antidot | 7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a

Analysis

max time kernel
148s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
22/03/2025, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a.apk
Size

9.9MB
MD5

0b3acfb4a4d609fdfcaea52f71418a17
SHA1

356490fdb6d169787c9515c02e0699fe48d54196
SHA256

7214d315b6d9c582e6f06769c890515c6c8340d3f1bfebc57f8a2977f021691a
SHA512

abe971fbcb5fe88d4a12ab200326f4850b61af919c1430510de4c233c6a3aa31bf5cfc40e099849cdbffab5ee6c5d2363e4f37890b00ba9ba185d603633f1458
SSDEEP

196608:9dLrZ7+n1A4GXJai7EvApOUGICoxYErSsik8uf:1yRsJai7EvApXGGjrSm8uf

Score

10^/10

antidot banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral3/memory/4577-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json	4577	com.sahuxe.monitor

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.sahuxe.monitor
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.sahuxe.monitor
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.sahuxe.monitor

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.sahuxe.monitor

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sahuxe.monitor
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sahuxe.monitor
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.sahuxe.monitor

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.sahuxe.monitor

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.sahuxe.monitor

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.sahuxe.monitor

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.sahuxe.monitor

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.sahuxe.monitor

com.sahuxe.monitor
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4577

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sahuxe.monitor/app_stairs/kr.json

Filesize
944KB

MD5
a78215d56178b1136e6744fe262227ef

SHA1
bb80ade285eef6ad823235e6b9f36fc6e4e9239c

SHA256
bf455e8bd24ce54932b5a5c9c9f318670512b386b88fa455f88f48b064413f25

SHA512
7cc1055c0fd42925e3d935abfb28d636cfa99178dfcf1d20930d7f8907916d99e447e08212596a004ab8100ea6ced729956b19a5c0ba4cbfa84f19fcfb190077

Download Submit
/data/data/com.sahuxe.monitor/app_stairs/kr.json

Filesize
944KB

MD5
4b9152756f6d308459a8a1cae8c7bee7

SHA1
5b180677274b1d7c7f0d6cd3fceb49bc12e0c36f

SHA256
e10483cfd7b7f00d6cd21e149155ae68ef0e9b211d96531201b2fe87488758f2

SHA512
1384c1b3263334aa1b5a72104b7632732d2a752e8a08c4197e691f64fb29819c6310afe93c44d832a4b8355e9841e9814390e4f8558c94d741ef3b58201d595c

Download Submit
/data/data/com.sahuxe.monitor/app_stairs/oat/kr.json.cur.prof

Filesize
3KB

MD5
4e2699dc508f6469ee5616cfca6e7df4

SHA1
df6a3e9dd6c0fb16f373089d7cee37197a625f92

SHA256
940d8493ae412d855b56fa96605cdbbab8602c46f34c38b6a9bd0e82aaaad7df

SHA512
598859ba6c747d5e8f39aa3a198ad7a286d7598bb951d2f528380d0ca0fdf26b0708afc19271f03effe83e17e722467c13a40b022d3a209381ad7c70c2858a32

Download Submit
/data/data/com.sahuxe.monitor/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
88f8c6481f71bb10d9347e6cbcf5961b

SHA1
cf7239939cd1a4db6948dc736dc128d5148402d6

SHA256
d8da11a2ae0c2504310586b0133b3d100789f269b1ff6d45c9dbe0b2bd020c8e

SHA512
a40c5222c38d998b18776f7a75b8974134585f9d1cac01382c2f3a52bcd6d1bfb4eb655b20cc7f852d9f7bb026ca82d7640a265696dba5b0bb5e14a6c70be813

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb

Filesize
104KB

MD5
26b4bca91215aa0b7ac3de28a59bd4da

SHA1
d178b3ac3439c00d5f581ea5841dcbba4316eabf

SHA256
c3ea57aa509f69b2593d11c662f6c3b7a8a85abea086f206e08788f8ce189980

SHA512
d695afcb882a4ead0092d80924bb9bc4bfa3a010ba9d446c2fcd477d893d69982ef655bdcbcc1697f590cf05592b517da92793527ab258700e84900e246bb199

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
7bf7827c1d1cb96b2f1b833247b389c6

SHA1
d5575486a42114a57c14b4d2edd2e8581ad4b46c

SHA256
8a7b7ed747ee02d3637c9a848fe7ce2f5635936a94a9d5150d4bcf15dc9efb43

SHA512
372bf2204dc69f9b5e0a8476be674537987084b28cba42a653eb7e938ec55d87ca800e77cf8171aba8e4fb7c3f661dbdbd5a8433204555a33904f7c9819342d7

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
426KB

MD5
629891baf0011cdc95927ea62928465b

SHA1
461c1e22b9d8545fd31ef01b89b91660f9c224a7

SHA256
0094f1c5cf84234e492091a47587258058df8f2d3365a975077123a7780c914a

SHA512
efe469a8e4c5a85be6ab24d89ce5429f2f56d7700d1209ab0980e501108964bcbffc14be0f95d88987fe8e023f6b91ba17c60894a88dc8e193fec784768cc1cd

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
b49a79555341643de588972631d5d744

SHA1
9effeb25cde353af484d6ab88d20231959d731be

SHA256
afc48b36fc56d8250bebfb3b8a59b5aabaf65f3e0e65e8859928221b26683583

SHA512
ecf1b4046cab1a752d3cabe4588c4dabc88f83eba2aec1a85ed57cbdf559fa05522c79f8a123c6740fc151525d53eee1a14b64b12c86e670a1b7ef162f2d8016

Download Submit
/data/data/com.sahuxe.monitor/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
b882c05d123611cb4b1c2128c529ec69

SHA1
d4c0d9f11b6f7950d34a095c74aa016ef769784d

SHA256
d7dc7311f175c5a9b67d4c8c7e3ace20fe1a0418c0f3720c9ef96f0ae8104a32

SHA512
052c197e21ece2050f18158f5e32c28dbc7cb30f77135da9c7aecd4fbbabe2a578da17364c1672314e70c6a0f8f19899a73d6a6126a16180c71d51efe7f744eb

Download Submit
/data/misc/profiles/cur/0/com.sahuxe.monitor/primary.prof

Filesize
1KB

MD5
07528debe20288057f4b98d231735230

SHA1
56fc16aeb4e3045d3836b5e8cb1fd67c18cc69d0

SHA256
67d96b199600b0d656120df1a215dd207cad8ac65ed851d1c6db5703546aaa33

SHA512
bebfcc9dc268b01e60e165d4d775bf0b12da26ffac64e80678c4286530cd2b86f6d581bbeb21440b36a0238a692441e428fd5fa12680df645953b6e6af837989

Download Submit
/data/misc/profiles/cur/0/com.sahuxe.monitor/primary.prof

Filesize
211B

MD5
adc7420f001b9f409ea152ea9917b2b6

SHA1
079555a97927d576ca4e25e65294b83c2b6810d5

SHA256
e153b616a7241b871cefba40bcb73ebf0117b84ce433604e76e65463cbca679c

SHA512
e4a856121b5ad570e4a303e924f167e52fcf17747344e486b5d3e3b39ff202a1bca314e92919011db3b899be73bb088faedddfd08f5dfd9e17ec3c78250b1a0d

Download Submit
/data/user/0/com.sahuxe.monitor/app_stairs/kr.json

Filesize
2.0MB

MD5
038f77c28987447b71f464713ff02e22

SHA1
c3f8b16058694de459127f60a1a5b119f829f821

SHA256
4d587c52d031b4e59583edd18a36a276dae50785cf8f03c69f6c02adc61e4a24

SHA512
8d9f44952932e2f224f264a882b0835c63fc02d3b026ede98c6d02252e5efe6f936ae83fb2d753a8111d82ae0f436c317a3858b9d989c31b6ef9a72e94c26660

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads