sahuxe.monitor

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sahuxe.monitor

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.sahuxe.monitor

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sahuxe.monitor

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.sahuxe.monitor

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sahuxe.monitor

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sahuxe.monitor

com.sahuxe.monitor
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4337
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sahuxe.monitor/app_stairs/kr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.sahuxe.monitor/app_stairs/oat/x86/kr.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4362

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sahuxe.monitor/app_stairs/kr.json

Filesize
944KB

MD5
a78215d56178b1136e6744fe262227ef

SHA1
bb80ade285eef6ad823235e6b9f36fc6e4e9239c

SHA256
bf455e8bd24ce54932b5a5c9c9f318670512b386b88fa455f88f48b064413f25

SHA512
7cc1055c0fd42925e3d935abfb28d636cfa99178dfcf1d20930d7f8907916d99e447e08212596a004ab8100ea6ced729956b19a5c0ba4cbfa84f19fcfb190077

Download Submit
/data/data/com.sahuxe.monitor/app_stairs/kr.json

Filesize
944KB

MD5
4b9152756f6d308459a8a1cae8c7bee7

SHA1
5b180677274b1d7c7f0d6cd3fceb49bc12e0c36f

SHA256
e10483cfd7b7f00d6cd21e149155ae68ef0e9b211d96531201b2fe87488758f2

SHA512
1384c1b3263334aa1b5a72104b7632732d2a752e8a08c4197e691f64fb29819c6310afe93c44d832a4b8355e9841e9814390e4f8558c94d741ef3b58201d595c

Download Submit
/data/data/com.sahuxe.monitor/app_stairs/oat/kr.json.cur.prof

Filesize
3KB

MD5
9aa8640bf97a8eca16f78ffd0f646b8b

SHA1
10ccde5ad8ea58feb5186eda66c5acf228ae535b

SHA256
7bf56ba1e1efa4f8d8b6caf9827daaad9fa46170d3d8c01f61ea98c10aa24e54

SHA512
ab5d73b07d260bccdfa444b9e94ad38795ac2d6db2072cd01df1c1d1bc0426b2e2865425311f3565bc00275202c88d5db161283e0fca451944539b56ec9051e5

Download Submit
/data/data/com.sahuxe.monitor/files/profileInstalled

Filesize
24B

MD5
b8070fb3433003dab36f03ccd0fe7d2a

SHA1
7ba3132532426dcf883227e68ed44a6ed6e2b668

SHA256
be1d6fc0304234f2f3aa7029286727357ec12116486a2fe5de8fcab6362842cc

SHA512
cccece02b0e0f39a019a4712f0aca274756efe8893c0869a17d58b12f098937177403d228255c79a86c8f1b816bccd0b1e5d36ba4143d5295bf1eff2c631e323

Download Submit
/data/data/com.sahuxe.monitor/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
54b95f1e83f9a71cdd7b358c2c1e593e

SHA1
92991e09b4938cd89bf4322dfc59ec3f77b4dc90

SHA256
6695f40ab10250c2ad9fdbcfc5fc57cd26ca15d9d04411cb99901edeebbe44af

SHA512
5c8698c9f405c5fb29cf71ae1f4229a9f92e938b8e84e6989a65fca00ce0221d452324840a377b4790b0305f6083cc42b114dd9d9ade719619e875e7248e43a5

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb

Filesize
104KB

MD5
a99bd2e2da165557ca8c341ee1d9d99f

SHA1
e1855b5e016233ab858cc17eaf535b104b406423

SHA256
169d785bd1e37d74b5c613f9b17e68bd217379c0dd36d771a32efccf6abb15e2

SHA512
8ca3d166e628186c98c112c5ea36a97c06dbdba9d2907915e896d0efa905b9c1d40c5fc221296e72e2be23f75e92f1212e5d75fd8c0814cd6aa9ced685dad98c

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
516a2f6d046299de92955b19505d1167

SHA1
470b2770e58bc32160ddd2fb755fa67df6643036

SHA256
220ebb3b15bc698af66f1d62d05ccbd7f4400251ff77bbc62b12f351cc9d36d1

SHA512
fc12917ba333e0e00017e43b4adcca82e63b4ee1d3c41b106966ad9659fd17c0832e917495f11967b44effbdfde893fa6d7f660f8e0f4c3f38ba308089e97486

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
21fb39285aa8706872f9ba7b36e9d363

SHA1
663437062ee8003745a771a32f9b9c0f72e5d247

SHA256
5b15624e743e86a3c3b07b29b12349cd1d2f9f3bdf9008ef8723a0f979afed8d

SHA512
0fd92c82a2517d9185cf4720441d81bfa298c2865ae9b2ec2768f33e9081d9e864c878d0b17774baafaea7449c476f553c2d12ebeb1b72f389947a7d4c333302

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
d0cb3ad0cb42e43876730a3310967bca

SHA1
4849a628cae89213925977a1d707439fe07e9d02

SHA256
a786fe91b98a03b7df29546ee73ce77490addd32e47204b9fdcf1885780c6678

SHA512
e5eb2037fbf94e3de7015995bdd5d6b5e80e7d4aff4012faaaeafd1cd334fb445075c7f3140e76842e42eec25907c095b26122ad3970775f2c85d32fa1c2f873

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
434KB

MD5
a396d384c6a4cfa3970d9621d39bed0d

SHA1
cc33ce8ac5a1ad8a81b4c30ac4bbcbd17260dcc6

SHA256
6cb7576c6748f69fd6575c4c6ad715d257db4619607601f0d365b79211ae99ca

SHA512
3bb7958ef8bdbfba4d95b5a8629c2e616c819ff6255502f531d27a846969be6a19f2fb150813537941ae5c9cf22aa3cd45d563bb7e4790fd48e149533a2795c3

Download Submit
/data/misc/profiles/cur/0/com.sahuxe.monitor/primary.prof

Filesize
1KB

MD5
07528debe20288057f4b98d231735230

SHA1
56fc16aeb4e3045d3836b5e8cb1fd67c18cc69d0

SHA256
67d96b199600b0d656120df1a215dd207cad8ac65ed851d1c6db5703546aaa33

SHA512
bebfcc9dc268b01e60e165d4d775bf0b12da26ffac64e80678c4286530cd2b86f6d581bbeb21440b36a0238a692441e428fd5fa12680df645953b6e6af837989

Download Submit
/data/misc/profiles/cur/0/com.sahuxe.monitor/primary.prof

Filesize
211B

MD5
468142015683ea3242ddd634ea64c6dc

SHA1
b3735a12d17fceb2cc758c747d0714a0bba019a4

SHA256
783118d94d180264b93a9c504268fc33722d6c2e430d17a9ae6b3c4be7da3853

SHA512
17d7a5608ca7c46795372b20d409c2c46d206b37198ba920377903ec94210ecb3d09a3ff7022b933aeb3314b42d418c4ea9acd0c396d436f34d2cb54aa8d780a

Download Submit
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json

Filesize
2.0MB

MD5
8d7082acc21139f1b5796d3d5f8e4de5

SHA1
c18fa65fff8efa0ff9d56db4aaf561a5c5c84304

SHA256
31a47ecf176c42aa0e315a7a06deeff8834b99dd46b4172ef32497417778fa06

SHA512
9fc3162291ae9c97dad79aff570a6b006f1111b088bc4db844bba0c929b9992d63b4601cdee3832da84db6ed5595b73fd9d54914ebab5f2604b48a88c2cd3a7e

Download Submit
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json

Filesize
2.0MB

MD5
038f77c28987447b71f464713ff02e22

SHA1
c3f8b16058694de459127f60a1a5b119f829f821

SHA256
4d587c52d031b4e59583edd18a36a276dae50785cf8f03c69f6c02adc61e4a24

SHA512
8d9f44952932e2f224f264a882b0835c63fc02d3b026ede98c6d02252e5efe6f936ae83fb2d753a8111d82ae0f436c317a3858b9d989c31b6ef9a72e94c26660

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads