andrmonitor | 7b9ce40a5db59d489387d2f0cf3ef0a058b5a7cccb1dfeca54e4d1f30e46dd1c

Resubmissions

19-10-2024 09:10

241019-k5aveaxhqa 10

05-09-2024 16:10

05-09-2024 16:09

01-09-2024 06:20

01-09-2024 06:13

01-09-2024 02:40

Analysis

max time kernel
140s
max time network
149s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01-09-2024 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

am.apk
Size

20.5MB
MD5

f95cf2c20d492d6647885e8428d808cc
SHA1

3ac3b2f7b6ef2adf78e3a35463d38c94bc0615fa
SHA256

7b9ce40a5db59d489387d2f0cf3ef0a058b5a7cccb1dfeca54e4d1f30e46dd1c
SHA512

3d5033bfa909468d92aad54eb5a308ffea9684471cc15810974a43e5c39e81558173774599b79d1d37fd7478516f8ba922d76035694764adb0f0a053636917c5
SSDEEP

393216:Hq0sJA35z7A79L+BCZ1mbgafiubcYZzb/T9i/zVN2I+TX5RUKpPbNiRSKcsIJ6:HqbJA35z7c5JPmbBffcSzti/zVN2IkpQ

Score

10^/10

andrmonitor banker collection discovery evasion execution infostealer persistence spyware stealth trojan

Malware Config

Signatures

AndrMonitor
AndrMonitor is an Android stalkerware.
trojan infostealer spyware andrmonitor

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	fka.ugsonrqogw
/sbin/su	fka.ugsonrqogw

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4240	fka.ugsonrqogw
4240	fka.ugsonrqogw

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xd237f000-0xd2610638	4240	fka.ugsonrqogw
Anonymous-DexFile@0xd1574000-0xd169f4b8	4240	fka.ugsonrqogw

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	fka.ugsonrqogw

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	fka.ugsonrqogw

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
4	prog-money.com
6	anmon.name
12	andmon.name

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	fka.ugsonrqogw

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	fka.ugsonrqogw

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	fka.ugsonrqogw

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	fka.ugsonrqogw

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	fka.ugsonrqogw

fka.ugsonrqogw
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests cell location
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4240
- su
  2⤵
  PID:4281

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
124KB

MD5
4c0ccabb25100a908b9db06434a6af8b

SHA1
555d9ecfa42e17aec483e1c05be0fc1362db9e66

SHA256
79aee6f8af24ae6adc8537de3a061bde3778d3d9634265b85b3e8727d4116304

SHA512
b9a4a1227fa927f0ef987a720c5bf16af71f3fba8c1a40d5387ad0d4ba193a1b7b23634b0850af7c25b55c8b2e984e7c84ab8fb3e55c83b3bc2ff859f4dcc5bb

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
96KB

MD5
484eb676577aa6f713922d66d58d08be

SHA1
d1b00b81b998b4dc4ecef2af37673f967cb39c62

SHA256
e75a53cecc9db8b832f9280b911c6d38972d26868cf3180cfd73b0facf82c3b2

SHA512
ead88cd0f7fc8a6e06147496eb5b699d9a1124a2c60173051e0014d71410f28d345b98246684f0911bc86226f8ea6dcb878781681a4590d137ba75e4cbd4c234

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
96KB

MD5
c96aa54f141a19bcd950d0005ad684e3

SHA1
78f2cfd1d387ab8c9efc71727acd14ec573c6b20

SHA256
bbb360ff18932a3a9021f953e799c811281f123b227ebb1c7c530889772abf2d

SHA512
072628518b6bc18b19663fb8b1c42563a4c49f9f925e56cc3e1c1bdea07cf4b0dd674434c41847983d769ab6b4bceb92bb63d8247b5169fd7c14f66ad84b9a46

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
52KB

MD5
b6815b344f6926d458cea05acd052cdd

SHA1
88f524aff1d4c5fee979a203dd952427871a7097

SHA256
028666f28ae0086b18fb740f792e8a80ad05547f0c7cb9d2dc8080e5125db366

SHA512
0431375f80e9c467d0abb042e43681a973bce455fe8354f5a138f19a3b28d3adc7eac3fe4c20bf44f085810749569b87a393185cd8f8bf2687f0923b8de4dade

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
96KB

MD5
8a7dc17af3b7d951734b11f1b4263189

SHA1
3d7a037843cef9e4204aef0c257ea6b746fe0c9f

SHA256
825aee5c8f14058c30645ccffd6d695ea636856e01630aca76e29c02e6dd4ef9

SHA512
462dd16f922da55168ef789f47a327b8d0b84723b3dd8d6b03769fe2760b0f8e877d4d595c5706468a7de3aac7b18d9bb1ee75e37011c451d3c060104a55ce0e

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
144KB

MD5
a8c19acfc0fe62a4f9cc9019b97498bc

SHA1
e499cff4b2b333d4596b5747e3a504ae58caa247

SHA256
97667452262bb60fd3279638532248a0b24933fb58b2ba7d58317156aef31ef2

SHA512
eef80d4a14a40115546cd2c3918e69aed66b8966ddabd76154ef36d8f679a8b8a992fe6af1ecb03b8243ce86bd4ae4573f50cdb3a9a658470d570ae371879249

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-journal

Filesize
512B

MD5
dc7bfae36160737e6a428d1fb3c58a56

SHA1
32b9b48f85d964d915660052a9d02f30c5c336c2

SHA256
b5e80915ca6a4ed24eb2e227c26fc807754701dbf9e17f44c62d24c9aa1ab3a7

SHA512
f3dd3dd134d9a77844fe616bbedf5933ca6bb37bac37612db80cd1295e2cfa08893774dc49bd1b718ca072f452c8c30361d2adde66ee943913e21a9311731f84

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
414KB

MD5
1cb4de944a571c4449c70c57d88d8fae

SHA1
5ea8a83c383bdba449dbc51605be32a2040bffcf

SHA256
130e31338b8bc0373168c0e3d16118d1565c2e3c8dbe50b4700e046959dceb36

SHA512
8913c65796e368572ce476c4c789fcda6aafbc007e0b98ee47e17ce4cf16c8baeff83dbba878aa4c295bd4fbad22b95305f0bd4163cf4acadf768b0db3b7b551

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
8KB

MD5
4b2e03d73cd02dec2053e11db0259bfb

SHA1
badb169f3d0a487ac278142798cd0792fcd50876

SHA256
fa0676ff2d1380d29a9452026fcb937b815461c3799a2b1c68050ccef6e0f6e3

SHA512
a6f5b975b1d5342ee1b15d753a5f6fb04f37ceea0bd362ac8fc67b749682d80c5549b72015125f7d0481b7996a3952e3a984478e92e1d3a2a64fcc52b974baaf

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
8KB

MD5
59e5fbd7a55f40ee1a09581aaebf9d98

SHA1
af8e45e4e5bbceb8d04a811d3c19ab7cddedb31f

SHA256
3bf6c45aa48a994b5eee0e230c7fc3ec2636561a754c4ed0d2da33c7a47e32be

SHA512
e4b94410c1a08071c6155d5aecb8f534e52b8cb796e2184885eb19e80d96255e50f1d3b01449790ac6f0554b388819cd10c3db201627e9b809bd3ea40a3f36ae

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
4KB

MD5
61a8e74471b52451d2c69f156d954ede

SHA1
86ac7e6db0b8b915eec4a29401b532e6ceaedc7d

SHA256
3b9de44465f86c329c4d4d3ddebd87952bbf2b6d1339c205004ece1cbb58b87d

SHA512
d5b53dc326f9389f0cc5998bdfc6cb9cc625f3a75ca85d0d7572c16429be6d648d161f37c595fc4f1a22a29e485d351f45ea8097c87c2261df26e86a35f98095

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
8KB

MD5
b631169ee9cd2fa220aae55790737341

SHA1
e2224a321fb33a30b9d09c9add9aa5e83835da78

SHA256
8c4d9dc13cd0f5e4a2049fc35d3bb5f5663a66c7b71bfb08a7c73434f39b4d89

SHA512
599466558742eef906d018aca927c31b713f35c08bfa0e8c8958cab2134954e3c247dcec8c9a7704c755130a193da1188dba12c3fe8ef2589f278d8bd0300d8c

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
418KB

MD5
7e667817cd2c44c96d97f148d000ab66

SHA1
8c26399b59531513ed100ce738264f922bc7965f

SHA256
04c446ddbcee3a498f28efebb203fbed4202944673f5d6038c10a0a5f0e3f138

SHA512
59ca30cc2af5530ae541297abb249e9b69866c939aa83138246f7712519e1990bb8f549c7911e917ed1f71b45707cca94bfb3e5345b62ec0bd31bbe6a97cd5a9

Download Submit
/storage/emulated/0/.am/dm/md/main.md

Filesize
2.6MB

MD5
470586b3a055aed7c22156273f38f69f

SHA1
39866ece4bc4bcdf2613bd67851ee7ba22df85ab

SHA256
65daf0c170cda7fde64c441438cf9875248bd33af61af060d943b48bfb405f8d

SHA512
95ab906e2be05248360a5d2a3a4edd61a128e1d71dedc35245384799ae68b686d37ba9063bb2e86a891d96acfec47c897bfca290ee6251afcb07f140aca9c540

Download Submit
/storage/emulated/0/.am/dm/md/main_tools.md

Filesize
1.2MB

MD5
51112e0a7f7962a8e02bc885025414ef

SHA1
40622959af4fe349d8881c885b9b30441de8804c

SHA256
2b089f76930214706716aceba0bc6cefe6e132d14dd7d0a7c59eaa4f90f126f0

SHA512
f02971a0f493fb72539381c3d1503d8573e8bc67f147014f443df8c01e71bb28437f832c5702d25a8bef2c34c64fb1f46d0000523eed04ea7981186ada22e402

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
173B

MD5
180b546e6c9ddb788736e131916b6d78

SHA1
2f8150be9fd1515753b3dd98695969730fae283c

SHA256
5756c02ccaa3e6c45e9cb95092d62242fc7e0eacc3570b93903e8b162e7597c7

SHA512
ffce506651639522b4d99848535eb6c77dc6f8e32178a6c3f53a3980b1305ca90910397f5df836da49d8afcd7ad528cdc8c678cd268148eedc81ceb76cdf1079

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
152B

MD5
7b9df425fa01d9926ade57c5c7254d2d

SHA1
2d6d8aaafda99fce226b958dee33373a769c8be4

SHA256
5f821aa2564bd545f305a0ebd06ed9e07843bd5b4ed7ddd90bd3b6faa474d310

SHA512
78c8bf08dcadfda17d0d3610b178a6ba2b98a220bf8aaebfd3b825aef61fa6827ef511eea7a4f9d06837507a5698414b77284c5e82dd618f5cd348136b55d820

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
3KB

MD5
7fb467aeca23b56e5ec52e5035c15d68

SHA1
97d8d60a8edcf412560f18af057cde38304347e7

SHA256
e3673259ae9d8e55b10b22ac2774a6c44fcd018cb177f04ac446416efc2e291a

SHA512
198793a97e7920a2b2897d75be3373b86e9caff3ad80e640ee6fb99e3b51c220cceea7b3f2b3a94c2157b89afd8386c55220ce66609b83c61d7325b02fed3b13

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
64B

MD5
dc3572c8fc1ab9ad2202e0122c238c96

SHA1
1ce3b9cfb558b0631968f88109c7357caeec6248

SHA256
e7c5912fc9a00dde54e0739f7837b126bf7c100649cbcb30830d96a8397c23d8

SHA512
68b5b57b750a5e5223f78ee410764e549c3baa29a84c4a490f5db9308823d18b006e100c1603d926413a31d7ff498eb0efa467289315dd3789d44f6183baad22

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
72B

MD5
700c3cbd001be3cbeca323044899b0d0

SHA1
eadca5197f4cc733edf19c011e2f85cce5079a19

SHA256
92417faf05c787c54952b01c97bd5d2e8ba7cff7aef802afebbeec0f2b8c2d2f

SHA512
626bc6d6a7b6ea5b0d9937572e0cbc54d2122c4f2235442601d35143667462da8c972df95169d620ded6ebb2fd9adec4052093ef75e7bffc97a349ffc722d81a

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
157B

MD5
1d390ff09eb3ba8b5cb2b28a6521e591

SHA1
f4523b650c0a9e3e43345dcaa15bd9be16c9915d

SHA256
26563b4b6535ba841070c7572f1f56204a50d7d8a6f818da27e8b97bba71b93f

SHA512
1e6290cc960b922ab240c4f84bf6b76e78190cba2c0470e20192ef3b2ebf3b31a0b04b76b52181633dd6c85393964ce57935db453693390bbad7720b9197f4ee

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
131B

MD5
ce61d94e4b15a5012a6138c970146531

SHA1
1863a8d25548326d7974b0a63fd18ec13578450e

SHA256
854024928902a6a1dfa400f5fd4c17043bed623290ed7c72b3a803d4f5c5fd05

SHA512
ea0bcbf387391a75932a35d18454b5dc7100b75e1b0a0486e03ecf9bfcb3d0d81147a403e8b152b2e00d2ed9b29e93d1087e4f63c16ead3e461364c29721e168

Download Submit
/storage/emulated/0/.am/log_.txt

Filesize
25KB

MD5
b5a7e41a9da6bdfec92f76cc7879efe5

SHA1
269d2d55347aeea44d47d0793736a02ff8491669

SHA256
d57e9bbee0f9c34578bbb77d82e18cee505ba24e3b5f197a6857d37a0c55d531

SHA512
21d2bebd4382b0b1f8293c0c8445792d11f65c7da0819fdeff253749a5f41d398483263ddd176e3f2257bb5ccee88e3fa63fb9afdee91ddd973baf880dbd8b85

Download Submit
/storage/emulated/0/.am/log_.txt.zip

Filesize
6KB

MD5
08e0c585366d73af3c7561381ad77737

SHA1
966d04da11adc15f2ad20939c8617c0c3902877e

SHA256
b34c7a95f7c1cac76c48f870e63083c9dc7d6fd8e6d2e18290c5aa9670336c66

SHA512
18a72f25308298fa85db8175a17364195045fd1efa4d2e6bd6f0124333698549add99aefb2845e2a0657670281d4932eb2ec3523d24e04e91e3fbe6fc904b769

Download Submit
/storage/emulated/0/.am/log_1725158426212.txt.zip

Filesize
220B

MD5
28eb267fa6be655584388712e9b737c6

SHA1
36caf32063999ee54496f47967e0aab0824cffc5

SHA256
ce7cefdb0ea7b30b60a194797d44d30ffd3ad7f14cb6ae6d955b56df65e30d6f

SHA512
61b62f70e3256cf986c62893d7a4ce713bb604a286de64c57a4be950690e5bec2776522d4d59776c2dd6f09c62c710262e7ad489e5c679f98f3802e6e837b270

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
67B

MD5
d8ad6773b632b7d8066ed57c6c482c6b

SHA1
c07e66a0e8e58e190392896d7b178b7079741967

SHA256
50eb09209f1670f34baec877f8bc19fd1ce7419e10da063b46fa4025558dc4ae

SHA512
4bba534c373aa27100f1c5eec84c0a9d77c0dc447dd33de3757c4d656a7c8bb7d602fb214102005e355fb9a22687dff6e141063d086ec4275a9b01c8c8c90fa2

Download Submit
Anonymous-DexFile@0xd1574000-0xd169f4b8

Filesize
1.2MB

MD5
336921950a9f279733cd787f1203d73d

SHA1
cefc36a7c17909054cf2a507b34f545af96c0e36

SHA256
c6f157d3401cf969f57b4d102e14fc097676f11cd4911a68a3e08cafaf2aa94c

SHA512
6fa4f733298e00a8495648b623c04a5a7912a6a5af26089749e9ad26f30e20ba8295dfb901084bbf7e6976acb65ac78d7ce7a0037b1a4044ec5ddecd29801f87

Download Submit
Anonymous-DexFile@0xd237f000-0xd2610638

Filesize
2.6MB

MD5
850905bb253b202528d72a6724d68904

SHA1
ab3ad068ac55cff5a8b4f80f4cab5507968d0ce8

SHA256
abdd3b7a2034ffeba98a4b5192ee6878e5d05e822f8ded07c7cb413e13c944bc

SHA512
a15fb152539326a73ee427fc74760c0e4999708a40b81b5b464a6bba8dc841efbeff2a573418e0754e8d14bd750da7e335f680067a6abc4f7807b6f8a59007a2

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads