andrmonitor | 059f6cbc0ae85403ce53189724812a70b38ee3a2263802f48f977d4462e164b4

Analysis

max time kernel
46s
max time network
136s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01/02/2025, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

059f6cbc0ae85403ce53189724812a70b38ee3a2263802f48f977d4462e164b4.apk
Size

20.8MB
MD5

96e77a35b4f5f9e9ef8c9280ca06800b
SHA1

f53fe17f4493bc08faf4f5c796aa7a0b30ad4506
SHA256

059f6cbc0ae85403ce53189724812a70b38ee3a2263802f48f977d4462e164b4
SHA512

409d307637349b4fc284221bb5d14051dc55a1c7016f82cedd6a6c2c8e3adf516b2cab0a9ba3851aa943a51994e0f24db6cf57300d319c0e58c9d1de6dd9a1d5
SSDEEP

393216:G6UKoU8+23isJA35z7A79L+ow71mbgafiubciZVbxT9i/zVN2I+TXRtkKpPbNiRB:RoA2NJA35z7c5SRmbBffc4Vri/zVN2IJ

Score

10^/10

andrmonitor banker collection defense_evasion discovery evasion execution infostealer persistence spyware stealth trojan

Malware Config

Signatures

AndrMonitor
AndrMonitor is an Android stalkerware.
trojan infostealer spyware andrmonitor
Andrmonitor family
andrmonitor

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	qiozm.zqoasww
/sbin/su	qiozm.zqoasww

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4210	qiozm.zqoasww

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xd3516000-0xd37d03c0	4210	qiozm.zqoasww
Anonymous-DexFile@0xd41a0000-0xd445a3c0	4210	qiozm.zqoasww
Anonymous-DexFile@0xd3153000-0xd327ff24	4210	qiozm.zqoasww

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	qiozm.zqoasww

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	qiozm.zqoasww

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
4	prog-money.com
6	anmon.name
11	andmon.name

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	qiozm.zqoasww

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	qiozm.zqoasww

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	qiozm.zqoasww

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	qiozm.zqoasww

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	qiozm.zqoasww

qiozm.zqoasww
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests cell location
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4210
- su
  2⤵
  PID:4278

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
128KB

MD5
83f9d1be51c0ef0019952bd962f70f05

SHA1
8f9e2782d24b692b46e6aa8974e61fb6aa7d903e

SHA256
9623d7ebba654211ee8fe37878dba389a66331142db2401a66207d308d29528b

SHA512
586686fe26bac50335757548d758303a9adc54ccaf923f9ed977d05ffb927a4c406480b8fd8723a6d8adbad5d079843931d7b1d20aab2c369e88e6a62b928a53

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
100KB

MD5
e763d84d6c5b4df11fa9b44b75518ffb

SHA1
f0afb59808d7bdc30bcedc741d9185822be2bdb6

SHA256
4cd3aa889cbc3744a0b0f2bb6a8a7fd8d9d2cfd84ce3c76d5d784f0f03bc8418

SHA512
4e669ef474aff2eab8eb317fcd283f23ecaecb923d4ba3114c4444b0a024da7074af08d3e910b0bf2d411b7f950f9b7e02d0b2ac91a4f4cca02fb107737d9d7b

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
60KB

MD5
b84ec3ac5c1e79f72c55ea19bb82f981

SHA1
2a911a0494b171906a25ce812a25847c9f550a2f

SHA256
cd2acafa436796594063fa7599247531a5a1faf91b5035d85bf692a395cd3841

SHA512
9faa7a08293d0d00f9d0ec1b8c217d86d99e938a0e81f6d0324befefaf8c3a4226a64c1f1ee44119c07035c643e46f7fab51b6421819f346619382bae75ad2fb

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
52KB

MD5
b6815b344f6926d458cea05acd052cdd

SHA1
88f524aff1d4c5fee979a203dd952427871a7097

SHA256
028666f28ae0086b18fb740f792e8a80ad05547f0c7cb9d2dc8080e5125db366

SHA512
0431375f80e9c467d0abb042e43681a973bce455fe8354f5a138f19a3b28d3adc7eac3fe4c20bf44f085810749569b87a393185cd8f8bf2687f0923b8de4dade

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
100KB

MD5
5a4b0ca3fea797f11415e77aaccd597e

SHA1
d822a4402d622433a89c389b3d75a1d6b27731d5

SHA256
bb2aa3c5cc2378247430eeafa0924eefe3caa384251da3d2a2b629eb975a119a

SHA512
9685eb681162e7e51565dfd792401c85e8686132f1d8b2948487bb6173fd76f4b14218ee8d3d29c1d79a561a2c0bc249736bd5901ca2b0b06de490a9be18c357

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
148KB

MD5
aee94d5318b8f244526b8f42dc3fdf3c

SHA1
3715caecd4268f731450a3d3cc6b9ce2009486d9

SHA256
44dc6682784ec1421b1bceec80bd967bb35da15bf2fddd0d037e1b24bac57536

SHA512
478fe3519c1de1fefcde9e3e950658e11c6985dceb7c0120bb3e222494cbe2096983bcd8e36fde5375179f915199a6cb1bd3bf9462a615f0263131c6ca3198d4

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-journal

Filesize
512B

MD5
7182463bc00cb49cc68a286c5afe4a27

SHA1
836cd020fc0476af36ad46f5ff39b813d0adfd3d

SHA256
f1aaba958316898e6fef39c0c7817620b544cdd25bb19933405cbf859c256e06

SHA512
b5c94b6dda781c4b0add6a7faa4f1ca4d4e240004c775fe064ff5825fca608a89388d87591b960b980bdfe38138535bd5af5c967346b811dadc001ad7da61732

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
410KB

MD5
2cc15302397cd5c7edd2047fa59b53c9

SHA1
715c1a35913ad3def6f103cf9c2b030c03661139

SHA256
5a00df29b31a75a734ed08b1ad5869c2ba9a2f182db38ead3308c2597bf2e44c

SHA512
a63a406edd9196c40202f3cebe7fab0e81639a631794e044ecc1a8afd39923c9fc8cf403622ab87eca90b42fbe3f77f63f8d6a38419db9289e0386fb34e5af29

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
8KB

MD5
1b63efba1cbaa41e7bfd8ef61103de45

SHA1
173c2ab38ea207e3f32d07e7c2e971fb01b589d6

SHA256
61718dc91372d12f5dd9d56887bd91f45bcd53fdc059ef90680c400d1195382b

SHA512
f3d9c07c3c9184a2dae2eefadefa8093e790bffd753f3fba633605ed31cdfa5f99c5a6c893c280b494afb290079ab32448302d6c9b3e088585edbf8d0f2c9b49

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
4KB

MD5
9ab025fa147a3c99efeda7111b5b7887

SHA1
232a3e9b1ca667f91fbd90e1af4af476ac758eac

SHA256
92442c227426b6a40523b5909dc744cf965830c510e51c1dc8577b1185c8b7a3

SHA512
e09d2548a5a7fa3d21c992ee2607d8f60d766f4824e7ec1ac0bc7dcb9179bde87f6e3cc8add8da43793f1fe294d849c77fc6a159ffb9103e5ae54b4b364353e0

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
4KB

MD5
d17e2168db9a4cf86a0bd9c21ca7a3be

SHA1
3923f1ac453515e9e522520fff62faac5ccbc58e

SHA256
c622e3271a47fba8662915402386acd98a7ce42a3f40f9df8baf8734a78cd74d

SHA512
031eb1836b5cf59810e72342eef0a7fe0450832d5677862230def32e75af459f8ab89be5078e509b633e77dba7d9f69bf3b96e0032ed6b9e0df677a06f5c195c

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
8KB

MD5
6cce63ca0edf0e974824f97f43512592

SHA1
f57525bfd60fce6ee85d7ad5d851ddddffa64765

SHA256
24fa50cc53537c4add6514780c6397296177e737bdc39147c8ff3480ab684f5a

SHA512
ce2920c03bb7b89616941bc66f30246acde5983cc55fff9b94093a7f5dc314d2409adb3a5592d12fae3de988b2d67a05e5dddcf5a8fd8f122d7b46443a3b7844

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
418KB

MD5
5cf0bba56fc8cf42d98f904e357d50f9

SHA1
4924e0ce77a080baae808b407415dfd303c1320e

SHA256
cc1273476f3e800a27676f7da3c6478b61d9db834345bb3cd06771a81ae1aa96

SHA512
05bcf5213bbf20f74b66efe20c532c4d92b1a3b5a6869b1dedd9dcf880275fdd1c5bb7a641b3baa4af0e4eee0accd49c625172cfa5dc05974802adacb2412623

Download Submit
/storage/emulated/0/.am/dm/md/main.md

Filesize
2.7MB

MD5
2383301abf8e9086f0230c0c3275beba

SHA1
6104a72736b331052ad00b7486d5e0766721cf74

SHA256
e7ec38080b7e44de44807a5f53cf3a3005821ae32d75a9ea3d9bc27646d5cea7

SHA512
85b4cfe31dfdbedfd9cedde5ac48feeaefddf88ea6b4e5b59cc4d3a95855c83518de23d94626438cc1482d711a34f125b6516480158b53130f1b035225792273

Download Submit
/storage/emulated/0/.am/dm/md/main_tools.md

Filesize
1.2MB

MD5
c81c51456766e174d6b23e17e56b3151

SHA1
2b8f21a13af6efdfe1bfa00c011ba6a1bc5d6f20

SHA256
79ceb49440a30e4e0b9ab83015384650cc535a1f54d457cf4a0873f9621c0822

SHA512
a88c8290d5804d10cbbe811eb3b041d122c66cb75b44c5095f3e03ebf90e8f39d58d6d7e20066df046e9999b3341337094336b35c987ed6af34852c8a049a13b

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
128B

MD5
453eef10ef522c4e48b7517fbae4f748

SHA1
9b779ca31c6dff01a2e95cfad912e789313740d4

SHA256
5fa894c69f5b24cdf9d5d5f46e15d7e7c6eb313f1bc219fc90908ee0591d2f72

SHA512
b4e9a2f7a150d25870876c69c0df8bcb3e0a6ec66534c8cf9837b9186be60209b1b8204a9ffa0ad634ee95e7e10e66df9a8424874fcb6358e4bdd099cdb26441

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
171B

MD5
a72612f6b2529134ab682076bd528e57

SHA1
3bce8a8cd0137403a6da6441336eacea8894cdfe

SHA256
341bee83b1649a3349134236bb7e31114faf6bd91f1c19f66007196b79715293

SHA512
77a4493637047b33ca12e73aba8f17c3ad0b08250665181108568c368bac35b56bdbd350462a324a10eb4d02564fcd9b69a639fbfe6291e89fc405e96a77e533

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
3KB

MD5
fad16500cf4dd101a00a225914a22a70

SHA1
003f90bec81e426fb27851079c68b7fc5a0b140b

SHA256
0bd603e2ddda952417c1653112e3a18033c25c3e31262f3e658c16134c9c3610

SHA512
d1470f3827515b6439fc597045e94d9597693c1aa925c8f523443efd0e6fea4a6b8eb002c1c942b15c7178a37b337ac19d014095b18c7d2679e31a7e3e7aa965

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
62B

MD5
d7778c71cd56e1414bdc5508e04d715f

SHA1
5aa9607f1f3dc6f33f30baeb1d9c19e2fc112d2a

SHA256
08a5b77e6edf6757ef8f4ba37464f9b357163e0c438baf79c02a7784641b0056

SHA512
55add9e9b54052aafa1adda5e7b12b0c430c1b5f009b44f6cddb02e3dcc2df88ec7c340454d79862ad695d02c0b9cc785034c8c109264fdf90f6203461953957

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
70B

MD5
edcde1640629ebd8cc5f8e78a89a6969

SHA1
609afd94b81e3ced466f2bb27a8c8fdecdc23abb

SHA256
cdbb156ebc17c5194f31e3aa76b72a3833c722744c26aa17974092862a4f0aaf

SHA512
d66cc03287108a8b80e6b090e7626e3941444eaa4b90f4ec8b613f5a824250e360125b557d87975bd1b1541ebcc2d5aa4411345ef0af1c6e1c1df44903b2e828

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
59B

MD5
297a20f0c81f1463f97f501d7cdf823b

SHA1
95de0a6b4defc2c920355ea416a57fd74b20fbde

SHA256
eedee618a2a4f5263f416315b1dbc8856c37b24079fd7134807b7183c1a2a4d5

SHA512
9b8793014c6cbfff88cd4e28c5ee2ed3b8bbc10f9feaf3e00a259b19006cbcaa674bfcc6f7c52494d221eeb222d86ca5dfd2049a1370de809f56fbfc1935754b

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
153B

MD5
a036bc86a485fa63acd949be90a46907

SHA1
1939c7772692ae2016067602aa508fbca618af24

SHA256
60384e406cc4fa3bd3db6c8b6e80bbe76b1f0a75aea6b30e3dc427d4dbd49f38

SHA512
6443b7f412b6a58766b197d1f61a3a875de4483158dec9f13afd598eafb7dd83942002cba963259bf31d4a3f196834bc84835429fcc5c15b4337624a52e4c28b

Download Submit
/storage/emulated/0/.am/log_.txt

Filesize
33KB

MD5
0c6f1d091950ef188d33c74933642f02

SHA1
5cd01522a852d563751c42cc5ef480d99f57ded3

SHA256
5feda593a69bd7d6583c5562de02284adeb47b0fb21f8bd82c23a7419a4434d7

SHA512
f47d6b9a045f7c9e5ee587e34987ebf736da167d53af66a8e8f0f37c035055a18d0cf81ef51cb14691cce88e0dd02ba4ab878d01a4c212649b1dcd24a4ab6985

Download Submit
/storage/emulated/0/.am/log_.txt.zip

Filesize
8KB

MD5
2a4e98c99045f1c395e32c2d5397b55f

SHA1
edf8a5adaf8d0176c2b89d545987556f51963e5c

SHA256
55263b21b844f00a014201481f80ffb5c6bf8a3090be7d58aab3c7b0297b2574

SHA512
4e3dea0da57aa704a27603ff559cd86cd3745c3eee4f9f45f8fd8984a371a2859959d914c0bb23a3f74ce0bc457e451b10d25c23b7464eee6a846287b0627384

Download Submit
/storage/emulated/0/.am/log_1738376854548.txt.zip

Filesize
218B

MD5
61893c19294b24facdbc0c0709ddaa83

SHA1
afc7e5c79b5831bc6b9b1dfe26eed4f0f7153e89

SHA256
8574da58d9933ed3f544da4646fe4e68f8dde67c0bbdc9b91878040276817f63

SHA512
d483d4ca2ba14def733a1f77ed90260cb059a90fdd05c52d4bb82167a4c77c1801383a0ee478d0fbdcd780186859f3f0eb150703401bfee705f4ee0755c871ef

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
78B

MD5
02a33fe89813f6da6310c3e84bf93f2d

SHA1
ed45da9761f0b68622171385ed2f31c1bd96ebc9

SHA256
d21d5e5e03f1f1d00dcb59ebf84f595e5c273c967da06e6306ac7035e6c620b5

SHA512
a99dd59f1b75951c0d60d07f7acc06d49f5ecc8842110ad8ee82343c63fa3f8d1e2dc585f75d6aa0e420bfabd3da56da195263b1c1a7bd4880d7a8a7643f4d0a

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
76B

MD5
82c9e18badb03758115eee83aaa469f5

SHA1
efac9ccaf736c5474a6f9b4637098a82b5fcf37e

SHA256
fa1c78d5179a7b2ccf361851a9b30c46018624975c146309d8d22e3dbb35a235

SHA512
0a2b08c0ee50238e25ad1a49356c643dcdb5832f5a46363dd306a91c57c76008b9752cdb786c1a839d513b86713996da91df54912caab6824fadc85e0dc2a0c8

Download Submit
Anonymous-DexFile@0xd3153000-0xd327ff24

Filesize
1.2MB

MD5
4768956e02a41b7e2032707b7c65a52a

SHA1
eb730a2e6f2b0497ee9731c488b02f0e68105942

SHA256
c50c0434ac58766df76b0ffb3fdd9489a6d8ea7b8789f0bfbb3fb78299a00060

SHA512
afae3c09e482e6577f4e79013b6d2dc1ce89a00a2ef5571074931da9bc91aceb53a01298dd3072325034ecd1ea0ec92dda630c06433dcd458ba7ac574778848c

Download Submit
Anonymous-DexFile@0xd3516000-0xd37d03c0

Filesize
2.7MB

MD5
fd1787b37bb2c8daead349360cb2b6d6

SHA1
ae98446bc912c5a95ca5ef3c1207daaf8cc97da4

SHA256
001b6ccbb7cce5f46e14b4e864a0c1aea678089704594eef8a4b229fdfc3aff7

SHA512
cb6908dc9a0ec87a087cc64ef9f1d48a9c63dc5c21991ce641575a9cf8d343cdafb9b799112dccaff0b439cdb366f1448f435b892fa5e9f4899dd78917c9964b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads