antidot | 7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a

Analysis

max time kernel
149s
max time network
152s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
22/03/2025, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a.apk
Size

9.9MB
MD5

0b3acfb4a4d609fdfcaea52f71418a17
SHA1

356490fdb6d169787c9515c02e0699fe48d54196
SHA256

7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a
SHA512

abe971fbcb5fe88d4a12ab200326f4850b61af919c1430510de4c233c6a3aa31bf5cfc40e099849cdbffab5ee6c5d2363e4f37890b00ba9ba185d603633f1458
SSDEEP

196608:9dLrZ7+n1A4GXJai7EvApOUGICoxYErSsik8uf:1yRsJai7EvApXGGjrSm8uf

Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral2/memory/5067-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json	5067	com.sahuxe.monitor

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.sahuxe.monitor
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sahuxe.monitor
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sahuxe.monitor

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.sahuxe.monitor

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sahuxe.monitor
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sahuxe.monitor
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sahuxe.monitor

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sahuxe.monitor

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.sahuxe.monitor

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.sahuxe.monitor

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.sahuxe.monitor

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sahuxe.monitor

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sahuxe.monitor

com.sahuxe.monitor
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5067

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sahuxe.monitor/app_stairs/kr.json

Filesize
944KB

MD5
a78215d56178b1136e6744fe262227ef

SHA1
bb80ade285eef6ad823235e6b9f36fc6e4e9239c

SHA256
bf455e8bd24ce54932b5a5c9c9f318670512b386b88fa455f88f48b064413f25

SHA512
7cc1055c0fd42925e3d935abfb28d636cfa99178dfcf1d20930d7f8907916d99e447e08212596a004ab8100ea6ced729956b19a5c0ba4cbfa84f19fcfb190077

Download Submit
/data/data/com.sahuxe.monitor/app_stairs/kr.json

Filesize
944KB

MD5
4b9152756f6d308459a8a1cae8c7bee7

SHA1
5b180677274b1d7c7f0d6cd3fceb49bc12e0c36f

SHA256
e10483cfd7b7f00d6cd21e149155ae68ef0e9b211d96531201b2fe87488758f2

SHA512
1384c1b3263334aa1b5a72104b7632732d2a752e8a08c4197e691f64fb29819c6310afe93c44d832a4b8355e9841e9814390e4f8558c94d741ef3b58201d595c

Download Submit
/data/data/com.sahuxe.monitor/app_stairs/oat/kr.json.cur.prof

Filesize
3KB

MD5
6942f83bdda06d835049fd3b46d99131

SHA1
e4e2a97c482da3d26379c856d167116c0b8abd4b

SHA256
d10ad88ae825d5eb28ebdf7480586a0b6c9a2449bbaa835f016bb48dc0f5d4ea

SHA512
8c7fc6a6a1054525d6dfad75def39ae91be3e434e9b940e8d8d119caac144512caf01a08185941f6a7e82c3495f69cf597cdb5d1049079f11a792ac76a9c6a25

Download Submit
/data/data/com.sahuxe.monitor/files/profileInstalled

Filesize
24B

MD5
09e9af4dafb7cc90da0ca2f3f8e7c0c5

SHA1
7df368d4280b742d7a249c1308ae92d13386241d

SHA256
5aed775683d327ccd1deb5ffd7cc48701e7c3500ec423bee93e002163cb36e62

SHA512
67df9ee292b88f584f923b5ce0a51e153cc8adef8ccc522619d953cd553189f2cb0404bdc2f7c2f9866b931ea250807bc5a5c34e95d9d7997f46ed1ba23310a7

Download Submit
/data/data/com.sahuxe.monitor/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
faf3fdcc8aacaaa7ff0157bdf2e1634f

SHA1
d2e5412791cd612dd7da8f43ebb900317ea89db8

SHA256
9fc7063f44837f405d92a706c2ccd39b9be7d0e1297cd9e0d38bf532591ff9ed

SHA512
af2523e9af76e936fe05051b258a9100abddf0846e956d6e7795924ac0981cc87a55fe4dfc1071e09f209f58d0f259a95980fe40b9975f3bcfe990c5bc147a7c

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb

Filesize
104KB

MD5
309a76b9c54a2ba0d7b866f4cb94c858

SHA1
30f9e1f03505689d8e6f33f2bb3e3477edcfc93c

SHA256
7c6d3e625e9c6cd7434ab4240ea013dbef15ef68a91e25d96250c5e82ef84a71

SHA512
7fbe4536fae233a0979f2bbe278fe3cb288fb32bf84a40c7706cf4ed68085f9f8766f3c4eddc62d3e456b032103af9e93a9c7ea532ce991a0cd1f5dbb27cbd36

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
5b1c306e6563a912d7cb8c1db8c4dbd9

SHA1
1865bdf57c85315d6e7b3adad2eb6077383402a8

SHA256
328245a438a444e3701171d46508091f4f4bb350a27a9faddd35ff6e270f1c28

SHA512
7f90983ca93d3d9d2c90ee5b671bfcc13bd2b7fab121e733b1fd652f4420ea69f3355d7b208742cc11fa9104a4f91d175b9bff42535f3efbe75ba3c30086eb1f

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
442KB

MD5
51e3ffcb1aed9216a9bf10113907310f

SHA1
d6d961f0a9b7c8738d9cbb785ebab8b0dc8c591f

SHA256
f40fcacfd7d1b23e5fdba18dc365bbfeb2cd821e6fb32f7673449d2e4dc44dfd

SHA512
56c33c4cec1734116af2918bbdbdabfdcb7f24d5fc9d2622ef26a98776cc73aaa014c289439df30f935f25d91fab75c9c15abe90033b8dc57847f6f8ed0cf23c

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
1d4e706d2a27bb690eb69e4ade48b7c6

SHA1
202cae9d6b56e22f07e5ae4437363d94af1c7f15

SHA256
9e01ba66d41b0abf75eb720de2d76c0e907cf21bfbab57b7678e6b625b703d99

SHA512
9b5adc246e08f25458fecc33528f7d30041960b183018c5a7f9432949f5f2f8d4bd2811747d45066f9e6ebd3aae8251d0e7ffe5937704b8fcc765d300ae4053c

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
99f4ea994f7d4fcbf0fd55058dc5129b

SHA1
28613814b0c2dc1ac11807db023ad31c76b808c5

SHA256
9b7c6f5a5ca3b78bf9a8ab1c08db9bd7edb09cbac050e5a6c89caf1d13d822fc

SHA512
f7022a3a74a080098516d1aba807460ba59683f4eae685f460357e6c6ee69480010f369f0a5f1bca6914ca3e63f9c0e31b39826f2dd914456a5a16f6242195d3

Download Submit
/data/misc/profiles/cur/0/com.sahuxe.monitor/primary.prof

Filesize
1KB

MD5
07528debe20288057f4b98d231735230

SHA1
56fc16aeb4e3045d3836b5e8cb1fd67c18cc69d0

SHA256
67d96b199600b0d656120df1a215dd207cad8ac65ed851d1c6db5703546aaa33

SHA512
bebfcc9dc268b01e60e165d4d775bf0b12da26ffac64e80678c4286530cd2b86f6d581bbeb21440b36a0238a692441e428fd5fa12680df645953b6e6af837989

Download Submit
/data/misc/profiles/cur/0/com.sahuxe.monitor/primary.prof

Filesize
25B

MD5
b9d9e0f8902d129e1aeebff0ae7b725b

SHA1
cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

SHA256
25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

SHA512
f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

Download Submit
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json

Filesize
2.0MB

MD5
038f77c28987447b71f464713ff02e22

SHA1
c3f8b16058694de459127f60a1a5b119f829f821

SHA256
4d587c52d031b4e59583edd18a36a276dae50785cf8f03c69f6c02adc61e4a24

SHA512
8d9f44952932e2f224f264a882b0835c63fc02d3b026ede98c6d02252e5efe6f936ae83fb2d753a8111d82ae0f436c317a3858b9d989c31b6ef9a72e94c26660

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads