Analysis
- max time kernel
45s - max time network
89s - platform
android-9_x86 - resource
android-x86-arm-20250619-es - resource tags
- submitted
17/08/2025, 04:29
General
- Target 18AgetWsAppV4-f3z8Ux.apk
- Size 85.7MB
- Sample250817-e4mvpasycw
- SHA256 9456fca3505e2cf13d07b3b752f6cec4ce386ac2a91bb2d027b6cff35f630d24
Malware Config
Signatures
- Antidot
Antidot is an Android banking trojan first seen in May 2024.
- Antidot family
- Antidot payload 1 IoCs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.somessenger.site1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.somessenger.site/code_cache/1755405631053.dex --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.somessenger.site/code_cache/oat/x86/1755405631053.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
getprop2⤵
-
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
static.whatsapp.net.443
static.whatsapp.net.443
static.whatsapp.net.443
static.whatsapp.net.443
v.whatsapp.net.443
00001DarkWallpaper.jpg
00002DarkWallpaper.jpg
00003DarkWallpaper.jpg
00004DarkWallpaper.jpg
00005DarkWallpaper.jpg
00006DarkWallpaper.jpg
00007DarkWallpaper.jpg
00008DarkWallpaper.jpg
00009DarkWallpaper.jpg
00010DarkWallpaper.jpg
00011DarkWallpaper.jpg
00012DarkWallpaper.jpg
00013DarkWallpaper.jpg
00014DarkWallpaper.jpg
00015DarkWallpaper.jpg
00016DarkWallpaper.jpg
00017DarkWallpaper.jpg
00018DarkWallpaper.jpg
00019DarkWallpaper.jpg
00020DarkWallpaper.jpg
00021DarkWallpaper.jpg
00022DarkWallpaper.jpg
00023DarkWallpaper.jpg
00024DarkWallpaper.jpg
00025DarkWallpaper.jpg
00026DarkWallpaper.jpg
00027DarkWallpaper.jpg
00028DarkWallpaper.jpg
00029DarkWallpaper.jpg
00001LightWallpaper.jpg
00002LightWallpaper.jpg
00003LightWallpaper.jpg
00004LightWallpaper.jpg
00005LightWallpaper.jpg
00006LightWallpaper.jpg
00007LightWallpaper.jpg
00008LightWallpaper.jpg
00009LightWallpaper.jpg
00010LightWallpaper.jpg
00011LightWallpaper.jpg
00012LightWallpaper.jpg
00013LightWallpaper.jpg
00014LightWallpaper.jpg
00015LightWallpaper.jpg
00016LightWallpaper.jpg
00017LightWallpaper.jpg
00018LightWallpaper.jpg
00019LightWallpaper.jpg
00020LightWallpaper.jpg
00021LightWallpaper.jpg
00022LightWallpaper.jpg
00023LightWallpaper.jpg
00024LightWallpaper.jpg
00025LightWallpaper.jpg
00026LightWallpaper.jpg
00027LightWallpaper.jpg
00028LightWallpaper.jpg
00029LightWallpaper.jpg
00030LightWallpaper.jpg
00031LightWallpaper.jpg
00032LightWallpaper.jpg
downloading-1927800201600510641.tmp
downloading-5807979944916034135.tmp
downloading-7976104631515985757.tmp
1755405631053.dex
libmmkv.so
libnmsl.so
libsls_producer.so
libytwa.so
_jobqueue-WhatsAppJobManager-journal
_jobqueue-WhatsAppJobManager-wal
axolotl.db
axolotl.db-journal
axolotl.db-wal
axolotl.db-wal
com.google.android.datatransport.events
com.google.android.datatransport.events-journal
com.google.android.datatransport.events-shm
com.google.android.datatransport.events-wal
stickers.db
stickers.db-journal
stickers.db-wal
stickers.db-wal
wa.db
wa.db-journal
wa.db-wal
wa.db-wal
02fa0fa8-1ac8-4a5e-a98e-1e928cd3448b
451a378f-56e6-49df-91dc-e06dde71e5b4
whatsapp.log
PersistedInstallation193779491604978625tmp
PersistedInstallation7512002285121598266tmp
.superpack_version
libandroidx.graphics.path.so
libaom.so
libar-bundle1.so
libar-bundle2.so
libar-bundle3.so
libar-bundle4.so
libar-bundle5.so
libarcore_sdk_c.so
libc++_shared.so
libcurve25519.so
libessential.so
libexecutorch.so
libfb.so
libfbandroid_java_com_facebook_tigon_serializers_jni_serializers.so
libfbjni.so
libfbjni_kt.so
libfbsocketthreadlocalscope.so
libfbsofterror.so
libfbunwindstack.so
libffqplbridge.so
libffsingletonjnilogger.so
libflexlayout.so
libfortify.so
libggml_core_ops_enhanced.so
libggml_core_ops_universal.so
libgifimage.so
libglog.so
libgraphicsengine-arengineservices-whatsappservicehost-native.so
libgraphutil.so
libhiddenapis2.so
libminscompiler-jni.so
libnative-filters.so
libnative_utils.so
libnativeutil-jni.so
libohai.so
libpando-active-fields.so
libpando-client-analytics-jni.so
libpando-client-cache-jni.so
libpando-client-tigon-jni.so
libpando-connection.so
libpando-consistency-analytics.so
libpando-constants.so
libpando-core.so
libpando-data-service.so
libpando-disk-cache.so
libpando-engine.so
libpando-flatbuffer-jni.so
libpando-flipper-string-table.so
libpando-graphql-analytics.so
libpando-graphql-ast-flatbuffers-runtime.so
libpando-graphql-ast.so
libpando-graphql-jni.so
libpando-graphql-network.so
libpando-graphql-pagination-service.so
libpando-graphql-params.so
libpando-graphql-service.so
libpando-graphql.so
libpando-jni.so
libpando-persist.so
libpando-response-cache.so
libpando-serialize-utils.so
libpando-serialize.so
libpando-tigon-data-service.so
libpando-tigon-request.so
libpando-tree-updater-utils.so
libprofilo.so
libprofilo_atrace.so
libprofilo_build.so
libprofilo_counters.so
libprofilo_jmulti_buffer_logger.so
libprofilo_local_symbols.so
libprofilo_logger.so
libprofilo_mapping_logger.so
libprofilo_mmapbuf.so
libprofilo_mmapbuf_buffer.so
libprofilo_mmapbuf_buffer_jni.so
libprofilo_multi_buffer_logger.so
libprofilo_plthooks.so
libprofilo_stack_unwinder.so
libprofilo_stacktrace.so
libprofilo_systemcounters.so
libprofilo_threadmetadata.so
libprofilo_util.so
libprofiloextapi.so
libpytorch.so
librtvip.so
libsmartglasses-bundle.so
libstash-jni.so
libstatic-webp.so
libtigonhttpclient-jni.so
libtigonhuc.so
libtigonjni.so
libtigonobserver.so
libtorch-code-gen.so
libunityjni.so
libvlc.so
libwa-tigon-jni.so
libwa_log.so
libwebpencoder-native.so
libwhatsapp.so
libwzav1.so
libxplat_appnetsessionid_appnetsessionidAndroid.so
libxplat_configerator_structs_data_access_policies_upf_ipf_thrift-cpp2-typesAndroid.so
libxplat_logginginfra_falco_thrift_thrift-cpp2-typesAndroid.so
libxplat_mobilenetwork_fbdomainsAndroid.so
libxplat_third-party_XNNPACK_XNNPACKAndroid.so
libxplat_third-party_yajl_yajlAndroid.so
libxplat_thrift_annotation_cpp-cpp2-typesAndroid.so
libxplat_thrift_annotation_erlang-cpp2-typesAndroid.so
libxplat_thrift_annotation_go-cpp2-typesAndroid.so
libxplat_thrift_annotation_hack-cpp2-typesAndroid.so
libxplat_thrift_annotation_java-cpp2-typesAndroid.so
libxplat_thrift_annotation_python-cpp2-typesAndroid.so
libxplat_thrift_annotation_rust-cpp2-typesAndroid.so
libxplat_thrift_annotation_scope-cpp2-typesAndroid.so
libxplat_thrift_annotation_thrift-cpp2-typesAndroid.so
libxplat_thrift_lib_cpp2_field_refAndroid.so
libxplat_thrift_lib_cpp2_gen_module_constants_cppAndroid.so
libxplat_thrift_lib_cpp2_gen_module_types_cppAndroid.so
libxplat_thrift_lib_cpp2_protocol_detail_indexAndroid.so
libxplat_thrift_lib_cpp2_protocol_json_protocolAndroid.so
libxplat_thrift_lib_cpp2_protocol_json_protocol_commonAndroid.so
libxplat_thrift_lib_cpp2_protocol_lazy_deserialization_flagsAndroid.so
libxplat_thrift_lib_cpp2_protocol_protocolAndroid.so
libxplat_thrift_lib_cpp2_protocol_protocol_baseAndroid.so
libxplat_thrift_lib_cpp2_protocol_table_based_serializerAndroid.so
libxplat_thrift_lib_cpp2_type_base-typeAndroid.so
libxplat_thrift_lib_cpp_protocol_base64_utilsAndroid.so
libxplat_thrift_lib_cpp_protocol_protocol-coreAndroid.so
libxplat_thrift_lib_cpp_thrift-coreAndroid.so
libxplat_thrift_lib_cpp_transport_transport-coreAndroid.so
libxplat_thrift_lib_cpp_util_varint_utilsAndroid.so
libxxhash.so
libyoga.so
ehktflrb
extracted_pack_file.pack.tmp
gmthhjxv
ehktflrb.cur.prof
gmthhjxv.cur.prof
androidx.work.workdb-journal
androidx.work.workdb-wal
androidx.work.workdb-wal
androidx.work.workdb-wal
ehktflrb
gmthhjxv