antidot | 09018457e7366d2b54ae1ce19ad5ea61ac0f58464d6858c41b358f0a37cf3233

Analysis

max time kernel
147s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
22/03/2025, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

risezikixo.apk
Size

7.6MB
MD5

4a4754d54b066ec39f69a8c4d5f6684b
SHA1

6f12b8f89943ad99c1a7fd872070b28a44783d6e
SHA256

aba358b9c43696eb01fd4ad64db6d55b2e3bf192a05e8a2b658fc43e0d74c2e1
SHA512

6d17d8ffc9c9a20a73739ae5c967ef4644c1e314f8952ee5234de38cae9495ea7f6d9caebc770ddbf3a86c6179fca69891606ef5cf7709ee89e41cea269ba7b8
SSDEEP

98304:SlO3ZBo9NyKP90roRSIC2zf2xCjtP2pLfqH7k3Gqh3BQJgozGaLBP6xwPC5s4Quq:xmmDC1Lk3GqhxQ6Lt2yaLWZdsa+

Score

10^/10

antidot banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral6/memory/4568-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.gedehunu.api/app_ostrich/fybWolk.json	4568	com.gedehunu.api

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.gedehunu.api
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.gedehunu.api
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.gedehunu.api

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.gedehunu.api

Performs UI accessibility actions on behalf of the user 1 TTPs 2 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.gedehunu.api
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.gedehunu.api

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.gedehunu.api

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.gedehunu.api

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.gedehunu.api

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gedehunu.api

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gedehunu.api

com.gedehunu.api
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4568

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gedehunu.api/app_ostrich/fybWolk.json

Filesize
992KB

MD5
b175f5ecb37b15cf85ce78ae2f76b53d

SHA1
ef53f0a4d879876caf0da52fc97bea85bfe7bf71

SHA256
f80c54852aa1737d71d84cb9233690f16000333c1fe19403289a326201d5f78f

SHA512
2d62d697054c416bfec677db2946032fa312f3bb9a1fc496bd04f78f923ce5f5e810dd8790421ddb4ad3c79a252a2cf724e6348a31ffb4e0c99242ab6c39181e

Download Submit
/data/data/com.gedehunu.api/app_ostrich/fybWolk.json

Filesize
992KB

MD5
e972e00ce3aad63780641f50f09ec402

SHA1
b036e6b98827378ce90a98bc324fb81d3e5d966d

SHA256
dda233ae814e2cbe848a992acb59ce4e8bf2ae9e44885bbae51a67668ab73464

SHA512
f36a0a0f033129eebd38be89de5da3961f0a78549719039a0430ded8d86928e41cb9f5b9549a9020695e2c55c142e5bb062cadb1d1d5c07d6b26fcf82fed95f7

Download Submit
/data/data/com.gedehunu.api/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
a565d26659b5179aba81a4a393d0506f

SHA1
3ab109cc4374c1897ca5a1e9ba0b7790f6a72740

SHA256
2429ee7c40b4af4b149d19011d026d8b7f7e89de17935f276dd47a9f364c9873

SHA512
4d532d82fbf2b810f785cdeca8f972c4c79e144d221195fe1a95e44668eb2177e4ceccc666c7c76c275acc128f2780bad0acab30e20d33945562205a4505274d

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb

Filesize
104KB

MD5
6edc2a13449d3bd428c6d5c6249cf0d3

SHA1
50d970d36e4d1b364d3515f18ef725be5c813a03

SHA256
90074c3475c1a09cf2c3bd9f31a6b3504d17556c77d2b4090fcb471163653e84

SHA512
8e35930a45e0d79b1ffafa502b4f28216c4ad87e5db5305114e188a8d48af272c8a8641c71135dcad117dc9a59179f5aaf776adebdf36f081cd3bf53abec26d2

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
9b0500593a0f7642a500e1517296e854

SHA1
851eb62c6a08588ed68b6a903b1478fc20341f5a

SHA256
cf116bbf017f1c86a20499b0120b966571e085892953eae4df0fadb8a3d2a400

SHA512
a57542514f90ede95b851d0eded83a19bcbda02089248b2838257d6a85926e6315b9aa84d6f6ec62aa447694e8227b07b1d8dbe073cd9fb5c103b24af28503a1

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f5fae6681207484d315097f796c0f43f

SHA1
4fd45ef5ea65306e1f1d20f2dcb59257652f5e9c

SHA256
d5ac76ae0622f46383ef86ee0549584eebb5e028b95748370ed1c0f206fad71d

SHA512
19c4443bcff3d53d7c33813a101584a6ef1c01ee7962e33e04e2d7e4ae388f83250525bed0135ee219b1789d49ec40b443e915410a55fcc2d3bb72a943ff6e9a

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
25fd8ad89fb14a971c1bd163958a2368

SHA1
7e67e9b8054bbc7840eb9f8fd74caa1973afc2a6

SHA256
36091fa1aec29d01f7f0eb34ebfa01984f3e68b56ded0f1fd46fcd23b7fc057f

SHA512
e518b02a2aa7e52fca0f68bbb7e39a183ce85b8f9d1ae22217cfe74ecf10939498c11532929ebc037b1cf95a72d77f342e6bc8e169323b63ff447bf3307d06c8

Download Submit
/data/data/com.gedehunu.api/no_backup/androidx.work.workdb-wal

Filesize
434KB

MD5
5f9fee97d3bbd6767462fc6ab71d3b48

SHA1
b7c4050d4176ec0ad322ac148af86d4b94545d65

SHA256
0b856ecfd6f76561f69f66c64928d4c095856feb555316430e52d879fbf084f4

SHA512
54559815c91961df15ed7ebcc34794b33ebd7a78798029a7a345b78180e80bb8e14f790a957db77fa7c0d44e77b752bac8c1a1dad1ac7c119ca6e45b529a0269

Download Submit
/data/misc/profiles/cur/0/com.gedehunu.api/primary.prof

Filesize
1KB

MD5
81195fb69e1bcff85589d5ec7f2eacbf

SHA1
ae25f0d5b2c120217144feb2d71230d8962ae412

SHA256
43ec58bbfa8af9ee1220bd451e22c03892e3d73d750040555d66af4a1c9d3fd8

SHA512
3f3d00e6638a1463b4a62199442482a564bff41276d76104ba11fb7f38a9e396b2bce29863f2fc90cfa5b169a340841657780b591223b8ab714d50eefb4e2f65

Download Submit
/data/misc/profiles/cur/0/com.gedehunu.api/primary.prof

Filesize
134B

MD5
227263167bc1e25b06586b2a4eace428

SHA1
bcef30d5d5d9ba6a5ce8c58b79ca6fe924b56d6a

SHA256
ef7fdb28852616d62307df3deaa112adaed9649e25e6f60d5ec4700cd2ec0681

SHA512
230def9841e7cc7af7804d28d12bcaec17f7b37ab21b7cf4ff44a8654fdc8d3e1208849d675907d2ab22fb38db140b7cfb2f1f96896980e3f792d7a59ea24c77

Download Submit
/data/user/0/com.gedehunu.api/app_ostrich/fybWolk.json

Filesize
2.3MB

MD5
90d90931ce1ba15f44ba378f586b265b

SHA1
b3e9b290c80e97ee8ca62c43ece88dff083d5ddd

SHA256
88b2778c087efc770f4b6167553dfe9ebe1dcfd63ecf0d6d7e6c501749e4d533

SHA512
514a988bd61ade77e206bade2aae61f6b7ff5404ec9788de749c22d8c6524155d0217b2a86187a3ecb74bc8b107b2a541726b62d4d78b13b99c448c374858fa0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads