andrmonitor | d354a5eeb5bd1b07595fbf25152b5944c1a0e0b9d512aed1b1f630b5fb2383df

Analysis

max time kernel
135s
max time network
144s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
03-09-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b9ce40a5db59d489387d2f0cf3ef0a058b5a7cccb1dfeca54e4d1f30e46dd1c.apk
Size

20.5MB
MD5

f95cf2c20d492d6647885e8428d808cc
SHA1

3ac3b2f7b6ef2adf78e3a35463d38c94bc0615fa
SHA256

7b9ce40a5db59d489387d2f0cf3ef0a058b5a7cccb1dfeca54e4d1f30e46dd1c
SHA512

3d5033bfa909468d92aad54eb5a308ffea9684471cc15810974a43e5c39e81558173774599b79d1d37fd7478516f8ba922d76035694764adb0f0a053636917c5
SSDEEP

393216:Hq0sJA35z7A79L+BCZ1mbgafiubcYZzb/T9i/zVN2I+TX5RUKpPbNiRSKcsIJ6:HqbJA35z7c5JPmbBffcSzti/zVN2IkpQ

Score

10^/10

andrmonitor banker collection discovery evasion execution infostealer persistence spyware stealth trojan

Malware Config

Signatures

AndrMonitor
AndrMonitor is an Android stalkerware.
trojan infostealer spyware andrmonitor

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	fka.ugsonrqogw
/system/app/Superuser.apk	fka.ugsonrqogw

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4258	fka.ugsonrqogw
4258	fka.ugsonrqogw

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xd317c000-0xd340d638	4258	fka.ugsonrqogw
Anonymous-DexFile@0xd23f4000-0xd251f4b8	4258	fka.ugsonrqogw

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	fka.ugsonrqogw

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	fka.ugsonrqogw

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
4	prog-money.com
6	anmon.name
15	andmon.name

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	fka.ugsonrqogw

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	fka.ugsonrqogw

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	fka.ugsonrqogw

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	fka.ugsonrqogw

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	fka.ugsonrqogw

fka.ugsonrqogw
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests cell location
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4258
- su
  2⤵
  PID:4298

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
124KB

MD5
4c0ccabb25100a908b9db06434a6af8b

SHA1
555d9ecfa42e17aec483e1c05be0fc1362db9e66

SHA256
79aee6f8af24ae6adc8537de3a061bde3778d3d9634265b85b3e8727d4116304

SHA512
b9a4a1227fa927f0ef987a720c5bf16af71f3fba8c1a40d5387ad0d4ba193a1b7b23634b0850af7c25b55c8b2e984e7c84ab8fb3e55c83b3bc2ff859f4dcc5bb

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
96KB

MD5
263704913a45e63bb5fe7f832586a8fb

SHA1
c4a5b469efe6a1b15406a16740ee0c90b835f8af

SHA256
89e0ffd8d257edad39bfc61fec6da1347ab1c0e5b5798715113e2f0f570d00a8

SHA512
b1d4206b8e74801251d2f37877a0c1112b21baefe6ab1107394e3586bcbd5f004d0f1bb445d585b530178db0f6edab2b0f50d7434f5169615f622944bbb16e1c

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
96KB

MD5
e23024c6fac600384b565cfcb2df8c35

SHA1
4ee611951c0b6a544ff3cdbb57d232536eb7bbdb

SHA256
95035b5b5b84fcd72e9cb8a286cd40b1eff989c9efd82cf034f130bd0fab8723

SHA512
4e071721ee5dfcb0154882af7588fbac47a0c7242d4aeb866071aa5b62c81ad73188442584078f2ab59681f35aef70cd719eef888ce17b6b1b119ce700e57d6c

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
52KB

MD5
b6815b344f6926d458cea05acd052cdd

SHA1
88f524aff1d4c5fee979a203dd952427871a7097

SHA256
028666f28ae0086b18fb740f792e8a80ad05547f0c7cb9d2dc8080e5125db366

SHA512
0431375f80e9c467d0abb042e43681a973bce455fe8354f5a138f19a3b28d3adc7eac3fe4c20bf44f085810749569b87a393185cd8f8bf2687f0923b8de4dade

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
96KB

MD5
83275af9691ef55b2ba8e0509da20720

SHA1
e783e2464d24b30236a408952178b2b0af4e42d5

SHA256
f6cda2f6e2194d298d54de6b1c1a051155c8db84f6b13455d4aaa93e8e2b69e4

SHA512
48376e8c4a4d8329c68defcd3609ebf61ce1178dd3fb3cbb2ca14ac57a1667b20d762221bc2d607cb5d0106eb4e3092d040b51a1205c9af0d55f6ca1eae3d3a3

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB

Filesize
144KB

MD5
5db9e9a86ed5e608e7aea6ed2a657d9c

SHA1
666f063f8439dd96fcac550f5fbf18a387dc4021

SHA256
f35507c5b8ed8d58904396b09f9f3865cbed0f5f7dbe2f7e578da3a958780bb1

SHA512
fc8e8b60a8d4bc75be22cbd0c948989206433da3e8e108ed8a05a8a8e55ea8a60ac5196ee13bf47302be9f906f1d196a41c4da0f5dfe0c0d5ab654e197c6c179

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-journal

Filesize
512B

MD5
e46dc18cd717c31f26ca460202eb39bb

SHA1
2a1aa2e9e73e4ef2329a10f87b65f6b49c6594c6

SHA256
3ca003b38461986a77c18649309369a6693197c171f666a9e6b5f8b619cab0b3

SHA512
73826ab4f0c483cc566107e51a8503a10e062612112687a6118d52f3141d35329f26a2ac0da05265d97796b23b5a9d775903ad4b90f7b6d15bc4e021ee6fd690

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
414KB

MD5
c7bb4fbc949d73afbb25afd07af5d89d

SHA1
4c082302630eeb2d9af235d3506aeeb5a2041c76

SHA256
354f6fcfbb9264919f9889408ffefc4f12e5932d2e72e3838517488b6bd86c9c

SHA512
8239d76460b570d5d4c653c9fee02a848d08585be6b11d0ff0e32ed3d0455ffb4d99cf24fbbe7a20d222bb436206440227858c55b9bfab219b24dcde66725c24

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
8KB

MD5
8b22da0c0a19662bfc4f8837cbbc3004

SHA1
2e35c21bebd99b955dbfbd88fe6f3b41e5bbdf4b

SHA256
59e857e8334d13f00d154bef2c4322a9cdda2c50cd0646b0e2c3dd17a9f8e0f2

SHA512
3dfd7f4a280fa1063aaabf67df7e5822e55d90429ee38f653dd8e8ed924a275b8aa1908ebe8690a438a9efe4d545ea0af277bdfd4ad2085b8bf9237eb51d1004

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
8KB

MD5
7c0207f6412f59b234f121110ab3b29d

SHA1
885264523ad380096caae945ac625f1b3217f0aa

SHA256
641df154a44b0e0975568a3aa88481ee1245bd05b01e6be5fb585210e8dbccb0

SHA512
b14744ddde2096970cb95bf9a97b88a9acc85b21e46ddc366b261af93d36b61ab632eeab9f9d4936776f446a4cab815b06c7d5166ecb97d45a5635ea1a22c1e1

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
4KB

MD5
a62120c2a0f5dce225185c9cda658d7e

SHA1
fb91b1b527e97d93dd73c0607ba88515ee00d4b3

SHA256
56fbb04eeb210b807392845b1ea16a3f89166f0c1ecdf27b46e2e0abcec58b24

SHA512
d856228e2d74fdd68a69f3b75982defc6ffe4c78f5041a477af9c2f290b72a85cee7adc6a5ce22a97fab85a20122a40b810bde18cc1e0eb36b5492cc76d4f961

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
8KB

MD5
88acb66101177b6d3c60b211fe9f39eb

SHA1
cc5abf68e0b9e287fbb79a53b13abfa57aa4005e

SHA256
199b3451e0e814bc265e2306d4604414ecf8324324ed7195f68ddef4b8ccb5ea

SHA512
f6efd55316010aa75e3452ddeb7a4369d9abd83845ad362eb9a7a8ec92704ca282edd9a8c93438cb00579caad08978f5276a7b5e2b2e144417d8b87abad80736

Download Submit
/data/data/fka.ugsonrqogw/databases/SettingsDB-wal

Filesize
418KB

MD5
f617c724c01bce3cdf2f1df104d1a643

SHA1
9760dcdcbcab45015c337c175759e6dd39b33962

SHA256
fdee8f2e7ee1dd0b2fa02ea2580f126157844473b024209a20cb455a5b1b1f74

SHA512
083186fdd7da02a1a8f385d2fb4a7d7933ffe9e5bfe71f19aec36ea04aae0aa927155a254a24acf1638f74c99b078e394ebf111f95b01c5ebc5846acd8cb0301

Download Submit
/storage/emulated/0/.am/dm/md/main.md

Filesize
2.6MB

MD5
470586b3a055aed7c22156273f38f69f

SHA1
39866ece4bc4bcdf2613bd67851ee7ba22df85ab

SHA256
65daf0c170cda7fde64c441438cf9875248bd33af61af060d943b48bfb405f8d

SHA512
95ab906e2be05248360a5d2a3a4edd61a128e1d71dedc35245384799ae68b686d37ba9063bb2e86a891d96acfec47c897bfca290ee6251afcb07f140aca9c540

Download Submit
/storage/emulated/0/.am/dm/md/main_tools.md

Filesize
1.2MB

MD5
51112e0a7f7962a8e02bc885025414ef

SHA1
40622959af4fe349d8881c885b9b30441de8804c

SHA256
2b089f76930214706716aceba0bc6cefe6e132d14dd7d0a7c59eaa4f90f126f0

SHA512
f02971a0f493fb72539381c3d1503d8573e8bc67f147014f443df8c01e71bb28437f832c5702d25a8bef2c34c64fb1f46d0000523eed04ea7981186ada22e402

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
173B

MD5
e34c2eafcf30165206c137a15c9ed36b

SHA1
8b896367780d12db9a7d5e5dcd4a0faa89cbc510

SHA256
05908488a72ff5a635d59b4ce39e2884c0603a1105249fa5a634e59c535b13e9

SHA512
0f7eb5563e253b9bcdb92f9d0e719b82d258a0b94cbcf1c0e66f31f5b9284951ee95792749ebb70564d5b4d6963bff0ddef0a4d51ad6fa3e1b0a1ffdd3d37a94

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
152B

MD5
5a314b559d3747ed73e302216273c2f3

SHA1
fc7eb25310477be90bd934c75d6fc58275e27375

SHA256
964a55430091de48e768df8e9502422a94fee5ae4fb3a40880825ffd0fbab04a

SHA512
58d36d6c33abfccff00805628489a57622a5bf60ef58d0b2408152b0cef04c8b1df3f366e49ab4ca66d5a776d0837cdb27e5e0ac3425c231f27a55adf05db536

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
3KB

MD5
97304983cf2e3bff3555fa6e960188ad

SHA1
63c06db86186da48d162966e873b993c4a3c560a

SHA256
ed7b2911ad424a6cb777e0ed6986112b578e976c5a7591ad749cccf07a9530db

SHA512
b91a769f263de75763385931997e05addd06db26dee3734a275ae3e4e59ce26bc50038dbc46d31e8ad7482c4625fd9fece9e6fc9f0fb543609aae9eb6283991c

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
64B

MD5
dad1b13391f37c1eab883fa9d1a694d2

SHA1
4ebf5fa4a109eeeeab815744e0e5c603c4cb7588

SHA256
78fde77a29c0e5bb8171961ad2a046bd61a186390ac3b40fdabd8902b3e4c3c1

SHA512
6bb6aa2fc0831714c3bfdcde3fe1a10296a4a438055ba77d371c90d2ed3ed62ced468741b86987d12d11f600dda63166bc6b347f7112ffb81f23f9ff4a260106

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
72B

MD5
5767b79575d2046e40bc280150a5b813

SHA1
ebaea7ca8ea75cbd51235cc6f7df8c6e82bad751

SHA256
c741a93ebf19d804da618643889f5c26891fe8b9d4e0fbb848f2f8281122d4ef

SHA512
a9538858616b5cdffcc7ccb62b6584402abc7315b56531e2db1fec85a5cade38df63e282db9a0ffabb517f3d82be7ae7ce560aa6dab3e257d20fa60c4ed35b48

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
157B

MD5
9698586ca2cec7d04afaece601304912

SHA1
907421d9826c19b87a09b6a6f5c08890abe8ad7e

SHA256
b0658b59c6f6463f2fc557c85ceace4863a80b3b49e9841737ff572de0fdbc18

SHA512
c885013afe69419c1af80ded96738f9a3bb90ccb59556ad11ce45f79b349c66985745ab5741b8f268ce36c99aeda56e8ebc7ba36fde5dd602a1fb7950ce28192

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
131B

MD5
34811616c97ba51ac732b53addeba0bf

SHA1
6ad1ab9a4ce88c7ea84bc9efff8d293116947aac

SHA256
00062f6ad1e53ce51669db8c5c6dd27babc634c482f83a571aa35d0384c10be1

SHA512
70cc02a42b96a030124627c66160b8eb727efa5140b674fe8b21155a1cde0c86a90816081245d888c2e45d6f80e1d2848a9803c05527740f0dd50602823f90dd

Download Submit
/storage/emulated/0/.am/log_.txt

Filesize
26KB

MD5
fe607549b3d2ace2a31d278abd4d4b7e

SHA1
90ea03f702a5c52a19f05a1435f6289a68a0e408

SHA256
6cf69a5c398c7f2150037810427a7876066d00093d10ee527ae952b8ca744863

SHA512
a710ddd8265303e8ccbd09e10f3d497801cead106c04a09fffc6e1fd7d1cf5edb0ade5e000ee8892725f3c69e621f95df2618ebeb8bc1d09868dd36e67eec8a4

Download Submit
/storage/emulated/0/.am/log_.txt.zip

Filesize
6KB

MD5
bee4a42b4df5f63773c3754cb66be363

SHA1
f26cb0c96ef6092ea38887d4338e4e32617496dc

SHA256
ec06bba254c664348da10fa684ea04921c8209194e1640a2e0ebf51bd660625d

SHA512
4b7bf736e85afbcc88601714d0491c3aeeff0442eb6f5e7c439c63f9432a43fbc6a46d9e7049574485b9426e6ff5c9249d8a20d0c6b4eb2708cf9b771abe5a59

Download Submit
/storage/emulated/0/.am/log_1725328869028.txt.zip

Filesize
220B

MD5
a1fbad8230da60a0cf764a66ab0482fd

SHA1
28905e18a20b134f5b9501fda40d75f5e7486168

SHA256
ad16792b8115c255ce89dddd77b17074c37c8989c9e71ea61b653e3daaf6b393

SHA512
49b7b2bcea437cd99c7ba1da468ee68ce7660c7f051788540559829906931a686495f7460937bd7c9e65943dbf87b4a9d13a90d2239386026d8fef087c05a438

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
67B

MD5
d8ad6773b632b7d8066ed57c6c482c6b

SHA1
c07e66a0e8e58e190392896d7b178b7079741967

SHA256
50eb09209f1670f34baec877f8bc19fd1ce7419e10da063b46fa4025558dc4ae

SHA512
4bba534c373aa27100f1c5eec84c0a9d77c0dc447dd33de3757c4d656a7c8bb7d602fb214102005e355fb9a22687dff6e141063d086ec4275a9b01c8c8c90fa2

Download Submit
Anonymous-DexFile@0xd23f4000-0xd251f4b8

Filesize
1.2MB

MD5
336921950a9f279733cd787f1203d73d

SHA1
cefc36a7c17909054cf2a507b34f545af96c0e36

SHA256
c6f157d3401cf969f57b4d102e14fc097676f11cd4911a68a3e08cafaf2aa94c

SHA512
6fa4f733298e00a8495648b623c04a5a7912a6a5af26089749e9ad26f30e20ba8295dfb901084bbf7e6976acb65ac78d7ce7a0037b1a4044ec5ddecd29801f87

Download Submit
Anonymous-DexFile@0xd317c000-0xd340d638

Filesize
2.6MB

MD5
850905bb253b202528d72a6724d68904

SHA1
ab3ad068ac55cff5a8b4f80f4cab5507968d0ce8

SHA256
abdd3b7a2034ffeba98a4b5192ee6878e5d05e822f8ded07c7cb413e13c944bc

SHA512
a15fb152539326a73ee427fc74760c0e4999708a40b81b5b464a6bba8dc841efbeff2a573418e0754e8d14bd750da7e335f680067a6abc4f7807b6f8a59007a2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads