antidot | 8fd64a79bb82be391831246f087f61e6b7efa91b1088de671b5a0505d74596f4

Analysis

max time kernel
29s
max time network
29s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
22/03/2025, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fd64a79bb82be391831246f087f61e6b7efa91b1088de671b5a0505d74596f4.apk
Size

6.9MB
MD5

08288e2f6635941c7dcf44ca1fc72b5d
SHA1

ace53ea605e8deebe778d8da7f38212807a30b5c
SHA256

8fd64a79bb82be391831246f087f61e6b7efa91b1088de671b5a0505d74596f4
SHA512

4fba748e64dcafe2740fb9fb132f5c66846b26e88650376d5e368b7dd26599c772f3e2c27aa44d26e37d97d28245f8f66dafe635508a95732016002982238d3f
SSDEEP

98304:+o/Kr+167klRoI4fslzEBzyHPxkZrSf/cd96hg+hbj2ieSyeTgnrSsnT:D67klRpaCnHP+ZWf/O96hg+QYErSsT

Score

10^/10

antidot banker discovery evasion execution infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral2/memory/4357-0.dex	family_antidot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json	4357	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.moduzigope.array/app_loud/oat/x86/DuWbiK.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json	4333	com.moduzigope.array

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.moduzigope.array

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.moduzigope.array

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.moduzigope.array

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.moduzigope.array

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.moduzigope.array

com.moduzigope.array
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4333
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.moduzigope.array/app_loud/oat/x86/DuWbiK.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4357

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
944KB

MD5
473c56196d771ec58f1b7ca467108559

SHA1
ebab80e23c5058aab2a8706297dab08e0b582fd1

SHA256
0d898506b0e707fb54280d12ceae72e6f73b78939551a293331e66f997144bde

SHA512
2d92645548784730ba744c2598c516d68aca704ea042ff041272c1e961e4ff5201f0f2f1a8456fcdd43d6643d75543c9edfe9e98f5018d8a68f73cfb09d40dd4

Download Submit
/data/data/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
944KB

MD5
7e1e61f33c84d3f1dc0f16dc604acdab

SHA1
e51f8e5ddedba95c5712bd1585f3409278e760ad

SHA256
cb526ba231f422499726499461a026f7a1c38901c930bc235ca48e08356d5dd4

SHA512
c4f45793f11480624b0afd17d4730d0d02c9353029197103ff17384713b25d72f4afd3e78297ce0458c447aea84773fc698c2ac9a33c380a053ef8eb1da92749

Download Submit
/data/data/com.moduzigope.array/files/profileInstalled

Filesize
24B

MD5
c44e8b9857f0192527ecd5593f8208e8

SHA1
42b4398f48eae790a02f126d29da4b27de807945

SHA256
2417e66b4697e2d20a455c70ca471db87e2597c6c5dcc9341eae4ec619cca6bc

SHA512
9d1630b5f741536e421a1d1cf9116e8f9f2d5e1eca0e5520ccb8be7d807f006cd17b56e146445aba6735ad43c248ba556e0a74a30f63ec6a4e79747ec3824137

Download Submit
/data/data/com.moduzigope.array/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
b4ce90a4cff98fb78e236812b0824bb1

SHA1
9d7193e1660405b82b75e20f8ca8f98f5a507d3f

SHA256
f848350a5e892c480daa97f01dab9e1a89ba7c00861005b35ea4b32c62f3b4b9

SHA512
c2fc21c91e0a32d0612b0908df78e46ff27aa64bca9292d0d4c7f5987e98363198cd4c361155db41783a6d9f1303ba37e444056d1554b113d4622b9bd612328f

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb

Filesize
104KB

MD5
517bb8ceacb2eea30224f0eaaa66997e

SHA1
7d9a0fba2bd6f9e924b517727d3754cb53fda86e

SHA256
fc7f3ccc3b6054c7adbf19356800894a81bd30c29305772115dc6993e955575f

SHA512
746695f7a61d7529bc8f6aebba3ae4f674918e56f13d86de0d22455635f6b877a1a1fd78999e9ace700781d36da5b4a1567804d6e69929e2ed2fc59f2a9b4ce4

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
1eb91c25951db04ecc513bc25a6bc374

SHA1
d7aac84612bf59832d90329516fa688c55dc0a9f

SHA256
c7b7f5136b7dea75e362ed29b6a3ccf2fc915f4e79997c80134d1ae70673f747

SHA512
05a62f2842d0d109c42ef438c13c61585769efb1f8d6fa4650ca27a79641e209ec8c3bb2ef18a36999e6b01a4aef5f096adfa14a6ce46f74da397b2ad10dc337

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
2bae80451fe312e6d195b03947c6a1b1

SHA1
bad877f2804727c9510d37544b7e0db459cfead9

SHA256
6f54d68f641506201e6388b4802b4ca68dd4b613f4c945f41695261b55a3a410

SHA512
858a5593c2de0fcc333ae3e5b0fdb906b43caa62ab673e17bf04afb798fe17d1826f6dfdab615f85dc64845d8c2829e7caa4996605db498d06fa3e9701d4500a

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
d1fa8ee9d65914d47ae5c120c07698cf

SHA1
b23533f7f3eebc8607e22e20b7214757a4d23779

SHA256
9307631b169ce84d0c9724fdc188c60f923479c2446afe859097581e5ff21d2c

SHA512
e4b17b4b2df774b51582b82e698a3458a6239961bc161d64a7f7137966717db69bac0b15043effe6de4ffe7e7454799225435465e45c08321fcbffaa7395af49

Download Submit
/data/data/com.moduzigope.array/no_backup/androidx.work.workdb-wal

Filesize
406KB

MD5
45a14295e0eb661eec4903794ae9643e

SHA1
e68818519b393644112b5738b6f4ba263c5f9235

SHA256
39c399dbb288d2194d305fd9d47db9681e62b45767794202f5f643c1aa953034

SHA512
f3df998fc90cb674fc32069970f944644470a0265044e0fd630d7fa1f4b5fb6ee784e1db6b0af782df9d95730a904fc84bf0e3e7c2f3d27f2b7bd5c1873166d2

Download Submit
/data/misc/profiles/cur/0/com.moduzigope.array/primary.prof

Filesize
1KB

MD5
e0d99945dbafbcc2e474862af8a4ad61

SHA1
759d6db9d7b7ecd3769eeb03054db5f48a44955e

SHA256
1900d5877f50b7ef892621d186b57cea9a98aeb558fb059c95fa45eb69787661

SHA512
173063e904bc1ca33eaf525be8e9664c3ebd329a2e948da8015877cb4a2c91a3871f332d91a22febb8913bf9b85d05d4ce14e939754eb8c7f89b32b58b87153c

Download Submit
/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
2.0MB

MD5
1fc1820d9311712a2ef4bb7b35093f8d

SHA1
98803bdafa7474d530b4540f6a04e81dfa6e6ea4

SHA256
471bb0020ea3139296b8ec054368362fe27437d703544f88f71c437b2f3a76a4

SHA512
a6a73729942355b83aa653a97fe7690e4f6cfb10a100316ad2c723dfa64a00464231b5625bbab9d0469b9184e7168634b5b53bbf8376e48b2ca33f391cea69c6

Download Submit
/data/user/0/com.moduzigope.array/app_loud/DuWbiK.json

Filesize
2.0MB

MD5
9fea90da834e82079c6e16b94c23bab8

SHA1
69473ba6eac095ee8a9abc845264c01a09a77a9f

SHA256
5d62db5294944a1d824b159f1d3d829ec294d18e8447ceb56305d8f6801b7527

SHA512
663ea4c65778002a1845bbc9c4f80925799771585fc36a5a238bee233d3de6c36194882d813f122bfb303ddaad0abfca906a295b40b329d28b7225a13f280d98

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads