antidot | 09018457e7366d2b54ae1ce19ad5ea61ac0f58464d6858c41b358f0a37cf3233

Analysis

max time kernel
146s
max time network
154s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
22/03/2025, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

risezikixo.apk
Size

7.6MB
MD5

4a4754d54b066ec39f69a8c4d5f6684b
SHA1

6f12b8f89943ad99c1a7fd872070b28a44783d6e
SHA256

aba358b9c43696eb01fd4ad64db6d55b2e3bf192a05e8a2b658fc43e0d74c2e1
SHA512

6d17d8ffc9c9a20a73739ae5c967ef4644c1e314f8952ee5234de38cae9495ea7f6d9caebc770ddbf3a86c6179fca69891606ef5cf7709ee89e41cea269ba7b8
SSDEEP

98304:SlO3ZBo9NyKP90roRSIC2zf2xCjtP2pLfqH7k3Gqh3BQJgozGaLBP6xwPC5s4Quq:xmmDC1Lk3GqhxQ6Lt2yaLWZdsa+

Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral5/memory/5164-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.gedehunu.api/app_ostrich/fybWolk.json	5164	com.gedehunu.api

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.gedehunu.api
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.gedehunu.api
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.gedehunu.api

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.gedehunu.api

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.gedehunu.api
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.gedehunu.api

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.gedehunu.api

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gedehunu.api

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.gedehunu.api

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gedehunu.api

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gedehunu.api

com.gedehunu.api
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5164

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gedehunu.api/app_ostrich/fybWolk.json

Filesize
992KB

MD5
b175f5ecb37b15cf85ce78ae2f76b53d

SHA1
ef53f0a4d879876caf0da52fc97bea85bfe7bf71

SHA256
f80c54852aa1737d71d84cb9233690f16000333c1fe19403289a326201d5f78f

SHA512
2d62d697054c416bfec677db2946032fa312f3bb9a1fc496bd04f78f923ce5f5e810dd8790421ddb4ad3c79a252a2cf724e6348a31ffb4e0c99242ab6c39181e

Download Submit
/data/data/com.gedehunu.api/app_ostrich/fybWolk.json

Filesize
992KB

MD5
e972e00ce3aad63780641f50f09ec402

SHA1
b036e6b98827378ce90a98bc324fb81d3e5d966d

SHA256
dda233ae814e2cbe848a992acb59ce4e8bf2ae9e44885bbae51a67668ab73464

SHA512
f36a0a0f033129eebd38be89de5da3961f0a78549719039a0430ded8d86928e41cb9f5b9549a9020695e2c55c142e5bb062cadb1d1d5c07d6b26fcf82fed95f7

Download Submit
/data/data/com.gedehunu.api/files/profileInstalled

Filesize
24B

MD5
6a553e2d5205cc4d84a0d78226d73171

SHA1
56a139488f80de052377399e44d28c9db3a73195

SHA256
2ea680a09ecc81820edc85ccef8bc764941b344d03bc37af15be842c988a5edf

SHA512
5207265e201ea05f33e740d2919d8c2886cdd2120095d8f1aa5d683318d56f00d01b135fdc9880cb7e15cfa559a72079384525e934e60bb97fafb4b2a39c498f

Download Submit
/data/data/com.gedehunu.api/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
a56d308d77997b831132aec459c1014f

SHA1
160d31c741c8492f2fa644744e6f3ea968bf7a9d

SHA256
5c9b4b91ebf5a96f764dc15078316ea773ab479cdb7c5929008a387674841bff

SHA512
7b242c6563f4179e228929a8c82ac3a20adabeffbfaf7efa2e8aed1ea788cf4190521053d5a310058600cc01f9c67e21f784bb35eb9500c883342d2c2ce608b9

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb

Filesize
104KB

MD5
f447e3df8d567fd10117e8a8bc973aa6

SHA1
d7d10713caf728448c0c446b0fa5eebf9a56c50f

SHA256
6349e86c211b65a55277c35082f55fdb1c3bc260694a9496ef0b108f96dfbd18

SHA512
b6fbda02d60c8ed8f77d1882a94de7c31407b3838e3e68079c58f349549dfe0639a6f502d36168993a222a36a3716483d1880dd79a12bffff6eef5f058c8e072

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
64f47afb0c3542e0340f58728ca4a61e

SHA1
3a5b90f8fc9b940ad6d7a73cec80f99011ae3921

SHA256
4164384d2eddc5423a87141f8aea1a70dc3bb8a5beec3d1ca0a59fdb387f721c

SHA512
2d7afd61a03f24e76f1c88d0bf3205989e62979eccb17e761f8e69ef13bef8ee1ea61d30f5773155ad8efdf3675e173d2bd4b3a9dadf5227f817123b7da4120d

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
89ce66ffe5cc7588a663f98b62aa1bf0

SHA1
00656c75659cd1a04c6dcbf41647e61602f90e2e

SHA256
b3ac7e48017cfda4806a723e72ff1c3b5ea29224ac57485a134143129eb25994

SHA512
5afb8ba14df56199e12ac1a75d4e7ad1dacdecb0e06c3fd963aa6e1744eda965d113a3cc26b6c35048273d7c2d285237459e01ae7d3f83a54b02bb4d15562185

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
7c5fedc92003c6fdd210fa5b4be85287

SHA1
7dff395671130c06799024116099c9cae6156457

SHA256
a7a69bcdd4f238699189fcced80d146935bccb103fc132800329e40e1c568f21

SHA512
434ce1d5cb6b06f6c84fc7a4855c52b0eff5044d948267cf3783823f70c97edea8f81bceeea30d163a5ff96959e77fbb128fc0dba23f431bb8199af19a5422c4

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-wal

Filesize
406KB

MD5
5ee2c8fa4ee034686f4a808edd95cfcd

SHA1
989a16d1816dbe95c82226490ff0cd639226e2f7

SHA256
2eafb2f0687098c2bce4cfc714ec8f5261dc537a020a241de8fa06fe61c61fc1

SHA512
07300658a6d4aa3529e50785c92c01ba576b043d72497b929291a1835998e46c1f94fe6db4933b0743c60943ac6de25e478d33491cbc8b10a7735bbd618af34b

Download Submit
/data/misc/profiles/cur/0/com.gedehunu.api/primary.prof

Filesize
1KB

MD5
81195fb69e1bcff85589d5ec7f2eacbf

SHA1
ae25f0d5b2c120217144feb2d71230d8962ae412

SHA256
43ec58bbfa8af9ee1220bd451e22c03892e3d73d750040555d66af4a1c9d3fd8

SHA512
3f3d00e6638a1463b4a62199442482a564bff41276d76104ba11fb7f38a9e396b2bce29863f2fc90cfa5b169a340841657780b591223b8ab714d50eefb4e2f65

Download Submit
/data/misc/profiles/cur/0/com.gedehunu.api/primary.prof

Filesize
25B

MD5
b9d9e0f8902d129e1aeebff0ae7b725b

SHA1
cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

SHA256
25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

SHA512
f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

Download Submit
/data/user/0/com.gedehunu.api/app_ostrich/fybWolk.json

Filesize
2.3MB

MD5
90d90931ce1ba15f44ba378f586b265b

SHA1
b3e9b290c80e97ee8ca62c43ece88dff083d5ddd

SHA256
88b2778c087efc770f4b6167553dfe9ebe1dcfd63ecf0d6d7e6c501749e4d533

SHA512
514a988bd61ade77e206bade2aae61f6b7ff5404ec9788de749c22d8c6524155d0217b2a86187a3ecb74bc8b107b2a541726b62d4d78b13b99c448c374858fa0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads