Resubmissions
19/10/2024, 09:10
241019-k5aveaxhqa1005/09/2024, 16:10
240905-tmdm1sverd1005/09/2024, 16:09
240905-tlxz9sthrj1001/09/2024, 06:20
240901-g35p8ateln1001/09/2024, 06:13
240901-gywlratcrk1001/09/2024, 02:40
240901-c5v7cazckg10Analysis
- max time kernel
108s - max time network
119s - platform
android_x64 - resource
android-x64-arm64-20240624-en - resource tags
- submitted
01/09/2024, 06:20
General
- Target am.apk
- Size 20.5MB
- Sample240901-g35p8ateln
- SHA256 7b9ce40a5db59d489387d2f0cf3ef0a058b5a7cccb1dfeca54e4d1f30e46dd1c
Malware Config
Signatures
- AndrMonitor
AndrMonitor is an Android stalkerware.
- Checks if the Android device is rooted. 1 TTPs 3 IoCs
- Removes its main activity from the application launcher 1 TTPs 2 IoCs
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Acquires the wake lock 1 IoCs
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 16 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
- Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
- Requests cell location 1 TTPs 1 IoCs
Uses Android APIs to to get current cell information.
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
- Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes
-
fka.ugsonrqogw1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests cell location
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
SettingsDB
SettingsDB
SettingsDB
SettingsDB
SettingsDB
SettingsDB
SettingsDB-journal
SettingsDB-journal
SettingsDB-journal
SettingsDB-journal
SettingsDB-journal
SettingsDB-journal
main.md
main_tools.md
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log_.txt
log_.txt.zip
log_1725171678789.txt.zip
prog_class.name