andrmonitor | 059f6cbc0ae85403ce53189724812a70b38ee3a2263802f48f977d4462e164b4

Analysis

max time kernel
47s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01/02/2025, 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

059f6cbc0ae85403ce53189724812a70b38ee3a2263802f48f977d4462e164b4.apk
Size

20.8MB
MD5

96e77a35b4f5f9e9ef8c9280ca06800b
SHA1

f53fe17f4493bc08faf4f5c796aa7a0b30ad4506
SHA256

059f6cbc0ae85403ce53189724812a70b38ee3a2263802f48f977d4462e164b4
SHA512

409d307637349b4fc284221bb5d14051dc55a1c7016f82cedd6a6c2c8e3adf516b2cab0a9ba3851aa943a51994e0f24db6cf57300d319c0e58c9d1de6dd9a1d5
SSDEEP

393216:G6UKoU8+23isJA35z7A79L+ow71mbgafiubciZVbxT9i/zVN2I+TXRtkKpPbNiRB:RoA2NJA35z7c5SRmbBffc4Vri/zVN2IJ

Score

10^/10

andrmonitor banker collection defense_evasion discovery evasion execution infostealer persistence spyware stealth trojan

Malware Config

Signatures

AndrMonitor
AndrMonitor is an Android stalkerware.
trojan infostealer spyware andrmonitor
Andrmonitor family
andrmonitor

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	qiozm.zqoasww
/sbin/su	qiozm.zqoasww

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4256	qiozm.zqoasww

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xd1793000-0xd1a4d3c0	4256	qiozm.zqoasww
Anonymous-DexFile@0xd11ad000-0xd14673c0	4256	qiozm.zqoasww
Anonymous-DexFile@0xd2411000-0xd253df24	4256	qiozm.zqoasww

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	qiozm.zqoasww

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	qiozm.zqoasww

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
4	prog-money.com
6	anmon.name
11	andmon.name

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	qiozm.zqoasww

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	qiozm.zqoasww

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	qiozm.zqoasww

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	qiozm.zqoasww

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	qiozm.zqoasww

qiozm.zqoasww
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests cell location
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4256
- su
  2⤵
  PID:4297

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
128KB

MD5
83f9d1be51c0ef0019952bd962f70f05

SHA1
8f9e2782d24b692b46e6aa8974e61fb6aa7d903e

SHA256
9623d7ebba654211ee8fe37878dba389a66331142db2401a66207d308d29528b

SHA512
586686fe26bac50335757548d758303a9adc54ccaf923f9ed977d05ffb927a4c406480b8fd8723a6d8adbad5d079843931d7b1d20aab2c369e88e6a62b928a53

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
100KB

MD5
8ee13bbf9588f48b07d62c3b7dd4bff2

SHA1
db7ce3545ff49be724aa8a8bc385af06941f8f4e

SHA256
ae92fe23983113925e1c41568b2ca86c9ab26776e55485826fddc3e9cc3083a1

SHA512
073176743a7700e91bf0eca99c778b90c4d130e987e113f63b684420f28bc6c24de96fd5b733f89a6c66181542022cde8c1285146971bf906b4433fd23fa7195

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
60KB

MD5
b84ec3ac5c1e79f72c55ea19bb82f981

SHA1
2a911a0494b171906a25ce812a25847c9f550a2f

SHA256
cd2acafa436796594063fa7599247531a5a1faf91b5035d85bf692a395cd3841

SHA512
9faa7a08293d0d00f9d0ec1b8c217d86d99e938a0e81f6d0324befefaf8c3a4226a64c1f1ee44119c07035c643e46f7fab51b6421819f346619382bae75ad2fb

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
52KB

MD5
b6815b344f6926d458cea05acd052cdd

SHA1
88f524aff1d4c5fee979a203dd952427871a7097

SHA256
028666f28ae0086b18fb740f792e8a80ad05547f0c7cb9d2dc8080e5125db366

SHA512
0431375f80e9c467d0abb042e43681a973bce455fe8354f5a138f19a3b28d3adc7eac3fe4c20bf44f085810749569b87a393185cd8f8bf2687f0923b8de4dade

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
100KB

MD5
2fd47f6caa706ffa5b461cfbde8e49f4

SHA1
03c6500a05c4ec784e79b2f6a0445e5255dc2eb0

SHA256
b84681e65c6e3fa6738af7780bc939823b66970e5afe6a73d216f27b473476f4

SHA512
9ddc2b696b32115f387589effcb409e5aa698382d29d4116aa78c213880e9ab43011999e3e2940b50ec665671932003d938a46e4a8871466a4343534f08f07aa

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB

Filesize
148KB

MD5
aeb46a94e6398a469cc1ee30e91e3410

SHA1
6521a0584f58fe61ea592b4d2c4bd22ad91f7906

SHA256
d7558abecb187969ee8e33b32d5944019de1a95b482576e5cd8a5ebe85477805

SHA512
af71c3037f3a146cd0e857e568ef97fa95a783238732a5590d40dd2b7d9b52d3957520ca31769f3ecc3bd08d4fb858ee82619b81e642fe93061f1a91a0bb3f67

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-journal

Filesize
512B

MD5
96e0816b3a2d558997ce18264edd7d58

SHA1
364d13ea845ebf524a2863c572ab31b12bebb674

SHA256
30ded1774b1002aa0e78f828c9ebfe29ce4afda8341d54b0c968c59ce2009fcb

SHA512
6c51245081a9655b47ef71dd3a8ab5861591f06265bfc96ee2b8b88c65ccd3cbc09d07b9e082010e7a584622c50f03887d332dd5225b94e2801b28710935e3a8

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
410KB

MD5
c779278c17055ecc1a057b1ebb118761

SHA1
a65c3ffb49ccd6afb33fd884a35a58ab8e00ffd3

SHA256
0a285179fe9edbb5ee8625d573e196d7fb742064cb8fdde583b97d31c1641d79

SHA512
d3ada002857b00d4dc05a02ecc3c89567151cb51cb4494b66078fa027ba6544fc365327269813dc7b5dc75cc51136e578d49ea68115d7e5b040bfaeb4fc11b76

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
8KB

MD5
a22e9f9db7adc9c0f532d5d370c94b78

SHA1
aa56838f85728200ae7cdd8b000222fec21460b3

SHA256
bfd4920f6a8cce62ee3e0ce2454eb93859c65bceb308faa74a212e2b0db36187

SHA512
9037027c05f70e5558405207fc3ef430f30f3ccc129a33f475854073a70834a4c73f776b0bf03941267a1243a6398b6f1816e12bf68684d44ca1862f1adbbf16

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
4KB

MD5
b459f4389371173e6493b6d2725fc4a4

SHA1
c7d1ff22c9c67dca3d70e45c0b4c98e1051b42f4

SHA256
d42131fb6dd6f4fae5028a50ba252011d51ff6587e95753b76da0443ccc69f4b

SHA512
d19cfbac34f69e9ebdd5cc6db2352fb9049665407efa373ea643a00af6252542ed8e03550458de5e9a476ea5432425c6dfa7662eb1b81463198d96bc05c38eb5

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
4KB

MD5
d54d1cd695e02e029e2ed8fc117aa3f0

SHA1
37fda21efef2c6758a5a7a4f92824ce099a830d2

SHA256
d34e4d014548fe2b0422d8f4c989d345a149c3e169aa518e1f9735e926c7e579

SHA512
89e0a9633b0c5d69e2a8399b7d5f1a273b6780fb7612b045138508edb16b6f4defbdf9a7c15fe829a7a33086cd54016b9bebe3c627b9c0effd0812f002b50360

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
8KB

MD5
acc0912854baca2081e7f9f168b0d501

SHA1
e693a3164ecb67915871855acbadef53561122cd

SHA256
5774e1271bdba91760d56d50f3425bf5b2d6e0cf7456709d8e621c70495b0d3b

SHA512
d621060ef5fba1427e41353e8e9f046adf1786a11b46760c96a2e50f161d2097277fe78530b532b98544e9afbb972090e391d8566bdec73460f808b5f38e9f32

Download Submit
/data/data/qiozm.zqoasww/databases/SettingsDB-wal

Filesize
418KB

MD5
569aa1c25ec6e566ed1932f26d36d82a

SHA1
0ce17a533dcdea4d5a4cb9fd9237a87145a2fca5

SHA256
23045fa5de580063f09cf04cfca6ccfcee3ad161a18dfc685e6bdcc4edd60cd0

SHA512
03b208db8cf60b61fbf0d99b4f8b908c5c8bb12431c52a71208858d9a2785cbb4c9c0e40f1793220115f13d2c7ad99c99dae790773d3afc8f32cb6f9a89cacf6

Download Submit
/storage/emulated/0/.am/dm/md/main.md

Filesize
2.7MB

MD5
2383301abf8e9086f0230c0c3275beba

SHA1
6104a72736b331052ad00b7486d5e0766721cf74

SHA256
e7ec38080b7e44de44807a5f53cf3a3005821ae32d75a9ea3d9bc27646d5cea7

SHA512
85b4cfe31dfdbedfd9cedde5ac48feeaefddf88ea6b4e5b59cc4d3a95855c83518de23d94626438cc1482d711a34f125b6516480158b53130f1b035225792273

Download Submit
/storage/emulated/0/.am/dm/md/main_tools.md

Filesize
1.2MB

MD5
c81c51456766e174d6b23e17e56b3151

SHA1
2b8f21a13af6efdfe1bfa00c011ba6a1bc5d6f20

SHA256
79ceb49440a30e4e0b9ab83015384650cc535a1f54d457cf4a0873f9621c0822

SHA512
a88c8290d5804d10cbbe811eb3b041d122c66cb75b44c5095f3e03ebf90e8f39d58d6d7e20066df046e9999b3341337094336b35c987ed6af34852c8a049a13b

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
128B

MD5
341ba2fc357dad0bc740ceda41643036

SHA1
a262d8c84c7c8608708d4269077b7997a6d82ac0

SHA256
96fb83a80ebca67cfe7962659d2bc37818f753c23f0ab8fa39cdfe154aff334f

SHA512
06305d0ec0b09a63b61074cdf278a16ad993ccf5523821babc254d0aeda0b603a2bbd8c32ef36dcd7e197fd28f8f3d1fd6bd6611ac934293f38f058735e88a54

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
171B

MD5
04199de4d5356de1c7ae76e2eba70eb1

SHA1
0e44a441724e50621cf82f26aa5634ba81d7053d

SHA256
2b128a43261f26b2b767be24903e7ffaaa251ec0e2b0f215564e3ff4cd5a1b72

SHA512
56827b5dd716af1bd91accbeb411d9ecc83d7506fd843cd24a6dd28dd503933e69f5972c9ed6fc2eb56e78ba28ae592664636d5bebd6ded0da647b8c17157dcd

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
3KB

MD5
9f654a4514ef1763687256d718d2ed98

SHA1
a68a778af731415af1d3c526daef8164e6181916

SHA256
f4b65aebeee2a8de05214cd50a035fd064e25c946deef2f1b27da57424ebad7e

SHA512
1debf8653053c43d0001f3e1bdb0e08eb5156de3fef35f1ba84a2a7720a2182d1f9dbf4452a9779757e44600d1ba164da8b46d89cdf48db3d6881dc11622dcce

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
62B

MD5
689ccc148b28bad225258e905abaeccf

SHA1
00e707dc22cee7f82c78e06ff3c3ce2607330708

SHA256
279820818e35a830359955b7f820e3a3af5017aba14b5ffa90ff0a6a7db1d414

SHA512
6ebd0052ed1e30445e08fa0f2f334e559001cca6bdf20fa8c9eebf57afa9ad77574b2600cade7a7449e6a7f57a3a43ef452c4f562a189d969dfac52b6f36d3d1

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
70B

MD5
9a1a641dc94990351e50438e2a0b9918

SHA1
f30d852b4b9916ca6f1a5389d1488f0b036b0a7b

SHA256
7a788d84cbbd9b67c46361b5107ffbfac5d957206036049e5bfe62895a9d1221

SHA512
9eb49f54846f97619e1d4cbf10e54ec61f87dcb0e9b6296b5bc6ac065ff803b7b03fdc58376f42e534f77d58d13f4a0437e3326ccb5d7035ed0a0ef7bb904424

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
59B

MD5
094b14add047ef0301f847fbba4bb840

SHA1
84b93d839f56afa0980ded51950c44436b220cc6

SHA256
06cd4485faf040a1685411d0b83b645614259bd7e14047a41460347b20e81c06

SHA512
3f8c777702f016cc898bfa395d8db33ecdd286cb5a4227985fc6ba19ebbd9b8e3954c77e2f3a0509410d0143e757e9b9a19f6b814b87b3d6a5a8f3ea10a29b82

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
153B

MD5
dcc7ab4cf894d9ad4fcadbffd7fb954e

SHA1
4c98e75bf60589d59516030319f3973ad17d49d6

SHA256
ec9e9128aee5c98d2175b94f71f5357d68c4922d1099c455dca67cd230f77f25

SHA512
81f475fb1b5a8eda8ecda10cd328ef7a23718155f4565121e67e8f2a910bd26af8728d42b7f3855b6ef98c01bd4aa4e2e4f80bf5a326d924c8d8866087cf45f7

Download Submit
/storage/emulated/0/.am/log_.txt

Filesize
33KB

MD5
27323650bd50d14d36fffa191dc23013

SHA1
70f92055c6e508965b6278f14d30636aa6dc740f

SHA256
6f7e20059623839d9b229c2d9d084ab168e662dde1a090945a2b9db0c85395b3

SHA512
dfb8dd7f13ff6f0c251672adcb46cf319f1754adfc9aca7d0da8e918744d2232fe11a49b87ed95b6b9610fd210959b4aa4028f8409b67ec344f98d3dc0e2e009

Download Submit
/storage/emulated/0/.am/log_.txt.zip

Filesize
8KB

MD5
b67beef6363308804a4d7cfdc1ba1462

SHA1
806f7ae9460f5e3c183a01fe423f6d8c36e0ccc5

SHA256
77652a01a3a725c9598878b77f60a58e4acfcbaad11f9f9b9e54bc8d3d597d65

SHA512
a0df93c50c91a7e81ec8c1f3d2bfc4812b63173548ffe3856121d1b9defefa2cad1a53d0d74dcc031b302943892fb0c220fd7d87e84c1f7a81e30bdd0cc80a56

Download Submit
/storage/emulated/0/.am/log_1738377057198.txt.zip

Filesize
218B

MD5
01928e9624ee23027e2e41c04fe2659b

SHA1
02e7233054117bd9278ac8f90d0798456466eaea

SHA256
a0a0dc8f6d41af50e9f55862452a517345ccdba373620f4c7639a1988c0f5055

SHA512
d3d252987d43a969bbbe14a44bb74d7454ee14af2f447ba5f7a32eb59b543571f10ae0b83807f64239c998b82730d5b849a3beba9dafbcb4087ba21cbbf9f53a

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
78B

MD5
02a33fe89813f6da6310c3e84bf93f2d

SHA1
ed45da9761f0b68622171385ed2f31c1bd96ebc9

SHA256
d21d5e5e03f1f1d00dcb59ebf84f595e5c273c967da06e6306ac7035e6c620b5

SHA512
a99dd59f1b75951c0d60d07f7acc06d49f5ecc8842110ad8ee82343c63fa3f8d1e2dc585f75d6aa0e420bfabd3da56da195263b1c1a7bd4880d7a8a7643f4d0a

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
76B

MD5
82c9e18badb03758115eee83aaa469f5

SHA1
efac9ccaf736c5474a6f9b4637098a82b5fcf37e

SHA256
fa1c78d5179a7b2ccf361851a9b30c46018624975c146309d8d22e3dbb35a235

SHA512
0a2b08c0ee50238e25ad1a49356c643dcdb5832f5a46363dd306a91c57c76008b9752cdb786c1a839d513b86713996da91df54912caab6824fadc85e0dc2a0c8

Download Submit
Anonymous-DexFile@0xd1793000-0xd1a4d3c0

Filesize
2.7MB

MD5
fd1787b37bb2c8daead349360cb2b6d6

SHA1
ae98446bc912c5a95ca5ef3c1207daaf8cc97da4

SHA256
001b6ccbb7cce5f46e14b4e864a0c1aea678089704594eef8a4b229fdfc3aff7

SHA512
cb6908dc9a0ec87a087cc64ef9f1d48a9c63dc5c21991ce641575a9cf8d343cdafb9b799112dccaff0b439cdb366f1448f435b892fa5e9f4899dd78917c9964b

Download Submit
Anonymous-DexFile@0xd2411000-0xd253df24

Filesize
1.2MB

MD5
4768956e02a41b7e2032707b7c65a52a

SHA1
eb730a2e6f2b0497ee9731c488b02f0e68105942

SHA256
c50c0434ac58766df76b0ffb3fdd9489a6d8ea7b8789f0bfbb3fb78299a00060

SHA512
afae3c09e482e6577f4e79013b6d2dc1ce89a00a2ef5571074931da9bc91aceb53a01298dd3072325034ecd1ea0ec92dda630c06433dcd458ba7ac574778848c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads