andrmonitor | 57cad33dfca431d80730501efae0eb000c634653a1941c46505ee5738435bccc

Analysis

max time kernel
137s
max time network
143s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01-12-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57cad33dfca431d80730501efae0eb000c634653a1941c46505ee5738435bccc.apk
Size

20.9MB
MD5

9513bc68630569c8f6781dbe23dca990
SHA1

bef54d5e9b77e43dc3bb554647fcd5ebf01fcde2
SHA256

57cad33dfca431d80730501efae0eb000c634653a1941c46505ee5738435bccc
SHA512

c14f4f83f92345ad63a094c7929faa388368b68514dd813bb1317d5ec259bf138f744f6e2949bbaebff10bf64b923465006d9aba1cd50093f978e5880bd75202
SSDEEP

393216:FnMsJA35z7A79L+GY91mbgafiubcBZ/bFT9i/zVN2I+TXZlkKpPbNiRSKcsXJ8:FTJA35z7c5sLmbBffcX/Xi/zVN2Ikpe8

Score

10^/10

andrmonitor banker collection discovery evasion execution infostealer persistence spyware trojan

Malware Config

Signatures

AndrMonitor
AndrMonitor is an Android stalkerware.
trojan infostealer spyware andrmonitor
Andrmonitor family
andrmonitor

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	gvevykrfc.cemktbvyqfmg
/sbin/su	gvevykrfc.cemktbvyqfmg

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xd2503000-0xd27bae60	4256	gvevykrfc.cemktbvyqfmg
Anonymous-DexFile@0xd3187000-0xd343ee60	4256	gvevykrfc.cemktbvyqfmg
Anonymous-DexFile@0xd209d000-0xd21c979c	4256	gvevykrfc.cemktbvyqfmg

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	gvevykrfc.cemktbvyqfmg

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	gvevykrfc.cemktbvyqfmg

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
4	prog-money.com
6	anmon.name
11	andmon.name

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	gvevykrfc.cemktbvyqfmg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	gvevykrfc.cemktbvyqfmg

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	gvevykrfc.cemktbvyqfmg

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	gvevykrfc.cemktbvyqfmg

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	gvevykrfc.cemktbvyqfmg

gvevykrfc.cemktbvyqfmg
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests cell location
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4256
- su
  2⤵
  PID:4296

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB

Filesize
128KB

MD5
fc7eeb869a33416e82cb60953de94eba

SHA1
e13da2bb6953ca73f11673f587a32a4c6eb9fbf4

SHA256
6f8c398beeb2b8b99588f32ac97f677d28e3376bcba11c8d4dad591ad18738a1

SHA512
c2601f0d5d8d9b25b39b61b1e3636bda1b57839dffab08e18807423e1619fd4f53a3f668abd98eb6a4b09b698c4160e431521a40f4469fdfed7beb8d92fc6d1e

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB

Filesize
100KB

MD5
c959c9ff077ce07af2f949d3a219976d

SHA1
3671eeac93b2a5d17811aad78645892928368867

SHA256
47005831c4647584841cd7600bf32a18540b5646f7f38c51da84aeeb68716a13

SHA512
bfd78bed2be30c8bd5355aa34bf40e0ee16c1adb707514d092891ee764c7301919b7d1e3c2f4c3ece42bfe5d112da59a1003be001083f34a22f19274675fb953

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB

Filesize
60KB

MD5
b84ec3ac5c1e79f72c55ea19bb82f981

SHA1
2a911a0494b171906a25ce812a25847c9f550a2f

SHA256
cd2acafa436796594063fa7599247531a5a1faf91b5035d85bf692a395cd3841

SHA512
9faa7a08293d0d00f9d0ec1b8c217d86d99e938a0e81f6d0324befefaf8c3a4226a64c1f1ee44119c07035c643e46f7fab51b6421819f346619382bae75ad2fb

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB

Filesize
52KB

MD5
b6815b344f6926d458cea05acd052cdd

SHA1
88f524aff1d4c5fee979a203dd952427871a7097

SHA256
028666f28ae0086b18fb740f792e8a80ad05547f0c7cb9d2dc8080e5125db366

SHA512
0431375f80e9c467d0abb042e43681a973bce455fe8354f5a138f19a3b28d3adc7eac3fe4c20bf44f085810749569b87a393185cd8f8bf2687f0923b8de4dade

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB

Filesize
100KB

MD5
aee41f030019bd76da75544c2c5b2f2e

SHA1
6b9c91d6d3f6cc663400d138ff5ac8b9b17bb1bc

SHA256
ae7b49fe3a4118ea9188e5b59052a0d330753c80d3be5e5df90a09f117694d66

SHA512
2a0f47e31268b9c3fd85b0289f091783b8333afc1c311d470dfafe798c4319065a84475f0f37490853cd16e95e4ebfdd1957822f1f0041fc7e7962d7c3c156a6

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB

Filesize
148KB

MD5
b26d5c84460c49e5f01b073a8b636539

SHA1
527daaf13bc16544659826b96ca25d36ac9a2a26

SHA256
18d1faf6c1fcaae76874577e1a018f0b093b3d532f54f5cc4c1238af8c86a049

SHA512
c6bb069d0e58311eda4c42e923205853d1ded325a5aeea0093ff643cdbdcff6d6ee491de001f294325a9c7f2f60b67d073b924e0aacc5e0a6f5486c99df35437

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB-journal

Filesize
512B

MD5
9b39046bc7bb3fbec416d71d854d6631

SHA1
f12deec45090b351d0a5ce36bdf24ab3b4e5f530

SHA256
45db97f528c6d1025d598ae4092bcf59a4722d36ec3921275c01e964df4c3200

SHA512
bcc86e3ab9571546e826ba71c551e2d2bdfbc02b8be12c758482f086587cc5f53f7fb53fc9f2ce165025c3f74f5b1fb1bb9392233d38df768689dcac27d9241b

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB-wal

Filesize
410KB

MD5
1e9fce0fed7e5e3cbd75af7344cc0b07

SHA1
083ddcfa0968aae3e46610e287f89cbe6b8cba6f

SHA256
485ba57e817a3c4c7eec48373ab884e12c4fe1f60d4e4bf07c9cb1e2bffcc32e

SHA512
7cb8744098e0f4956dc9a134c08ab9b298acc086d6cd156ae9bc0e3795d14f50a9e05a478a990191d7e32c4f2eddb149ab1db354429260c291872a0436e9c7d8

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB-wal

Filesize
8KB

MD5
81bf9b8af3cd2475770c2663e842b103

SHA1
07366234e6d6b9b7fec47ff5d709d9904f2ef676

SHA256
5cb4484c61f2058619085d8c3587f3f6502faf5c8e5093198affae268bbb64d2

SHA512
c313dd4722b67dbf2f51caa0075807e6cc60296843df215f95049c58c651ecc9b7a4641ed7172e987063217a53314157c876a6a7336944d9935161824c2ff029

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB-wal

Filesize
4KB

MD5
a9131eb9873595ed3e2863edb8bdbc20

SHA1
e5ddff6cf578ba8a41ea072a82dac86725ca86ce

SHA256
afda57211ca8017a74def97194b18791010f0c286f7cf77734a0987cc155684f

SHA512
351de915c60fec48f60296c4bb6fdb3247ef5ecbcdae5ae2b961a2034bbf3fdc85a8c86978f22bd8158e4e5301a7f1a4d6d972a00e1ec3e043e2b7c88d8f6553

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB-wal

Filesize
4KB

MD5
cf2ea751349c74aa0698f09c761e497e

SHA1
cf5d63fa93213e12af36dd550965c7cec3c1f004

SHA256
27d3c9e9195e72f7935a189beb0dad276355ff4175786bd97fa3f47a1d66d93e

SHA512
d30d0d22a98e8147c1cc3e24883bfbd72aa42881c74b1c578cc2c5a2fbedf4c5002c4080b615746e993ef1f861cb0484c48535f92ad9eda723e1c094899153ae

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB-wal

Filesize
8KB

MD5
600eda46c25a2c897d078ffe811467f4

SHA1
247603a313631d7c62a897f140e63433b9078c17

SHA256
4f019022b6ea90f3a66e308c7649adb8ec59df9ea537a52d2b85e549f36bdea0

SHA512
c90ad73169fb881aa6da50e117f909c79644cae43cd29767b2e6f58bd5c084c69f2464505fc7340591fb504dbc3b8247832d590d49dee361f9ece84b2f50b44a

Download Submit
/data/data/gvevykrfc.cemktbvyqfmg/databases/SettingsDB-wal

Filesize
418KB

MD5
a397f54ff46be30bfedf15d159ce884b

SHA1
d91d0532d89722238ffb2e53a5e23d9f4e0a4f04

SHA256
1d980a8ebaab8f4670dc6880f7f776a313015583d13e5563290c3774c2792dfd

SHA512
809656a61f80ca1b928d9f28edf4508a1985e8f7798e3e5e5468da0c677a29347211381aaa443cc65171e87d7074664283484601e1dfc05df40a0735f6e078ca

Download Submit
/storage/emulated/0/.am/dm/md/main.md

Filesize
2.7MB

MD5
fc5c2f165df3e661d69554850b7e8f95

SHA1
9ce32a8377117278ee366af58875b01a2c8fe0db

SHA256
989be89cbf9ddb59c9d1cb60f263d67213eaf9ae4053f5a53ebf94040d303fcf

SHA512
d3ec97d40be88d9c6dd3253ee7c9caafc30fa8d5b8d63f804b2674f011c46b194276f69d88e7548ae1c0b0fd89e796b459bfa105b0aa989aeb2954dc088d0c85

Download Submit
/storage/emulated/0/.am/dm/md/main_tools.md

Filesize
1.2MB

MD5
87f9d7a738756162c8b7f1c125ff4140

SHA1
1a3bbf2cc1affb0ec01d02bd10be5005c170c6d8

SHA256
edb91d71636995982a9b2aaad74f84e67aacf35b60bd6e73bb923f4a7008337c

SHA512
d45e4ec5777cb43510f78bae6eaad5e6e294f9f18c0242df50a99ed39b8a7f0d75997eec27ae204785e006ec83d00ea85dd9ccc4f72c7706f326dae4af26285e

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
137B

MD5
8a4c7885faddb5aee5fae868c2b5b703

SHA1
2b0ac1428ce4c864c5e38b6d374526b6f72a9498

SHA256
7f005532ecf20083b1cf12b3d27b4f5977b557a1c4e49e46ef7b6f7bad003869

SHA512
8538e9248e05d4fb0caffa0eef627be1c1f93f3cffb6485d8fe8fd15ec0bf774a7082a51e584c0ca25b64ba95321101823707208902d56ee0e5d5644a9d9e9e8

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
171B

MD5
0d5ffd4c2e3a6bd57165575ec1f6f406

SHA1
8fb5d5f549f0b04e1dccb584a7e1267e417e0af8

SHA256
c0fc3f41d832dcdbcf0ab4aa3243fba8535ab3d5ff0cebdb1934d8300506c898

SHA512
429118ac7927c82279a603b3a198d869db375c60d9f694641aa998c98494fbe5278f571ee6beeff187649aa4cd6e1865c4307185b75e19b5468bc476b95c2ee6

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
3KB

MD5
31a9688866fd3648a3b7256249f5c5cc

SHA1
a50bfb907c1193ea5b3595acb79086457d6a3828

SHA256
f6abef7fb7b077f053ed8ca179741025e114ce5593355a660cfb7786d259bc48

SHA512
570d56fd9c08b00c2bb8367ca4b0b869fba648a618436fa54053ac3eea0ff7b188ce1251c2ee4f16659fe476d4894151916b5425a57186e7e687c994c40ef8cf

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
62B

MD5
ba7c86a1dbe691a309c0ab3585845a96

SHA1
aaf86b6ad6a2b5ef314a545b1fcad1426ceb6120

SHA256
166d39bd4f2ef682bcd2549ddede30c225240b8f6d403a5c01d243e25bfb549b

SHA512
6fd0f7b0ce5c46451f83de797baf8ef444dc89ee917c9052fc1fbb04df02609ebef3163a067b02e7cd62989d9c76d7f63991c3719cff29c9c83f39499231d769

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
70B

MD5
646b8d02fca9a877faae2f0af8d6e81a

SHA1
025a2b14134ff5c0bab4e540ad1bbcf304ad9962

SHA256
034106bf6a21df9df4445438a2f7f3fc7c4d5a0f584d5f85331a75d074114daf

SHA512
7a5031009e9808c609fff8d4a5c8349171bec150c4e921dd9e2a547a1ff25a87ce807d26c118aae98dbe7529ae5be3ee12bb5075be66702c39da19e38131e7fe

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
59B

MD5
ffe5d324e1c1dbe81125f7b45647c9de

SHA1
cd46b753ead84b1908c5a164f9b7334c5bc35b5a

SHA256
5c73a637704a8514be7831afbd4e6f82d667782458ec2791963a2c8396edf2ec

SHA512
9172843c8f0fc62ca8dc22a6e067ff7e69086239cf6df0c8df723e4b38cc0ebb7ba98e31361be7c845a50af11f4e8a62ff3634c6bab47b30117c5f14307a4ccf

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
171B

MD5
d524416e7f309ddea08379f2de101404

SHA1
521ca40befb2ff650907fb046cbcf36c97b17cb1

SHA256
df6d7784c4fb78456b31f29a341907418dc75a9591d82d49b5a4b85907492cad

SHA512
0062157b1d56b9afc37003b65a3cfce6d69e00b4d489de501ad513df6693d323fd6017736098a8456d0d764588f22f98cde8ae8a16ffbfb62683d75748c64176

Download Submit
/storage/emulated/0/.am/log_.txt

Filesize
29KB

MD5
ace711d913195e0d0fe9e16831a50cc9

SHA1
d022f918ec6058d279fb984122a9914fbd9ef6f1

SHA256
58596edb970a5e751d5a0f9d7170ed1b706994785020faf799f0b01d8a4e519d

SHA512
e46448e8067b861dfec4c0235050bbd5723ae09aee2bd922d9ebf2f27364469a62a0f894f86009bacd9a7ec0a8e31f2fe1edb70a2e4678b9d0fb244e265a03b0

Download Submit
/storage/emulated/0/.am/log_.txt.zip

Filesize
6KB

MD5
c1af15858cfa8bbf8e18005d3c86126f

SHA1
a785f44e2967e75017ec0dfc5b84f7a4aa25ca4b

SHA256
4dd41c941ac832bc979e8e0efc1964705dc1286fa792abe1c489ee56dff59d65

SHA512
a33f58d749b10f9dcd1e7a77766dc72219808d8cec36d324d7c42cd24bdd1dc8a7da053d994dcd9b8f58409cabe9f52e37e6855744ac8a03bc9ecdfb1dc845a0

Download Submit
/storage/emulated/0/.am/log_1733022540873.txt.zip

Filesize
218B

MD5
c7e0704aa7bff21ca2bc20aadd89f60f

SHA1
df4ffd799906da6115668cecb6216e7020fc201e

SHA256
ca149785d909f1802d717e8ab81cb3fdd53b08b647037fea6dec883bd0c38751

SHA512
804ea3560730d1f643f8125758ed7f16eecf2418cea9291959517292ad3a905e3ad2b56e77148149d6b4a469222351bd6c64d528a1f02bf62b96caf155ca761c

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
101B

MD5
38f0b1a489b3a8199e83f6ce6c831883

SHA1
870d22256ce4346d0a94d488f703492c4154c4a8

SHA256
af1ec46848fde1684ac250a263ce39f2f7f9f24d33835504b6a251ae443223b5

SHA512
0df7776fba8b2caa5814dd8fc4357217fc061231c0a9e1f7d3d6a95e6b648f32d1f54927359e14af7bfa0a348d97b6198abae666c1f8607824ec4dffab436d78

Download Submit
Anonymous-DexFile@0xd209d000-0xd21c979c

Filesize
1.2MB

MD5
603dd5064572fcdbbed7753d36254d6f

SHA1
d43df670cd60dce6d02955b73eeabcb5d04c286b

SHA256
08df256b7e051a79efa3d142d40307b2045627fe5696f414a0f3ae0f70d7b8cc

SHA512
a0fc3ca2e19cd9b917108ec469703da1fab7108625ca3983db8a26f261d2919fe7c4bc064fe8b56915c8a4c8173562c553b8751d7bc4b4e4232b435a2c640f0a

Download Submit
Anonymous-DexFile@0xd2503000-0xd27bae60

Filesize
2.7MB

MD5
9e5ab1ab869c16715311e524196d3653

SHA1
01c0e56cd26546e301762f0c0ffa6cd1dfca2235

SHA256
293ee414e1b04f71ae70117f2aa20476f76af60db33656ae41959d8639c23af2

SHA512
da46dbedcafad3cbc2344637f075655096bd358b2fecac3596476b3eb5f7da66825623013b7cbe50788ef40a37ee2aba1454f5d098379da011cb3d88a57f9876

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads