antidot | 84b94edbf79d057dbbdc9f8c009d5d175464f0a069bf4c1e9df1b07cc245d15a

General

Target
HotSexGame.apk
Size 9.4MB
Sample261005-kxt83sycrb
SHA256 84b94edbf79d057dbbdc9f8c009d5d175464f0a069bf4c1e9df1b07cc245d15a
MD5 24f5c73f3b6b11a16b8f3baec8b31cd2
SHA1 b661d37d7b0158496358110f398c9f0b0cfff038
SHA512 a813f7fc59a14cf9cd6b5d03e85b1bc0a892cf4417a8590e581113377aeae94a73bb015d90ed48d488b34f1efac197b56410fdff1514643480076cad438ff0d5
SSDEEP 196608:C4ok0P0wxlIF7TSyxxOHKNx3ajHE9Jig4RQ+KT46a2P:1TL9VOq3nig4R2T4Q
TLSH
T1B5A612B3F755A47EC5B6833745760E622163BD298A83C6872958322C4E77ECC0F1AED4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  HotSexGame.apk
- Size 9.4MB
- SHA256 84b94edbf79d057dbbdc9f8c009d5d175464f0a069bf4c1e9df1b07cc245d15a
- MD5 24f5c73f3b6b11a16b8f3baec8b31cd2
- SHA1 b661d37d7b0158496358110f398c9f0b0cfff038
- SHA512 a813f7fc59a14cf9cd6b5d03e85b1bc0a892cf4417a8590e581113377aeae94a73bb015d90ed48d488b34f1efac197b56410fdff1514643480076cad438ff0d5
- SSDEEP 196608:C4ok0P0wxlIF7TSyxxOHKNx3ajHE9Jig4RQ+KT46a2P:1TL9VOq3nig4R2T4Q
- TLSH
  T1B5A612B3F755A47EC5B6833745760E622163BD298A83C6872958322C4E77ECC0F1AED4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker defense_evasion discovery evasion execution antidot infostealer persistence trojan collection credential_access impact
- Antidot payload
- Family: Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Queries the mobile country code (MCC)
  discovery
- Requests allowing to install additional applications from unknown sources.
  defense_evasion
behavioral1 behavioral2 behavioral3
- Target
  dixeda
- Size 10.3MB
- SHA256 c38e6e24e5a311958664492cdf5af99f8eadad21cb8aae07360a27cc044b293c
- MD5 8a9243247c1dfa0b249fae01f49b69a7
- SHA1 c54366269d767717029e642081e63d2f1d9c630d
- SHA512 a75c912eedc64c213d9c45a04af13e8c61eb6236616edca7e30c1dfa4dee42f6d405182a2027e0ffa821daf33d517f4693dea2eb349fdef7686f3d0a894c56d1
- SSDEEP 196608:u9ecLSEPZI5mKfyGNUc/FXIvQwrKOYErSs2:MtaxfyGNUc/FYvQwrprSR
- TLSH
  T181B66BA3D3564A1ED4EA823B58624F4026363C85A743DB83310EB56E7F771CC5A993CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

collection credential_access defense_evasion discovery evasion execution persistence impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  defense_evasion
- Requests modifying system settings.
  defense_evasion
behavioral4 behavioral5 behavioral6