antidot | b039eb4e742a77a99452781f9de0aafd51bcfad6dcfea745e88200d0dd1ab69a

Analysis

max time kernel
64s
max time network
155s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
04/04/2025, 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Update.apk
Size

17.1MB
MD5

d44caa02e4fa7e2992b327abb4242791
SHA1

2ec56ee9ad5fe44a3407ff977c6d0b5dfe4704e6
SHA256

3de709dadce6084258b4928145e5da404affeeedad19426f93a2741d6fd6dcf4
SHA512

46b0c1d1a118bbfe621a1f95d2186259db9f3d458adbfdd07686961559d88b37252b1d71fdd4d9aad6e6f6e2b120c906fd52dc04612ae6e1de17fe9d356af57a
SSDEEP

393216:n/6/FU/4HPKDDeXtn7rqqn8W41YRdcz27+rDrfn7S3Zd:n/6924yDiXZr18W41YRvwDrfmZd

Score

10^/10

antidot banker collection credential_access defense_evasion evasion execution impact infostealer persistence trojan

Malware Config

Signatures

Antidot
Antidot is an Android banking trojan first seen in May 2024.
banker trojan infostealer antidot
Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
behavioral3/files/fstream-3.dat	family_antidot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.belilu.acm/app_dex/classes.dex	4813	com.belilu.acm
/data/user/0/com.belilu.acm/app_dex/classes.dex	4813	com.belilu.acm

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.belilu.acm

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.belilu.acm

Requests allowing to install additional applications from unknown sources. 1 TTPs 1 IoCs

defense_evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Intent action	android.settings.MANAGE_UNKNOWN_APP_SOURCES	com.belilu.acm

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.belilu.acm

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.belilu.acm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.belilu.acm

com.belilu.acm
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks the application is allowed to request package installs through the package installer
- Requests allowing to install additional applications from unknown sources.
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4813

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.belilu.acm/app_dex/classes.dex

Filesize
1.6MB

MD5
f255edad36ca54915519e76fed7d8049

SHA1
1b5e5200fc0a4739f65170d8c62a12914272e480

SHA256
ea8abdff5124a73c975b186e92de2fefc8d19b688082bea46cd7773b46374dfc

SHA512
939eee51aa07b8672a911510603fa88fa1a5e9de2f907a2352e46d04cc2002dfb2c50aa7a91b8d1d92c724ecc0f7e992c412f6cd4f208cc7183a99a01dbdb397

Download Submit
/data/data/com.belilu.acm/cache/classes.dex

Filesize
781KB

MD5
52c154dcde5d100bb1526079b0d7966c

SHA1
fb8b8531e5c1da60d3d4ad3336df1202c6b2ee66

SHA256
6c5ba604db8fcec76fbdca3a3a6356effc5d74cb20e526834157ec2c1055d56b

SHA512
81d5297e24d3935b88c88a8bb5af2c2fa56323a375200f3d3ecd0215bdce53d13b017c2ed76f4668000eb3f5a9a61cbfb4661735f6b22c250bd12af68ee0263b

Download Submit
/data/data/com.belilu.acm/cache/classes.zip

Filesize
782KB

MD5
37e70e82c84d65f7b0334ddd76d7b3ff

SHA1
0661ee06aa45c7c7e90e94b0ac3b19bb70f60b5f

SHA256
3b8f83cf8b8e2033f0d1198ac495858e4803b4c655a4281a1f77187b7b779ce5

SHA512
eec81c2771c655fb76f2ffb85f8fa24ae03eba6576299e295f21632e73d02f7c341c35f448ab8ac3de1b1b7eef409f1217e44fc55ce862f0cb5f022c70edc981

Download Submit
/data/data/com.belilu.acm/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

Filesize
8B

MD5
3c4f103ad6ef90eaa85e99b84e471f31

SHA1
3e48ac65c802360723c6163984a61b36b0a6d2d7

SHA256
aaadf4d652c8f85b18f99dc5bca6d0061c573f3cf52477492edccb9c060de299

SHA512
4e6250afd052016701a847f04d264e3d696f90208397cfb0470448fc48200318fecb25109545aafacd80fa498b11f72cbc6d4293965edd92774b4083cfc0d8ba

Download Submit
/data/data/com.belilu.acm/no_backup/androidx.work.workdb

Filesize
116KB

MD5
2905da42f69345de555a8e855f6834c7

SHA1
fe1271c08e84b0b095f8f55a2e02daea2d661f9c

SHA256
a9c84dbc25fd9b760a29a0aebdbc2fc998926163580db2b94e43b181d115172c

SHA512
87eae0d98ea8b943caf023e39966b1a38018ad526e41d5c50c6b52c6206ea892f4128ed370be02908c0f5f0328906596444247c9fccd2ba89a4132f74e22354b

Download Submit
/data/data/com.belilu.acm/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
44c54a9ed0c4bbcc25fa9f3a4adb2fae

SHA1
f7b7b26aa7529bb2445cf72f6bff1b54b6b84c5c

SHA256
3c32e62d4f0342f0cf40c4a6e6129a1ca6cb26a7d5b232f4a7a6d52db5e45e0d

SHA512
c8d193fb0772a51e2caec64b791937914321031c628d17cf0b6eb54e7997f978eb49bb960d88779036cace4dc5d46ee2f2872861664c1aec5c616be24a7ab663

Download Submit
/data/data/com.belilu.acm/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.belilu.acm/no_backup/androidx.work.workdb-wal

Filesize
414KB

MD5
22b807e91dce4a959c21f3e13ee9ac74

SHA1
a2f8d00cdf5338302055e47fb09a2a6861a90e1c

SHA256
f79f1d0c0f3b76ef9993c60d9bc8d9208e6b46e2f3ea121a4fb6fa8df8aea52d

SHA512
f5e96292578c560f35252f259764c6bb4a79695100c187a5f83c31dc2f27759dec6f514b4a5ca5f12dae49df5f2e3aea197617d6f531606237578aacab046259

Download Submit
/data/data/com.belilu.acm/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
85516c5266c6cf3d17de5de5ba393a53

SHA1
d95fa253b8725325da14ad4d39aada6db7df1660

SHA256
8a47c07409082fad3444c81d14d886af6d2374ff1aa0a23a99ae6767822d9e1c

SHA512
498df1b5fd437fe46bed620577b7c96630cc5ddbc50313b096a1528bbfa8884f61c1e66ac059d9ab2b013862f62222ebc679a4a184098584baeecf856c0e8407

Download Submit
/data/data/com.belilu.acm/no_backup/androidx.work.workdb-wal

Filesize
116KB

MD5
e076ee3d5c0ea9aa4a27da0a42cc88d5

SHA1
54bffd7ab440abbc5f8ce43d743e1bb4a5bdbfcf

SHA256
2691eae5c3a1f7f08d7aa56c3ba505ecf724efeda11f8d631c1c1e7d3468e0ec

SHA512
6ae1abf1cf6869c54e43b96d8199f66c7872206c560bf305624134180ba8f2710316ac3ea60e43db85eb8cadce3a05a8b00e1ad8b7b1a61972509fce62a06083

Download Submit
/data/misc/profiles/cur/0/com.belilu.acm/primary.prof

Filesize
1013B

MD5
00290bc6b09ac837f078d4ac753e0284

SHA1
135a20dd7ca2c536b52883a1c3210e146087ffc1

SHA256
0f30686171731bd060c6bfed03aa7d8efd96b517b9dc9b962ac1432d7d9fc717

SHA512
0d2a64d482fac57df157ea4278f8025fc4a1dc1918b78b282b61a3f34fbd74ab7cdd47dfac7f92f7c6378c58226ae0f952bf32cf5fd5f5fd919704a5c7ac0fe2

Download Submit
/data/misc/profiles/cur/0/com.belilu.acm/primary.prof

Filesize
25B

MD5
b9d9e0f8902d129e1aeebff0ae7b725b

SHA1
cb0d2b4c9dd60a5c1fc6261fb581bcd3416fe781

SHA256
25a822139d06016af8be1296c0242b60e35074f94c713e03323636be1162ce91

SHA512
f158a9dc753e0cb41f71a98714ff02198c576bacdd792a6153fdaf6f9a7b52d8cfb6d09099a269d0c1b0d31e2ea5a307ea1db85115bdc6797887a6de36d597f6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads