andrmonitor | 7b9ce40a5db59d489387d2f0cf3ef0a058b5a7cccb1dfeca54e4d1f30e46dd1c

Resubmissions

30-09-2024 12:11

240930-pc4dgayeqe 10

02-09-2024 01:09

240902-bhr1qsxckp 10

Analysis

max time kernel
140s
max time network
148s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
02-09-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b9ce40a5db59d489387d2f0cf3ef0a058b5a7cccb1dfeca54e4d1f30e46dd1c.apk
Size

20.5MB
MD5

f95cf2c20d492d6647885e8428d808cc
SHA1

3ac3b2f7b6ef2adf78e3a35463d38c94bc0615fa
SHA256

7b9ce40a5db59d489387d2f0cf3ef0a058b5a7cccb1dfeca54e4d1f30e46dd1c
SHA512

3d5033bfa909468d92aad54eb5a308ffea9684471cc15810974a43e5c39e81558173774599b79d1d37fd7478516f8ba922d76035694764adb0f0a053636917c5
SSDEEP

393216:Hq0sJA35z7A79L+BCZ1mbgafiubcYZzb/T9i/zVN2I+TX5RUKpPbNiRSKcsIJ6:HqbJA35z7c5JPmbBffcSzti/zVN2IkpQ

Score

10^/10

andrmonitor banker collection discovery evasion execution infostealer persistence spyware stealth trojan

Malware Config

Signatures

AndrMonitor
AndrMonitor is an Android stalkerware.
trojan infostealer spyware andrmonitor

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	fka.ugsonrqogw
/sbin/su	fka.ugsonrqogw

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4252	fka.ugsonrqogw
4252	fka.ugsonrqogw

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xc7c5f000-0xc7ef0638	4252	fka.ugsonrqogw
Anonymous-DexFile@0xc7ab3000-0xc7bde4b8	4252	fka.ugsonrqogw

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	fka.ugsonrqogw

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	fka.ugsonrqogw

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
13	andmon.name
3	prog-money.com
5	anmon.name

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	fka.ugsonrqogw

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	fka.ugsonrqogw

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	fka.ugsonrqogw

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	fka.ugsonrqogw

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	fka.ugsonrqogw

fka.ugsonrqogw
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests cell location
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4252
- su
  2⤵
  PID:4293

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
124KB

MD5
4c0ccabb25100a908b9db06434a6af8b

SHA1
555d9ecfa42e17aec483e1c05be0fc1362db9e66

SHA256
79aee6f8af24ae6adc8537de3a061bde3778d3d9634265b85b3e8727d4116304

SHA512
b9a4a1227fa927f0ef987a720c5bf16af71f3fba8c1a40d5387ad0d4ba193a1b7b23634b0850af7c25b55c8b2e984e7c84ab8fb3e55c83b3bc2ff859f4dcc5bb

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
96KB

MD5
835b5348968dbc829268c393d66161d5

SHA1
d1a2059eef412cf202b9df28bf61dabe4e21485d

SHA256
82b542cfa1db48dffe7d87c62976e781895497c9e82b0281259121145ce7faf3

SHA512
7b91a36e981a724b50f02a4efc1c931ec66827d7c69f0e93c0e2970bdb5bce3a4b6208a34484778772c2686a39d12a6610d3dab419140ab7609625e8987ee575

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
96KB

MD5
9298070a2226b9f7f2979bbd77a08030

SHA1
6556c64770707c73ece6e6a839d003923b8fbd6c

SHA256
d2fa4255d49470d73e0c40f986ba6c278e5557ee01030f3d7cd282905747454a

SHA512
40152e46b022de2f76ff6d537cbf4dd049189e0203621467148819d3b082e643777b5360234a709f00256d64a9f2d8f3f290305ef074d67a54e368beeb69340c

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
52KB

MD5
b6815b344f6926d458cea05acd052cdd

SHA1
88f524aff1d4c5fee979a203dd952427871a7097

SHA256
028666f28ae0086b18fb740f792e8a80ad05547f0c7cb9d2dc8080e5125db366

SHA512
0431375f80e9c467d0abb042e43681a973bce455fe8354f5a138f19a3b28d3adc7eac3fe4c20bf44f085810749569b87a393185cd8f8bf2687f0923b8de4dade

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
96KB

MD5
e105c36ec8d793f4e4a1a7194addd5b0

SHA1
4308251a27db78feb068b3c90392ee6a21d68487

SHA256
607a9b06305d9c6b11b00a5d1a517a5a237fd81f75ba34879e571da88f04512e

SHA512
1b950e9b2f1b4c15e9cda63515aa2c3fd7d51c7cd5e56e3504743a648c844939de452b20ebf9f6a92a0eaee5b0e66482dfbee143c5ffee43b2968681c5472159

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
144KB

MD5
e24ac9adbe9d99811fb66a27f5635899

SHA1
5376c064df25f89769eb0d744fb8fc700f9b4f2f

SHA256
f2906583bb4ce17e934971079291ad9ee4c936e3d2337c4ef25911191afd4125

SHA512
3b434afe44793edeb6b0611ba568039c1122bed34ec4ec281d2cee9beaaa7c136ed3fefbd13e7103e2cc3a6f97d475d708e6e77febb61c728832e8a5eae61791

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-journal

Filesize
512B

MD5
701e8fecba6fc3e32b0c0fe4ee2cba62

SHA1
9ddda94b296794c6ca8c8a32bdce426cb1d2a20d

SHA256
3c7c7cc1b1d347df2a4ba44aa8bc5dc22686bc7d86d8b8ebd026ee078a8e5215

SHA512
84fc798b6bd791fb4037a2dae2fd74bb659c7d6d5d00dc8c7a4f67630befc6aee99832a1d531f8fae19a902ea479e3841a39a700f4076ac95da16dc82866f698

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
414KB

MD5
722342a12cba7c6859d272ff1d0de39a

SHA1
83d935f9ebdb5f1c95b71c5eead56bee2f5731d9

SHA256
9c2ebe0f61bfd87c09d596c83ff406b03b14351e7b0d1e987cc23ed6d4b38989

SHA512
e855c6752a4bcc68217c25fd8c30aa5fdbd184800458b7027b73f6f34235e3fa3453c8a764c02251db5e910e280de717f25fd91135ff60465bdd161d70397340

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
8KB

MD5
06e856d536edd0622fa57a31ec604ad8

SHA1
6d5a077abed1e70cd6ba85eb0a1afb3cccd6fab5

SHA256
3f9fed5f43c7e2bb4279400dfc7815be612eb0a2db8a063ee4d76cf7c0cc420c

SHA512
2724991bbe64e76232f3bfffd90972c05d5ab7b74b6298538fb49b11feca125c6182e4af9e45db0027585d87459fe6a4ac5877e390c664c5adb710028cc9be3e

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
8KB

MD5
e7ece204c0b268c872e46beb494b68ce

SHA1
f17bbac7d9247f161b9c877ccdde30da2eec94ca

SHA256
da73d816789403f7b12edd5d7f769519b5b5c269271b481d17264077e9d49bcd

SHA512
133bdfb9c9b620a15e6738d865ac8b1afbb4ca7ef9329b3f3ca64fe3df4aab2dbe52e237e0fce2ce3eaba338951b108d02854ae2b49c662cf075a2e3601ee572

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
4KB

MD5
fcc49f8d7ad75f0730c06602f15647d7

SHA1
112227c1c8c5ad3187d601d3921092949d01197a

SHA256
d03b769ff3ed5f9fb4db20c3c94e3508feefef87e98bae44f2fb17b144613634

SHA512
70453b53232c71f4982a8e481e03000723aea76fd7ee4297a35fa751fd6e12d4fdbc7dc5386ff236123602d52b660e697dd45b3a40961a7c70bb094d11b76d11

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
8KB

MD5
49051ebb267fa3b5afe6030cd6566c8e

SHA1
33477a099aaf0279656127acc46bf7d78ef49617

SHA256
2f773dec25846c8a46a8896e014ab9bb75939d8ac9f7f9413b5616e851f7a7a7

SHA512
238f2a4d9c889f951815fb9e3f8f1b7fa0de6790f449afca1b63419c5d09524e2602465572fa31a189c3ae09703ba45e6c5e68a96852e07e62501e84164dfe9e

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
418KB

MD5
1d1c9c7aa5d1c607c9464074419d34f7

SHA1
fe9e7b50df88fd2a8663f914aaff749147b491f2

SHA256
01db956ea518d361ba47e592dce379b44ad029a7597e51e27bc2d5948257c138

SHA512
b7355f02ae5d1fce684f150ece06586326158695f985d0601ceacbad9470eeed043c2ba7ec233a3e07a6cb2d3549a5aade8990806e208f2316ace0853923fe32

Download Submit
/storage/emulated/0/.am/dm/md/main.md

Filesize
2.6MB

MD5
470586b3a055aed7c22156273f38f69f

SHA1
39866ece4bc4bcdf2613bd67851ee7ba22df85ab

SHA256
65daf0c170cda7fde64c441438cf9875248bd33af61af060d943b48bfb405f8d

SHA512
95ab906e2be05248360a5d2a3a4edd61a128e1d71dedc35245384799ae68b686d37ba9063bb2e86a891d96acfec47c897bfca290ee6251afcb07f140aca9c540

Download Submit
/storage/emulated/0/.am/dm/md/main_tools.md

Filesize
1.2MB

MD5
51112e0a7f7962a8e02bc885025414ef

SHA1
40622959af4fe349d8881c885b9b30441de8804c

SHA256
2b089f76930214706716aceba0bc6cefe6e132d14dd7d0a7c59eaa4f90f126f0

SHA512
f02971a0f493fb72539381c3d1503d8573e8bc67f147014f443df8c01e71bb28437f832c5702d25a8bef2c34c64fb1f46d0000523eed04ea7981186ada22e402

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
173B

MD5
f0ee28098022e46cd248f19727c1e523

SHA1
eab2bc46a5a2427391abf4e952dd339f38f926d2

SHA256
ec5331629887bc8775ee6f78dd6bdd44ec7566584a48d29a194be632eb760916

SHA512
fa49afd7f892b3c039ab8d127f60126610c58c7e6f24fa468f95d71e7537e03c1c210e467daeccf4717ff5df968b67d04c3797a660443b7231a280ee15ff8ddb

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
152B

MD5
4dd18938e68ba06bf22070c6e05f4776

SHA1
77f2e75d6e8bdf6e34165d0793d75ec8a41ac568

SHA256
a5b6a6a6a1f61718fe262fe8cdb59dfa0332ad7b78c0bbea07101660c4b7d6e5

SHA512
638a1a52122e75937dcce26698efaed53cf492197ebbd305f0bb01eccb46aa47b07447bdd49caad44de47e75451725a6b9417d2a1a1506b13947861809788cd2

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
3KB

MD5
31e2359cbb66264d1b7cdbb7149de353

SHA1
8a1fbd67b95027429f465888421ca178e421c904

SHA256
66ac9b3c4503092326c1af56e897e1d7291bb8ce050fb61ba1d6fdd6bb9f4e88

SHA512
ffe5527b5193a9255080900b1b19bf6cc4ec6edf3eed66b2efd9f820f195e033809fcf2385af68eaeb7db16e879788471fe19c46b1d9058531271a80e79a4d20

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
64B

MD5
bb2b1bcb7a7ec509d663d7fca8c7d49d

SHA1
fc1cbd395d55437298193662b7e097e173f05d15

SHA256
4c4d99df8e9b59a99c88515c021502a6e4e21d7b2d3b44466226c5796a0acf63

SHA512
e5112f01a2cc81f33a8bf0591f41e7779a3a9af6d8ab5669c66b4f74b67cec38299bce68ad848ac5638d060ac33bd013f3b06b991c0695f05901ecf5d95d7beb

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
72B

MD5
a7c413f2e6d8d9f46ff3e529923fe51d

SHA1
16ce42336561dfb1ff3a6c4a160d959bb4b26eee

SHA256
66e6371ee76222dfb09a7181f0332a756b7ac13c7944c6a3633f6792b863c2f0

SHA512
c58c0212fd069ec5de15a33f790bccdc46721860d04213201429119b61db5d3e3944a79da31664748930c8bfc94bd1b36842f82d7f3e9f276f4912fa0711f3d6

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
157B

MD5
90fb1ab1ed8a7b55541fe0cab6e459eb

SHA1
9ee6cdd00fb9273dd1a1e67350f0815dd0c9fa9d

SHA256
edd10efebb74b1a736970fe8523e114d77e446bf51cd3bc19f146b37fcab9444

SHA512
bc7d7379604f20c458694d8d111aaf84e5472e3bdb623885b70f9ec29a0040f05657d6311cae48bd441619db1db918c380400b2763b88853792e4e1ef63d97ba

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
131B

MD5
e227b4bb10616380adeb2231084e716c

SHA1
d84235067889fe0feff69b1beb1dc59846b327a4

SHA256
d4febf7c51cc87612afb653251aa0a7f41e1f04393b24231518bf5d7066c735c

SHA512
0705de03d98b25e89bd454dc41e280ff22f9b876d8e11ab9795aaa609937bd92b64513733ce37e10e20c21118becc2f637d9d2b2522b7c75caff2d36ef576f9f

Download Submit
/storage/emulated/0/.am/log_.txt

Filesize
26KB

MD5
25c6d3fafc54f25ce3d5dfc6ecc7e8be

SHA1
2f9cb4f6d5f30a7a46f40231f0bf1c070fdf7dec

SHA256
f83ee27a88a2f5aa9512629773150bf8ffe4c95dfddb6caacce77e10ce7ad9a8

SHA512
dec19e480d7d45cf285c4630bb0ffc8c4bdac487b2cf510f2aff712caf60cab57cdaf25fad8ceabee731eb50faa515a4e9f4c55e3ff6b642117d2ab73d2560a9

Download Submit
/storage/emulated/0/.am/log_.txt.zip

Filesize
6KB

MD5
f1547dd3f8ef97eff71e5cdab7719190

SHA1
1903668458a38d4b7610911d51c1cac49e85237c

SHA256
efaa7653fb9a9d68ded2b25f7f5c5d800c30d80b32a070f00da936b748f7209b

SHA512
6561c7a2d5386856338f5905e957c0e98a03a2cfb291c9efd7247d35646c5bc5f46663b6db8b7554a97541a33dd55856d25438991906910e3d3c5b1b207607b4

Download Submit
/storage/emulated/0/.am/log_1725239362493.txt.zip

Filesize
220B

MD5
0ce9f6176c182427307fba9a1972c137

SHA1
eefeaabd8b817c405563011648aaaa973676cc17

SHA256
f079c111fa11f366e65b0932350248e2bbd1c16e652da5dca1179322765ea51c

SHA512
4385693ec28f3adfc2e9b28fbc95b73a91d0cbbdb8e87b873b6fa7f57d844410c657c5dd8fab195e023043e4205039ee31dd2695f64f4699e82b75ca870e5654

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
67B

MD5
d8ad6773b632b7d8066ed57c6c482c6b

SHA1
c07e66a0e8e58e190392896d7b178b7079741967

SHA256
50eb09209f1670f34baec877f8bc19fd1ce7419e10da063b46fa4025558dc4ae

SHA512
4bba534c373aa27100f1c5eec84c0a9d77c0dc447dd33de3757c4d656a7c8bb7d602fb214102005e355fb9a22687dff6e141063d086ec4275a9b01c8c8c90fa2

Download Submit
Anonymous-DexFile@0xc7ab3000-0xc7bde4b8

Filesize
1.2MB

MD5
336921950a9f279733cd787f1203d73d

SHA1
cefc36a7c17909054cf2a507b34f545af96c0e36

SHA256
c6f157d3401cf969f57b4d102e14fc097676f11cd4911a68a3e08cafaf2aa94c

SHA512
6fa4f733298e00a8495648b623c04a5a7912a6a5af26089749e9ad26f30e20ba8295dfb901084bbf7e6976acb65ac78d7ce7a0037b1a4044ec5ddecd29801f87

Download Submit
Anonymous-DexFile@0xc7c5f000-0xc7ef0638

Filesize
2.6MB

MD5
850905bb253b202528d72a6724d68904

SHA1
ab3ad068ac55cff5a8b4f80f4cab5507968d0ce8

SHA256
abdd3b7a2034ffeba98a4b5192ee6878e5d05e822f8ded07c7cb413e13c944bc

SHA512
a15fb152539326a73ee427fc74760c0e4999708a40b81b5b464a6bba8dc841efbeff2a573418e0754e8d14bd750da7e335f680067a6abc4f7807b6f8a59007a2

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads