General
-
Target
57cad33dfca431d80730501efae0eb000c634653a1941c46505ee5738435bccc
-
Size
20.9MB
-
Sample
241201-dm9sfsvmgw
-
MD5
9513bc68630569c8f6781dbe23dca990
-
SHA1
bef54d5e9b77e43dc3bb554647fcd5ebf01fcde2
-
SHA256
57cad33dfca431d80730501efae0eb000c634653a1941c46505ee5738435bccc
-
SHA512
c14f4f83f92345ad63a094c7929faa388368b68514dd813bb1317d5ec259bf138f744f6e2949bbaebff10bf64b923465006d9aba1cd50093f978e5880bd75202
-
SSDEEP
393216:FnMsJA35z7A79L+GY91mbgafiubcBZ/bFT9i/zVN2I+TXZlkKpPbNiRSKcsXJ8:FTJA35z7c5sLmbBffcX/Xi/zVN2Ikpe8
Behavioral task
behavioral1
Sample
57cad33dfca431d80730501efae0eb000c634653a1941c46505ee5738435bccc.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
57cad33dfca431d80730501efae0eb000c634653a1941c46505ee5738435bccc.apk
Resource
android-x64-20240624-en
Malware Config
Extracted
andrmonitor
https://anmon.name/mch.html
Targets
-
-
Target
57cad33dfca431d80730501efae0eb000c634653a1941c46505ee5738435bccc
-
Size
20.9MB
-
MD5
9513bc68630569c8f6781dbe23dca990
-
SHA1
bef54d5e9b77e43dc3bb554647fcd5ebf01fcde2
-
SHA256
57cad33dfca431d80730501efae0eb000c634653a1941c46505ee5738435bccc
-
SHA512
c14f4f83f92345ad63a094c7929faa388368b68514dd813bb1317d5ec259bf138f744f6e2949bbaebff10bf64b923465006d9aba1cd50093f978e5880bd75202
-
SSDEEP
393216:FnMsJA35z7A79L+GY91mbgafiubcBZ/bFT9i/zVN2I+TXZlkKpPbNiRSKcsXJ8:FTJA35z7c5sLmbBffcX/Xi/zVN2Ikpe8
-
Andrmonitor family
-
Checks if the Android device is rooted.
-
Queries account information for other applications stored on the device
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
-
Makes use of the framework's foreground persistence service
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Scheduled Task/Job
1