andrmonitor | 960b8e06d0db96f0bfcd044167a1af9b7397c73a13f222cdcce13f4824a8ffd4

Analysis

max time kernel
167s
max time network
177s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01-08-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

960b8e06d0db96f0bfcd044167a1af9b7397c73a13f222cdcce13f4824a8ffd4.apk
Size

20.5MB
MD5

662a29140ea32f87a19fa76996137563
SHA1

cd0a4bd3abbf0fe2773a9c7a7a589a0609582219
SHA256

960b8e06d0db96f0bfcd044167a1af9b7397c73a13f222cdcce13f4824a8ffd4
SHA512

511b9d8e95dc7fa26fbf385c4f8bbdd0120830d7a4a031ac6929807bf265e7edafaa4778cdae6e80e632b8f1cfd4e7fb194a776328082402fbd2d22b79174b0c
SSDEEP

393216:tGtsJA35z7A79L+v291mbgafiubchZHb9T9i/zVN2I+TX3VyKpPbNiRSKcsbJo:tLJA35z7c5vLmbBffc3Hfi/zVN2Ikn08

Score

10^/10

andrmonitor banker collection discovery evasion execution infostealer persistence spyware stealth trojan

Malware Config

Signatures

AndrMonitor
AndrMonitor is an Android stalkerware.
trojan infostealer spyware andrmonitor

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	xspcmj.qiegf
/sbin/su	xspcmj.qiegf

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4254	xspcmj.qiegf
4254	xspcmj.qiegf

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xd266e000-0xd290080c	4254	xspcmj.qiegf
Anonymous-DexFile@0xd17d4000-0xd18ff4b8	4254	xspcmj.qiegf

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	xspcmj.qiegf

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	xspcmj.qiegf

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
17	andmon.name
4	prog-money.com
6	anmon.name

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	xspcmj.qiegf

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	xspcmj.qiegf

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	xspcmj.qiegf

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	xspcmj.qiegf

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	xspcmj.qiegf

xspcmj.qiegf
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests cell location
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4254
- su
  2⤵
  PID:4293

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/xspcmj.qiegf/databases/SettingsDB

Filesize
124KB

MD5
4c0ccabb25100a908b9db06434a6af8b

SHA1
555d9ecfa42e17aec483e1c05be0fc1362db9e66

SHA256
79aee6f8af24ae6adc8537de3a061bde3778d3d9634265b85b3e8727d4116304

SHA512
b9a4a1227fa927f0ef987a720c5bf16af71f3fba8c1a40d5387ad0d4ba193a1b7b23634b0850af7c25b55c8b2e984e7c84ab8fb3e55c83b3bc2ff859f4dcc5bb

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB

Filesize
96KB

MD5
6eefc9492eaace68b8e9553c97ce08f8

SHA1
71c9baeacba21e2ca6662d25f7e58fa3e7c6b4bb

SHA256
03f29f3616e4c753f7191066a4e1c08d65a9dc3d2f68e93e3232d49a0a044d5c

SHA512
81f4bbb5eae28bfbc4195f9ddd37e421e971c401b5d5552a41105ebdfdb3d240694a4c31e498bcad2d7d97e13e72ef87e28a6b78c0e78330c7660b4f8d519566

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB

Filesize
96KB

MD5
d1a283b8fdcdf696ebe756d79b5d9720

SHA1
011d75ff222c30047996a8f9ebbd02acce428eda

SHA256
370ced6b36f45d68a9c86fcd06988fc998a4ec78c0d3f4338aeef2be6abd7739

SHA512
7e5d4e502661b5740ff1a2b9d20252138f823e662a6d15f3cfed704d2e6db533c6755f56a8333f63fa21ceace636e8d3241977074ac4ba1ad8561dcf060fd4e8

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB

Filesize
52KB

MD5
b6815b344f6926d458cea05acd052cdd

SHA1
88f524aff1d4c5fee979a203dd952427871a7097

SHA256
028666f28ae0086b18fb740f792e8a80ad05547f0c7cb9d2dc8080e5125db366

SHA512
0431375f80e9c467d0abb042e43681a973bce455fe8354f5a138f19a3b28d3adc7eac3fe4c20bf44f085810749569b87a393185cd8f8bf2687f0923b8de4dade

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB

Filesize
96KB

MD5
30f10fbc1a99566d203c87ba363efce4

SHA1
44adaaf06081fc909d16f925f8933bcbeaa98311

SHA256
7409006caa015ab58c75dd16ac9353d62da76a36aa6699e5027e1f8961ea2d9c

SHA512
c325e9e116658844b0e6155025ba1525afcf76b8b1f5bfef284e880daf239d354092a481bbffe26083d7a8959d80bf16305271446a0a174a77fe7b4ae35419fc

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB

Filesize
144KB

MD5
6b68ab8c879d88238faf78581379c724

SHA1
bf3e8bc029285ad20d7e4b0b3e592bf3bdaf3a6f

SHA256
d6bad5b5d988b33354346e101e51d667fda23f2a699877eceeebb6ce55ac5e1c

SHA512
4e840e0631516bede46787893063a3db7ec5134a0073a10eae15372655ef85eeee0cc499d966d0ed6ead235d7489d2d4ba71f9dc5604cff8bb81ec03abd1d816

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB-journal

Filesize
512B

MD5
a7caf5d602e7dcbedeb2740ebfe3aade

SHA1
46c704039c044c848fce1fbdfea9d8677262974a

SHA256
2351f7d13dedc27c434eff3e24ec0fb9023609af131c40607b7aa508d4deccfb

SHA512
7a78f5f2de629b958a22c7084e19e622f174312b200538b576ea453ec1a7436cf9f452b42abea872bca3eab72e17f5064729e7f7ad8dbc17b4255f0f969404ff

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB-wal

Filesize
414KB

MD5
925ea67cf3918cc80cd07898a5f605b7

SHA1
03a42de5a5d1ec9ef6dc74a5cb9375ed8a81284a

SHA256
225c1fab7a042d6e53dadcb650f1aca5c985c065ee3ca31364a12a022c63d209

SHA512
3afe4fca57ba63bffe4e17d0e1cdebdd7c03bb77bd615d39223b3050c7b294678d10b79df4ffb9b93f01c4e4e83b3b34ac27dc5b2c470fddeb0002cef848001f

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB-wal

Filesize
8KB

MD5
016040409ac5f36750d7b03c1e6616b6

SHA1
4c43a2769930a92a4db536a97740f6c90f713a5c

SHA256
9519401bd12d00cfa1a6080691e63c3bbd1f7ee26bb990097768570b89529719

SHA512
14c63bb77551b581b80d37f037b74d9ec5201471832cf1691db046c2908b19ade1773b86c6d6695de4c145b047f0b3a989f9b504cc8cc08caa1dc84426fb4bbf

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB-wal

Filesize
8KB

MD5
13a8b665e515fe40485ab57b46498497

SHA1
4c9a769f7c51b41fec7f166ae77217404b2ccf05

SHA256
95241b8d343e5b2db3d80de16b7f40fdaea6afb30747c48387485d8739d6f9af

SHA512
7014f3983d1db986386c39a101f5792f1b7274a193b681c2c3553889ddf7dd77edfcf4688af7ceacd1f9a5c880565835b6c55544e700f832d2c96482ddacb252

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB-wal

Filesize
4KB

MD5
76295706a231dd3bb8b0ed474f9e845b

SHA1
7e44cbb31d94881b5a6c2af5d690e6c5f012c6d0

SHA256
a6e5f8dc642a5e29c3f54f9e00c3edb75b089527adc3d214bdd3dd7607a400d2

SHA512
fa11aa452c7856c58ab3e27e753bd1694c30a9788f2d01ea91719e4a395257c0bf1df8e518e532aa5f1fd19f768157855c813127c856d924547c9031f4cc3708

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB-wal

Filesize
8KB

MD5
0c8dd6ec6d45601cfaa2b972010a9bc6

SHA1
540e8d0323b69ecde1d37f583a10fdb30202baf6

SHA256
1642b5b2bbc8657faee52dbbc5b248f02f2d474bb57ee0cfd5a100e83db1c2ee

SHA512
df9761c39b75f761212644c152fb0db1d4328c79f2b86e9a67f7d74e2464f26e871d2a889b3f41a9ca8ad12017c7773479270914a6a859fd9f577aee5d6db1ec

Download Submit
/data/data/xspcmj.qiegf/databases/SettingsDB-wal

Filesize
418KB

MD5
755b605f9952ad5d9f7313694fdaa5db

SHA1
1e233c76d39833f68e8be7cb2b8741bc46648c9b

SHA256
719051e31f6d26afb1adf3bc65fc6e867047d5c5691a2e0c75c10411b8a5a1da

SHA512
a54e6b5d358d14cf45b0c132f2262dff7953287118ebe0b4c9eda81319f5da7cfafca9ec4e1135363d0ed56ddeb5738a7cb1c8e613c13b03f63dd4f5138a44c5

Download Submit
/storage/emulated/0/.am/dm/md/main.md

Filesize
2.6MB

MD5
8aa5d8f3622ac78fa2cc58d58c87dfaf

SHA1
33071f0a26c21320a749a25a5e94a694aaf346de

SHA256
db50acab3ed87a8cf5df819c8c88e3364f966dd5279d1f3a3f8e3154ab8cc326

SHA512
0ca20d27a1e8511ef0d588d15fe4c6f443a706af90d414e94d4d7e021080309f574892c327054c9b072a6a8740a9ab88e774116d2d815ed839ea7f813ef35251

Download Submit
/storage/emulated/0/.am/dm/md/main_tools.md

Filesize
1.2MB

MD5
51112e0a7f7962a8e02bc885025414ef

SHA1
40622959af4fe349d8881c885b9b30441de8804c

SHA256
2b089f76930214706716aceba0bc6cefe6e132d14dd7d0a7c59eaa4f90f126f0

SHA512
f02971a0f493fb72539381c3d1503d8573e8bc67f147014f443df8c01e71bb28437f832c5702d25a8bef2c34c64fb1f46d0000523eed04ea7981186ada22e402

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
173B

MD5
10615d360a334ef38999586d6e5d3191

SHA1
736bcae62e81ffffccb0547082e67f6a6bfe44e5

SHA256
25a0c9bf89c7f492a55e7bf90a3ec0ed7e798c7d4d321fb042c849978bf8b221

SHA512
f1398269bf2b1af41ede191dc5bb8adb4e8a85aabe4a5dca81b84c79d73461221b3c7c8dce018373e85c364fc187a80b9f1a6fb187c487aedf7d53702a33d8cd

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
152B

MD5
83bcd4d5786a7efb8afec66fc499e678

SHA1
46c4bd6b74ad32c7732115afed461efc1d215f9c

SHA256
c468576e1952da0c3697a42e45b49e7dd5c56b3a9b4c4194acdefc42d66f6ee3

SHA512
831e6db85d9a1109dc09e54cc39026b22f62afe3a5e464b5470dcf43d47c9d3284b39a5228ca26eb90e222823351f6a31829e00de1f42f08a0a73bb009092521

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
3KB

MD5
aacb4985e7b1637e934d2a4a4299cc9d

SHA1
a9f8fc0ec7824a7acc95c6aa4afb5f84989addb3

SHA256
06fd312923119646c9759168b2cf0379442fabb9c18f3fee5b3e5fe98e20195b

SHA512
19e1e51486758da903f8ee1b539cc1f2b678102fc9b2b374165708aa78df517051359573ebd34ef3854ba45bf27c8655c249656c29136fd497499bdb814a5c40

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
64B

MD5
f89b93742ef88afe0ae52021d7e7fbea

SHA1
cc0163ff54259959745dafbd3656efab80bee8d3

SHA256
d6a8b13634c9f9bc619413fcef536846562b25e42acaece2cf9f50f9209b9e5d

SHA512
d5b333264aae8341d57be7cd3f1bd62c6fc251c72bd05590383082d5872431d1feb0d44ef5c344b50361c78424425b589c130ae0dc79fa6db093abe032a3c1bb

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
72B

MD5
287d41aff7889079fe34ee316b57fb2c

SHA1
68ea92bf95a199400be3dc4d27677bb2d1e9ffdd

SHA256
d59c115dcb6f053dcdd9a7881320087cf073e0c8edd3f8dd245ba09c9d416b60

SHA512
7f92e7c2b1f177c3debc08fa469a22a4d83f35f5ae6f6a36ac8596c9003279626e425e55d13638387c0078818d8e02b76a1c86c8aeb325007421c2f74db30e84

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
153B

MD5
2cc5098bace9237e93c10228a5a44e00

SHA1
eb75846d72fad6a9223aa8669d48c5566a4d03a0

SHA256
28fa76328b1b0a838b076de967307713cefa441b9f52734d8085284052343fe3

SHA512
5747136a3ab948e336ebb0fa22a77dfa11f15e1f863bce72f93019621ed9a09cd618db737a7bb3566d3f322d54cd95edcdcac1073e5199f97d2f557476a5791c

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
129B

MD5
21a640ea92df11dc03b2da76930680a7

SHA1
7dade6fb6270652c36e778cdee03926fe2752f71

SHA256
ec224e026dbe7b2cf477b0215a11c5e80cd6b36085484a26030da1655d51674b

SHA512
ca86cc315b38f5eb5ff0aa242abc708579a5d711afe92ae74545d136e3816329b178cf5a848a1082094072fd3efa74287062458882cb7a201bf38b049107dbf0

Download Submit
/storage/emulated/0/.am/log_.txt

Filesize
27KB

MD5
1b3cf22e9c0e0930fc302ead806e3e6e

SHA1
0644c9cd4c4a064d59a6181f9efe43fbb6a0f1bb

SHA256
7b95c363ac610a7e73296b43a550a1766e112df5aced7f8f8825a23a75438d9e

SHA512
edb6d855014d4638d902929b1606f2868abe0ab49f5a5b2b91ff6c936a8763a801ca18f33059bdb102da54cd589c3c8ffb3a9515cfa1f50ffa0dce6f474fa2f8

Download Submit
/storage/emulated/0/.am/log_.txt.zip

Filesize
6KB

MD5
3eee65068e3e23f49e3d49059eeff811

SHA1
d3ed52fe66ae1c97d24e9278fc834d2a5c1f92f4

SHA256
9c96383a4c5e2dc16706da61856c872bf2a9c278dd8e8b5e2f4b18a0d2e2de58

SHA512
7b522d67e32a2f858e09ca168fb6ff711189dae6606b2b013e8dd83026e26824dfa10a505e532c8d7b08cf3d3ea19b145ceff15de7abc2f0287017b585463932

Download Submit
/storage/emulated/0/.am/log_1722478573919.txt.zip

Filesize
220B

MD5
f7df07b3de087a8cfbadecabd6249717

SHA1
8b15531eff2b9070363367f932d41007cfe9f8ad

SHA256
79ed03da75af7803f26500f7f72a1812b5b0011ff94eb9569430beba02064dc0

SHA512
21f2f726152e93adbdf33fd57a4b76dc26a82975fab2e41a238455e287a6b77f9a782f8617e8e4e23d9e61d1ccce1d34ec801609eae37131c7f9064dbd2544b8

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
72B

MD5
fda9182e3ed7babfe6cdfb2fc79f91a4

SHA1
63c41d4facdb15262581b9096fef50492c48c801

SHA256
d09df77525b05a62e89c70cc207651dd416cf2b9a73d0ac5b37db77e93325803

SHA512
8554dbe745a8b52ee7cce25f4cd6ed4a92601223b616ad8357bcce09a9907b09dab3042220d2c41649b3b70b409124c1c2c8efac855c10d8c347c662bb3f98d7

Download Submit
/storage/emulated/0/Android/data/xspcmj.qiegf/files/Download/mch.apk

Filesize
64KB

MD5
13684d2547f64dabfe299d1c6553a05f

SHA1
b000477d2cb51e917f2ebce3a8c53745ba7e0fd0

SHA256
3cf935d3101700253aa86e9d233201e587cfdd71b44491414b9d0f8f351febc0

SHA512
e75a7c2d43b9223cbb58cf21640ed86a1df77fbeab56d9f7904748898feac40aa6a372dfdfd44c93ea8480dad2f9889684bf37b85549d4bf8e2a2c7c79172217

Download Submit
/storage/emulated/0/Android/data/xspcmj.qiegf/files/Download/mch.apk

Filesize
64KB

MD5
46ee58bfdc5b7b08404ba09dd3e5fc40

SHA1
eb65ea45fceb3bb399cf0b715a88a78b87e131e1

SHA256
a8709e0be26d00a7eb3a63c3f4408c9344fab6121e2fc8f30b5d8d8cc8757b27

SHA512
b585ae796c4a4035abbed7d5ea6e79732c7bb7275d6c97e03c0572e1c74ef77277fb407ebecf47406c39b83dc26befa85ef5d2d12855ba30890d0222c80360a5

Download Submit
Anonymous-DexFile@0xd17d4000-0xd18ff4b8

Filesize
1.2MB

MD5
336921950a9f279733cd787f1203d73d

SHA1
cefc36a7c17909054cf2a507b34f545af96c0e36

SHA256
c6f157d3401cf969f57b4d102e14fc097676f11cd4911a68a3e08cafaf2aa94c

SHA512
6fa4f733298e00a8495648b623c04a5a7912a6a5af26089749e9ad26f30e20ba8295dfb901084bbf7e6976acb65ac78d7ce7a0037b1a4044ec5ddecd29801f87

Download Submit
Anonymous-DexFile@0xd266e000-0xd290080c

Filesize
2.6MB

MD5
3bca1a576ba29bd493e42938a489aa5d

SHA1
0e5d4bc3a7daf6864fb3076e6c1e9685e254efd9

SHA256
b1da8dddf686b15b020b54c3509896b4a96b080604cd9d9cbf302e4beee473ce

SHA512
39a80b04bc764b98d47e035fb46ad89607bf599110bb5f62dc394f50e2c329fe913fe4be70b2a7879be3e2d7650eb9322f026e4996c62a45632e4045cc71bdc0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads