Extracted

• • Target

    4b38232db89ffc202f41fee493a84b056f1115339439efb6635d170e05bfa85b.apk

  • Size

    20.5MB

  • MD5

    3306391950192abec178615e5dfcee53

  • SHA1

    73d7d97fa7943be3fb1a09021579de25f101d6f8

  • SHA256

    4b38232db89ffc202f41fee493a84b056f1115339439efb6635d170e05bfa85b

  • SHA512

    67e19e7dbaec8d102cd41a693a86203bf1b2ca4147d29b5d4d5b30e24969d937c1e3ef67f88ad1ecfee75fdd80ef5849ce56d10d55f9abec58f6933063932ddb

  • SSDEEP

    393216:oyNMhsJA35z7A79L+oIv1mbgafiubcbZLbhT9i/zVN2I+TX296KpPbNiRSKcsgJk:jM6JA35z7c5KtmbBffcFLbi/zVN2Ikm4

  Score

  10^/10

  andrmonitorbankercollectiondiscoveryevasioninfostealerspywarestealthtrojan

  • AndrMonitor

    AndrMonitor is an Android stalkerware.

    trojaninfostealerspywareandrmonitor

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Acquires the wake lock

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery

  • Requests cell location

    Uses Android APIs to to get current cell information.

    collectiondiscovery

  • Requests dangerous framework permissions

  behavioral1behavioral2