antidot | 8fd64a79bb82be391831246f087f61e6b7efa91b1088de671b5a0505d74596f4

Analysis

max time kernel
25s
max time network
28s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
22/03/2025, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fd64a79bb82be391831246f087f61e6b7efa91b1088de671b5a0505d74596f4.apk
Size

6.9MB
MD5

08288e2f6635941c7dcf44ca1fc72b5d
SHA1

ace53ea605e8deebe778d8da7f38212807a30b5c
SHA256

8fd64a79bb82be391831246f087f61e6b7efa91b1088de671b5a0505d74596f4
SHA512

4fba748e64dcafe2740fb9fb132f5c66846b26e88650376d5e368b7dd26599c772f3e2c27aa44d26e37d97d28245f8f66dafe635508a95732016002982238d3f
SSDEEP

98304:+o/Kr+167klRoI4fslzEBzyHPxkZrSf/cd96hg+hbj2ieSyeTgnrSsnT:D67klRpaCnHP+ZWf/O96hg+QYErSsT

Score

10^/10

antidot banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4512-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json	4512	com.moduzigope.array

Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.moduzigope.array
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.moduzigope.array
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.moduzigope.array

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.moduzigope.array

Performs UI accessibility actions on behalf of the user 1 TTPs 3 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.moduzigope.array
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.moduzigope.array
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.moduzigope.array

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.moduzigope.array

Requests modifying system settings. 1 IoCs

defense_evasion

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.moduzigope.array

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.moduzigope.array

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.moduzigope.array

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.moduzigope.array

com.moduzigope.array
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4512

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
944KB

MD5
473c56196d771ec58f1b7ca467108559

SHA1
ebab80e23c5058aab2a8706297dab08e0b582fd1

SHA256
0d898506b0e707fb54280d12ceae72e6f73b78939551a293331e66f997144bde

SHA512
2d92645548784730ba744c2598c516d68aca704ea042ff041272c1e961e4ff5201f0f2f1a8456fcdd43d6643d75543c9edfe9e98f5018d8a68f73cfb09d40dd4

Download Submit
/data/data/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
944KB

MD5
7e1e61f33c84d3f1dc0f16dc604acdab

SHA1
e51f8e5ddedba95c5712bd1585f3409278e760ad

SHA256
cb526ba231f422499726499461a026f7a1c38901c930bc235ca48e08356d5dd4

SHA512
c4f45793f11480624b0afd17d4730d0d02c9353029197103ff17384713b25d72f4afd3e78297ce0458c447aea84773fc698c2ac9a33c380a053ef8eb1da92749

Download Submit
/data/data/com.moduzigope.array/app_loud/oat/x86_64/DuWbiK.vdex

Filesize
36KB

MD5
76dafe59df2ab4caa743cd8e3608a2d7

SHA1
7f6f4f0f213cf0b058ee0c003b15e270fac407a6

SHA256
f5cf96a5007902c4f81e014798793b9be07c17ed130de0c8bd1e5a830d99229f

SHA512
22b692e3e795f8fcc25702a1bc87afe069ba322ef34e268489ac13428606e53baf2dc6ca8f84388a51f78bdd3d775c5a403246684b8e2d6268dac8b5cf88c239

Download Submit
/data/data/com.moduzigope.array/files/profileInstalled

Filesize
24B

MD5
1eeab70adf5b55940b3a22abae16f67b

SHA1
907fce15dbd0ca2f61bd1e0c361bc81c6b4c62ac

SHA256
fda59674b9ffa974f72795a81ac63f4cd580c7f89b42f1a58533b3f8c15812db

SHA512
047b025b170aba5b6635ac364be53ff960254585bb24a07209af18dde91cc49b8dfe0f12dfb3882b12e893e375de57e6e83afeb753b254b91d2d4797773c8ead

Download Submit
/data/data/com.moduzigope.array/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
d6c0619eab96b5a666e0f78e5e9fc52c

SHA1
6f3e38d21ed2798e1b7b15cd3437c6a688db6f82

SHA256
340ec904aaa976b0bbec86f8f8c6e9f7ae3b35245c0ca9c0744899c0f972b7f0

SHA512
7d82a18e9db8843770a82357491d9ac62b85a7982713a29b008d8ab4badf76557ba1dbd5f4a044f2a971808f2f672d96ef98ec4fea4d54642054bbf62dd084da

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb

Filesize
104KB

MD5
c49367d18f1c11dd0c4063300f85be14

SHA1
c8bc796f308ba4714a294c95b318634267b4d0ff

SHA256
0cbfa7d6b0dcaf1eb3cb1c8208c4e27f21dbd54cbb7ccae4fa6ecbd81e4ba7a5

SHA512
c017530c2fa2fa4da8bfa8af0ef21df3ece794c82b7aef34146e717f1bca4d5c73059f97ecc63b55aaae2bca1682a46140e5d90b0bad25ff0e7d7e2a5cd4e0c4

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
40b972d46c2f82ad9600f3ecad1ee572

SHA1
12057bba9322efce724480c1b81c16996ee07284

SHA256
1851d8cf3c87b80384e86120be0a6a6090580c9317831b6fab3f8a9b47f10f9b

SHA512
3c476a68bfc07bd9ba91a3160c0f93e2c27a7dd112c9245ab6aed656145a65b3793be0d065192f4c90bc00f1429965116c8cc442a28d0a2edfa738097b373ab0

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
2745b3ea117e0d75b4c20efe458eae45

SHA1
8a9dee7194ea210418bb406efcd60ab5871eea06

SHA256
3050b2f245866c6debdab8cf2e66f33f177877383d08918d08df650c48a15efe

SHA512
e852fafa07b3f230773d1fc1be24a2dd3e6ff5e49c432f416405de824fd4f58be901ee2e4177aa29649e9ccf581be8ddac596436fed7efbafecdb8923c0ad662

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-wal

Filesize
434KB

MD5
f99deccd1e3c3075c032ca5c6f19a993

SHA1
3ddb5e112f6215a0cba8dd9d4d822ef2300e203a

SHA256
02c5bfdfb19546cf1944acdf9c267664efd4e1ebabefb2d7ef48d475374c9dbd

SHA512
dc104c116a6e1eac9ad433cf192906a01bd5910b9a71201b6588694e3ee98d0f59ea43e42c46370266ae6619ef2a72956f07808ca2aed1670e53db019217a120

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f117b3f1926cde125239d676c5d072e9

SHA1
7d55571bc9a39a18ccc671bbc42650f512d5388e

SHA256
ae9a389bad5e17afade7ad7d74b40849ccc7310d4450a7bae91b186adda68ffd

SHA512
e7aac115d3fbfdabe2d7991715fd5233acd824ce6b96fb23dfd52e707a1126422cc03ac3ddb40ca2dde57e8bd49844ce3fadd3a7e91a0e3c14e01d94bd80ed81

Download Submit
/data/misc/profiles/cur/0/com.moduzigope.array/primary.prof

Filesize
1KB

MD5
583866cdaef8f1a215446c3845d90d94

SHA1
2a2d8263eb83d60f4cff628f08afd23422e4971b

SHA256
4c17c48631e0f390efa1be0010799218ff54d6c4c0c058fe3406684f7e6f5ded

SHA512
e3f0e43129fd53c44b8c8ca2267b622a7fc5bab5cfb9dd81faf727350741d38b9a8a6a75e4c4f89ee48781d689ae59de02ae327cb1bf58fe5b193e247dc34ce1

Download Submit
/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
2.0MB

MD5
9fea90da834e82079c6e16b94c23bab8

SHA1
69473ba6eac095ee8a9abc845264c01a09a77a9f

SHA256
5d62db5294944a1d824b159f1d3d829ec294d18e8447ceb56305d8f6801b7527

SHA512
663ea4c65778002a1845bbc9c4f80925799771585fc36a5a238bee233d3de6c36194882d813f122bfb303ddaad0abfca906a295b40b329d28b7225a13f280d98

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads