93ca4d53d68b38627ce7c629f189d500ebe5f43240ae9a4cd1b1c02c68990359

Analysis

max time kernel
131s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
26-09-2024 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7a01a72056b791898c75c6de13a15c6_JaffaCakes118.apk
Size

13.6MB
MD5

f7a01a72056b791898c75c6de13a15c6
SHA1

9d901ec639f2a83899e3b1f60acd149ccba02387
SHA256

93ca4d53d68b38627ce7c629f189d500ebe5f43240ae9a4cd1b1c02c68990359
SHA512

03074bc31e599b7220577036f099908ed31642bf3bd9497e7b72934499279f394dc57ef9b68d62b053d84d4a833812bf061812c29739692760cc4cee16a491b9
SSDEEP

393216:OM/M1aZ85fVGEAA9SVSEArrHnexhdPWACDIurRo951bw:RMnhA0SZ0i1C8c22

Score

8^/10

banker collection credential_access discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.andmon
/system/xbin/su	com.andmon

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4248	com.andmon

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.andmon

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
11	prog-money.com
14	anmon.name

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.andmon

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.andmon

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

T1517

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.andmon

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.andmon

Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.andmon

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.andmon

com.andmon
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Tries to add a device administrator.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4248

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Access Notifications

T1517

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Access Notifications

T1517

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.andmon/databases/SettingsDB

Filesize
84KB

MD5
9a1705f1f84f97bc19044a9bf9ef2949

SHA1
db883500cfcef8b692ec4192f4cb55c00bd8d8f3

SHA256
cdbba48a7b88d3eb944631d7caa5fff47f79210e207a26607c7ee332e087d1b1

SHA512
6b2e7f463027c92d12b2fc2a75ba4c10ff549cb30efc62168d7b1b9dad11dd9c5138fc975b230d3985a7979d5e989fd35fc753a78825f18dd9ca5855b36a21f3

Download Submit
/data/data/com.andmon/databases/SettingsDB

Filesize
28KB

MD5
079700dd24e42c6c986319268907fad4

SHA1
1e11b0dc3e3c283f05aa38219a5b5417b73ec1be

SHA256
8c1ce76976707828509fc7073b465ed81f6c1722cfac88504928765003f781a8

SHA512
f8ee3d2d66cd620d4d1cef5e1084c0225f28fabe266a19efaf690c20cf0d4c1a362c32f3bbdc4acdb41fb189abe5b134542638cbf73d5a71a80b76c2942d1836

Download Submit
/data/data/com.andmon/databases/SettingsDB

Filesize
20KB

MD5
4e0b9a0dc7245d33336e781747c5c808

SHA1
1ce9e0ec9fc8acdfdbca282ff9ea2b792ca0f254

SHA256
104de7f907389c6e86aa4ae8c9366acc8b4fd01bb4994d58a826b7690f562d6c

SHA512
dd4891258c98c9966f5ba176ea060097e71ae35157522a08681b952f1f99517d4a6231eaaf64ff7dc404370b1080b34716d7023d33d03efc121b9bafdb1cc280

Download Submit
/data/data/com.andmon/databases/SettingsDB

Filesize
104KB

MD5
596df4f33051a70d1884606ba5b8f206

SHA1
6f73d1795361e485d48537d75e39c803449379e6

SHA256
1febec4fa14f8186c8d9fc18503e4e1eae3777ebf48e0069c7ace7976adc3f48

SHA512
2e17f6272085551548ab22c55f677945b0f4aaa1734169b13f7b71df019cc5efe349e8eff3b62ad64d958fc53eaf115085486ee0429be49c8e7c1e79d9f7aae8

Download Submit
/data/data/com.andmon/databases/SettingsDB-journal

Filesize
512B

MD5
a0621966f7b8e209aee8c2b9dfbfcaa9

SHA1
e00c48d8e4cf85555f296c73d67870c79702aeba

SHA256
4897940138579b6f8a7608b40b3c7a12e35f63dad5c68d1958638231f440f119

SHA512
775e7ab84fd39558adca99d8058251c2b2984bfa3286506810519174e89377c39cef9aadb01f75986f2f2e85637981249fdd1c0b91c2e6b661391ee149529f97

Download Submit
/data/data/com.andmon/databases/SettingsDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.andmon/databases/SettingsDB-wal

Filesize
221KB

MD5
b2b9864fbc7c203a7d8f3daa8745e987

SHA1
62f6533a29b7d1d3706fbb8dca4d89e9303eee13

SHA256
ac1554dc9a2281ff4926ae6c34dbdd46f48b8655e1408901c4d0a5477b3a2cb7

SHA512
5a8c167d2891544a71f11dedba3b4711f9f41ea4ff3ba94aa232ea55a32a7187c0bb2aa2f82d6a4f87c01c002ba6390d9c8a7efbf66480af0850b4f425e00b13

Download Submit
/data/data/com.andmon/databases/SettingsDB-wal

Filesize
4KB

MD5
bfedc2d1aae9ddf995cfd0a488e960ec

SHA1
6ff74889a0484ac860723950877e350041a80e66

SHA256
e87ff27da22c291f3693b259eb3e7981bf5308d7b9e283880f6894e6c4eea7e5

SHA512
622faee83483a9ac83f9462eb2371e8c95008bd72aa01d821628ea85ea362d15aa66676630064033daba85fb4ff72fd586a3319b6bdbab59ef7813addba18ec4

Download Submit
/data/data/com.andmon/databases/SettingsDB-wal

Filesize
8KB

MD5
751adf0e20949e0c575c327c7d22f6f6

SHA1
f58bead1218c826e2ef8d5b7355781394688ce4a

SHA256
f72ccf8c209ccee6cd195b2d3a3f9278ff4ec23fd32a47087f38438da1f6feaf

SHA512
be8e98f6b9c94029cf65d0969f9cda202a97353159923a69d3f47255f253ab4d101edfeffb3766b95c70941e65317e356d9fb1e56e2c164b4dba1fe84c54fc8c

Download Submit
/data/data/com.andmon/databases/SettingsDB-wal

Filesize
402KB

MD5
6e25fe7965f648cd28e42845ef3ea2d5

SHA1
21cc6e1103e235f0e9c4c2285c08dd04a09a1bdb

SHA256
794beec95027041754dd4c6ec01c550868ecdd80b373d67cbc6ee6a950e5c7aa

SHA512
eed7c84df119f17f5d785fccc9e0262274a3b1f225325b4fd837347bfacb27b6fe0eed43f39e1b49affc0215f53e94f3cbe02a95cd7d98d623997130f79d7723

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66F4EB65030E-0001-1098-2005EA8B4CD5BeginSession.cls_temp

Filesize
78B

MD5
d361e30a09d70aa855983493f8249eda

SHA1
4956ef0d7fcd0d9d8c8fc3a52905d5dd551b070f

SHA256
7617642dfb6468037095a2c544a0d66109294f4d20ecd283c285388a9ab6cff6

SHA512
c1016f17b44edb874876de287c7ab5ddf411abbe1e3880f50da5dbce0ff40084efcb3a9f402c5298c1bf2a4f715e2f8556d59fced55314df9c170a212d41cfa4

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66F4EB65030E-0001-1098-2005EA8B4CD5SessionApp.cls_temp

Filesize
103B

MD5
5d466871afb005e6afb35b0408c88425

SHA1
1b0a12880ee544608243f6e4ac7e31922e2636d1

SHA256
ec7d89e8ca0b606202dbf5c5b3183332c9d3a012e9090fe7801d63e33b53c534

SHA512
6a6cc7f7269c93836e52f47eb628c29b918439494ed51916e7a290a346192bafab97d962036f38ddda5f1768eb997eb40fbe940461132717c0d8154516e3f7ae

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66F4EB65030E-0001-1098-2005EA8B4CD5SessionDevice.cls_temp

Filesize
88B

MD5
109c0893179e4534e4a15c802896b991

SHA1
7928002b83d3b0c2599fa59ba964940fad78d0ba

SHA256
474426810d5d5d6b36629582d784d7875f4235eeff21d3c461a26ebf0a12f364

SHA512
bea4eaa6a055a6cfd76081bffc404c2ba7c1fa565fa49dd4e60e2a59dfe7ad3f5224caaa6c2df214ea36f153c7150120ef26dfb77084d50791450dffb2929b6e

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66F4EB65030E-0001-1098-2005EA8B4CD5SessionOS.cls_temp

Filesize
14B

MD5
9b3d4522944ce6396563812bfdb92fa9

SHA1
6d2a6133c8f01938a48ccc77ef86ad8ca335c020

SHA256
d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9

SHA512
091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66F4EB65030E-0001-1098-2005EA8B4CD5user.meta

Filesize
28B

MD5
2e24f7e64aa1ff176b3d0bbf66b47972

SHA1
d70934a5531757da24fb6b2e4f1ec6c0e16f32cc

SHA256
2eb995e182f00f6717ac27cc51e63239bb08a191569141d053d9384397488289

SHA512
a2c0350774a38faa053e603c75706e37ecc3db464d1dd4bea1f9692bf663979038e358fd8f24b459198d2b9164854123d61320cd7ab2bde195ab5832f2a6c90b

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66F4EB65030E-0001-1098-2005EA8B4CD5user.meta

Filesize
46B

MD5
69de0fbc5ecc151462b35f5c0795f4a7

SHA1
871ff44a8c5a2c682c0943c0ad522ca1dac22044

SHA256
9c01223aa82dbcaeb26cc6500e86c08157e1070eaa0469f20fe2b40a0fae0df7

SHA512
e1f367d078f8cb9818c3197442c4479f101f233be9a6baebb0ee20bb69bfea8bb305204e8fa896d66a47b45c860d53693ccd4c683ba73a7d3177f02b925851e4

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/log-files/crashlytics-userlog-66F4EB65030E-0001-1098-2005EA8B4CD5.temp

Filesize
87B

MD5
21bfb32922ab8d122635fa7f92f1647c

SHA1
16e89efb577be2a2eb2258a9db9a37a096bcbbfa

SHA256
73c18f9deaea5f2aa2b3690f56785a2f07022a6b3c88e8c69bac843a207c34a3

SHA512
539a8ad6c47552ff21e9344417f835e87eed747dd0943f3ce5d00bde9ce7db2a92b6504d3c98548556ce0379dedc05bd263a03e460168640d123767e7199b481

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

Filesize
409B

MD5
aedd516120a5f3518d08377e8290eff9

SHA1
f91e3989e0ebecb9b8465d39afef69d0440b39c3

SHA256
5bb64109ba16fa7ca008e05e500dbfb5508234a3c2274aa8917a35b8d9617cdc

SHA512
f3cd02e5be7b43bb00905db2cfe13a2abe62e6b6aa01de7db2256f053cf72d4a268b11784de45b4f2615ca44064397b72fa458a31a7e8df648f71660df8e3323

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

Filesize
1KB

MD5
d1d5b457f56195a186e466aff2e80917

SHA1
61ff01cedd8d6bf1f0d5f85afe9d0d3afaf556f0

SHA256
2878846a60b124a3b9507e44e1b71c4852f6b2f06b44b6318a45f0c5374b6c94

SHA512
37bc192246c9ae98e2d00551d3806869d2e3d88b701fa6e248d8fd52cc590c2a0a5937a0dccdbd988f96e7903f352f9e2d4e84a846e1095f523cd07fd049477e

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

Filesize
16B

MD5
c33583fae4e0b61cde1c5b9227963237

SHA1
fe2ebe4d27469af1460f7e852031a04208ef629b

SHA256
35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

SHA512
fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_ad74baec-6938-4389-be01-1cc685452d4d_1727327078584.tap

Filesize
335B

MD5
c430d9adde3a0acf1cc1567edd6a708d

SHA1
7f0bb151c7b7316914f0123d985d7099cfbd4f47

SHA256
b64f91466a3b4f638c6737237dc7d9355e7b8aaff5ea6c4d158eb167272cfafe

SHA512
cb301b01fae3c239fb7fb8b644ff7fa6bbff6bc28c0f3934cd0f14d31ca065ed0403f21c64168f213040ac7f44081f6cc6bf5d3cebe46a0b28b0094473efb5ac

Download Submit
/data/data/com.andmon/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_ed575942-4897-4f95-95ba-5b2d84a1163f_1727327089861.tap

Filesize
415B

MD5
f1bb642c643d91a79d2040add1850143

SHA1
98707e5fe1fea8636b3237c5d8ff8448413d6072

SHA256
e6baae35627b8fa2c2779ee0841639c75942c0c348d29a36c7c569855da5e7e0

SHA512
5af358f7991efca43ac7a38f0fe07ed8795dd88a5374195ff6304f23b4c37e041422096a9c1cdecc7c1e7cb1857cf52c6bbec5af0226b3f91febd497684854da

Download Submit
/storage/emulated/0/.androidmonitor/log.txt

Filesize
46B

MD5
86f47839fb7dca91d09f1fcc6906f31c

SHA1
cbba2363a8d9d400b625788e7912afe9c5801b52

SHA256
8ba3769c86ddcc5b41c66ea524b5bb0cfa0a704663ae0e88119bd2f0d25c17e9

SHA512
fc8212d09cf8b6588b66dbf25b82817f8e2b46f37c7138c34be070b67b745a490bb134ee2e076aba57dda5d8848d653d9727249df5d8e946e163b7a16baa3138

Download Submit
/storage/emulated/0/.androidmonitor/log.txt

Filesize
59B

MD5
7f90fc74a86c2d5250f771376fbbb706

SHA1
46f5a408ddb66fcba5e0fa51f2ca99136f01fe1b

SHA256
72e5037d2089c4355cc507565b35cc86e0866e400d4fb60c52dd29f1c451a2af

SHA512
d884f7d55f4d2dbf7a153e0b1b98b7e5a41a16c65f24538f3b3a8f8f33aabbfa2b6385195e3c79f5ecf9c64168df91e9f54c71c640d3efd9803a1badd88658c6

Download Submit
/storage/emulated/0/.androidmonitor/log.txt

Filesize
74B

MD5
d29cb79c0346cf2520e1be14846b2403

SHA1
69f5ad27dd611c60a1a7cd2cd715656608641f96

SHA256
5a2e17a275b2f3bb9f4d3765e1b076cfd093e776a55582578b4e985fef7ae063

SHA512
7f3a9832b3cdfddec026fa62eedb37b38407e42f4b147a84aaf76abb082200fac5d1520f956249a9706c018dbadbfd5a6f79b76fb5468c8e408b5a6e2920720c

Download Submit
/storage/emulated/0/.androidmonitor/log.txt

Filesize
55B

MD5
b948a5debe0014cbcbdf89f26ab18498

SHA1
584746d144b858d2e53cfdf5763d3ba22241a980

SHA256
42b786d107b714ae2c2983d5141b82eafd183f5f88b9a5f784f39187f8076b92

SHA512
649b4a66a149e8a917c1b6c1e4bc51568d94b8fb6502fc042ee14d91016033e37f48d59b22a4e30102878c953ba26d1e65f1067478999fe2bed8f0a6e900fd1b

Download Submit
/storage/emulated/0/.androidmonitor/log.txt

Filesize
48B

MD5
de4b52de8cd691514ac573724841a078

SHA1
40fd1d6d82d3e25f64a1dd6a4ad464fad3fd401d

SHA256
c9aca27afef1a116ed089ed38ef6944ea6aa4aeeff84f5a467f4b540411a62b6

SHA512
ebd1cb67a9cd4315266f524691aebab8d734b00309460eafe89e236eb164860c50fc7403d97bded9f7cb3f13eaa30bad982a89d56787f6089c3c94c9d8e25733

Download Submit
/storage/emulated/0/.androidmonitor/log.txt

Filesize
51B

MD5
68a0cf67c2dc357b11d3891bed4da49d

SHA1
56942cb0871d47c90ada8fd00b26aebffe8d8439

SHA256
5368dbc52e946fc420ae89f959f2825d6edf1516fe8c961c768599a7136515fc

SHA512
98108849481f37888cf073d8f6d45135c293346344a29e9a842fdecc816775c9fef245d6c89dd97421c56f608ac6ca5c651fb200bda3b1513831b71e2eec9f55

Download Submit
/storage/emulated/0/.androidmonitor/log.txt

Filesize
622B

MD5
91afbefd5c9594299f6cb2bdf089e343

SHA1
dc1454078e630c9a182ddec8d8ba32f99d7060c6

SHA256
5c7459fa886045f319ab63ac34658f20e1cc64d8a402ed19a233b43a18ab9e2a

SHA512
29946ddc9f87ba78c5943cd70a37092ccb25760decd02c1e549e08fb4623530c71e3c3e72d31d71d6b98042cb0acb5323fa230e3e27eba905c87545d50c27b08

Download Submit
/storage/emulated/0/.androidmonitor/log_.txt

Filesize
3KB

MD5
7a552c82000c5a68663042a4034f9af4

SHA1
d306b68ddb35189fc58bc85da63ef9a74a6b5643

SHA256
5d90f850bbfbb89705b33e44c824ee2c33ada2a0c8177e78fd51d29c85f09ea0

SHA512
c42c57d23f1662edc46a956c36fc8df330a714db9f41cb16b534f908ffbcc59c5d6389d5709c3937eafd4a978703f695aaeca4279763eac5e37ea3d0d36cc4ea

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads