antidot | 8fd64a79bb82be391831246f087f61e6b7efa91b1088de671b5a0505d74596f4

Analysis

max time kernel
148s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
22/03/2025, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fd64a79bb82be391831246f087f61e6b7efa91b1088de671b5a0505d74596f4.apk
Size

6.9MB
MD5

08288e2f6635941c7dcf44ca1fc72b5d
SHA1

ace53ea605e8deebe778d8da7f38212807a30b5c
SHA256

8fd64a79bb82be391831246f087f61e6b7efa91b1088de671b5a0505d74596f4
SHA512

4fba748e64dcafe2740fb9fb132f5c66846b26e88650376d5e368b7dd26599c772f3e2c27aa44d26e37d97d28245f8f66dafe635508a95732016002982238d3f
SSDEEP

98304:+o/Kr+167klRoI4fslzEBzyHPxkZrSf/cd96hg+hbj2ieSyeTgnrSsnT:D67klRpaCnHP+ZWf/O96hg+QYErSsT

Score

10^/10

antidot banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral3/memory/4793-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json	4793	com.moduzigope.array

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.moduzigope.array
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.moduzigope.array
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.moduzigope.array

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.moduzigope.array

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.moduzigope.array
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.moduzigope.array
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.moduzigope.array

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.moduzigope.array

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.moduzigope.array

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.moduzigope.array

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.moduzigope.array

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.moduzigope.array

com.moduzigope.array
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4793

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
944KB

MD5
473c56196d771ec58f1b7ca467108559

SHA1
ebab80e23c5058aab2a8706297dab08e0b582fd1

SHA256
0d898506b0e707fb54280d12ceae72e6f73b78939551a293331e66f997144bde

SHA512
2d92645548784730ba744c2598c516d68aca704ea042ff041272c1e961e4ff5201f0f2f1a8456fcdd43d6643d75543c9edfe9e98f5018d8a68f73cfb09d40dd4

Download Submit
/data/data/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
944KB

MD5
7e1e61f33c84d3f1dc0f16dc604acdab

SHA1
e51f8e5ddedba95c5712bd1585f3409278e760ad

SHA256
cb526ba231f422499726499461a026f7a1c38901c930bc235ca48e08356d5dd4

SHA512
c4f45793f11480624b0afd17d4730d0d02c9353029197103ff17384713b25d72f4afd3e78297ce0458c447aea84773fc698c2ac9a33c380a053ef8eb1da92749

Download Submit
/data/data/com.moduzigope.array/app_loud/oat/DuWbiK.json.cur.prof

Filesize
3KB

MD5
ded4d11fc659116e91c27ece10ec4431

SHA1
adbfaa2d6227ea63b1f1cc168962ab7f1b4f2477

SHA256
ba794fde3ab36189fa6e8f2883296fa4251707af9a69e5f80f306007638de69e

SHA512
e589fc1a678ac07e67d2c42563343f6582300eaa0ea87b3f51204b48f5813286f5b49df81677a03809ac8362ebcde84538f1cdbb92f4ba7feb3a7645fa9cf912

Download Submit
/data/data/com.moduzigope.array/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
2d310d5541cf83d9e55f419214d5629a

SHA1
d9e14b3edf0482e8a1d4a89c49fd9c45a1c17681

SHA256
bd6e29dd38e10a764482484f44851c262d43e3ad3886dd3e5e1bb00eba49c934

SHA512
fde7d67743c2859bbf093e96ce37f2bb61c57edab136f738e1b4458ca984dbae564f05fc405205286c3dcd962cc01d9676ca3b4206465b5a27e91db6064f495b

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb

Filesize
104KB

MD5
6f8384a87a6f04a74b9d887a9ed11b19

SHA1
f2ab9c00905b2fcefecb772d83350b1e5d7be529

SHA256
d29f3c8305691ff092ecc466dfe01bb2ddc92dd5d6822fd3c7c8c55d223e2f72

SHA512
ee5660c8e5e537bd14ebbd90610347c2ed5f7d051e8c9b67a9b29200512c20e9dd798c9d00b47c70a5211ab7e2cd5e600137babf9a0381b0aaa1d0893e9ead9e

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
ca0c12c39fbd272f675be48afec0ba17

SHA1
262bbafce6ea435592f7d79a5d7388f76e302f54

SHA256
d81efa6d58905bf8504c8487fef71e162b1699073e67398966f84b99b7051cd0

SHA512
b95dc2e549540bb3e41c5078bee16f53ce457125ad0dc7363e59e71c5ca89485f2e48421646d9d3dbe190944166c815cdb389a7d1d4a7db180fb518b3bc17e68

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-wal

Filesize
426KB

MD5
5bc72059ecbc46bcc0edb98d3ae24ade

SHA1
b83f3e512220e3bae72abeaa057680b9a06482ba

SHA256
be3eaa603f9f0e700ed8b0bbfa0d70b8c6d88024898b6097201abd5b8e4ef526

SHA512
2d0575255ea04d4601b1de4489dd7a0deb87779ae746b3b2a7f25c93c962f3d33b7fa11c15bda4a4e5d931d4f7992aefc17a28a69540593ee47871a5a35ab426

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
ebd1aada90aeddf016fc81ce07ce0a0d

SHA1
65f8dba08832ca80e997f0334b91fb1fddfbbf53

SHA256
4489705c23baace385bf405ee3c3f820705354dc7ff06d525c478264844fbc91

SHA512
08e5084d5aa069ce0016a29e9792e0e69dd9a701222ede38e4288d1823569f0091d4f14bfcc3d79d4f3e5f83aefb7358c26c43f97434356515c5210499af37b3

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
630609fa288664c816eba06e2b204aa9

SHA1
3211975b215bcc73be2c7e56fbac0c3a4add2a47

SHA256
bc35ccb25529c56374f1df0880b348bc25747e0b726716c42d653c8c1e4a4ebf

SHA512
23f130548df56b457f171853374061f7f053b83a97a07b58d0128c0ca031e65d4f083c935dead49d9641205999a8022609166b762adf8ddd51e3b71dbc9402bc

Download Submit
/data/misc/profiles/cur/0/com.moduzigope.array/primary.prof

Filesize
1KB

MD5
e0d99945dbafbcc2e474862af8a4ad61

SHA1
759d6db9d7b7ecd3769eeb03054db5f48a44955e

SHA256
1900d5877f50b7ef892621d186b57cea9a98aeb558fb059c95fa45eb69787661

SHA512
173063e904bc1ca33eaf525be8e9664c3ebd329a2e948da8015877cb4a2c91a3871f332d91a22febb8913bf9b85d05d4ce14e939754eb8c7f89b32b58b87153c

Download Submit
/data/misc/profiles/cur/0/com.moduzigope.array/primary.prof

Filesize
174B

MD5
4f4fd5e1bfde5631be4020365adf1468

SHA1
1a1467a1469341656bc9f144535a4db4f8584692

SHA256
250cde1135b99548a81b552cda9695d5af1e316f5bc8258148fdac60140c197c

SHA512
4967494195f3ad63c03842dfec81708e06f9450b57cc76a020db4dc7e3c213390c5d7b80884aa78e5c62b93d227c78a72c5adbd9a08763f97ed4bdc26ca3b432

Download Submit
/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
2.0MB

MD5
9fea90da834e82079c6e16b94c23bab8

SHA1
69473ba6eac095ee8a9abc845264c01a09a77a9f

SHA256
5d62db5294944a1d824b159f1d3d829ec294d18e8447ceb56305d8f6801b7527

SHA512
663ea4c65778002a1845bbc9c4f80925799771585fc36a5a238bee233d3de6c36194882d813f122bfb303ddaad0abfca906a295b40b329d28b7225a13f280d98

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads