Analysis
- max time kernel
151s - max time network
135s - platform
android_x64 - resource
android-33-x64-arm64-20231215-en - resource tags
- submitted
16/02/2024, 16:29
General
- Target 5f830ca263271deb676bc8ba77d7ecc5cd3c0731f7e01b9050fbe6f20066c47b.apk
- Size 20.5MB
- Sample240216-ty883adb9t
- SHA256 5f830ca263271deb676bc8ba77d7ecc5cd3c0731f7e01b9050fbe6f20066c47b
Score
10/10
Malware Config
Signatures
- AndrMonitor
AndrMonitor is an Android stalkerware.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
- Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
- Acquires the wake lock 1 IoCs
- Queries the unique device ID (IMEI, MEID, IMSI)
- Reads information about phone network operator.
- Requests cell location 1 IoCs
Uses Android APIs to to get current cell information.
Processes
-
gvhy.xmlhefy1⤵
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests cell location
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
SettingsDB
SettingsDB
SettingsDB
SettingsDB
SettingsDB
main.md
main_tools.md
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log_.txt
log_.txt.zip
log_1708100981292.txt.zip
prog_class.name
mch.apk (deleted)
mch.apk (deleted)