andrmonitor | 4b4c1064e3994b59904749fb706c8dfdcc6a50c203694bb45a6d1b4ce11795b3

Resubmissions

13/03/2025, 18:19

250313-wx6snayzdz 10

13/03/2025, 16:23

250313-tvv72azm18 10

Analysis

max time kernel
36s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
13/03/2025, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a.apk
Size

20.8MB
MD5

459697ba8c760c82c9d2c84e2ebedd8a
SHA1

e7f531016d07ca6c8332e9a4071725a21837be40
SHA256

4b4c1064e3994b59904749fb706c8dfdcc6a50c203694bb45a6d1b4ce11795b3
SHA512

6ef8e8b9c60d6f801ef7035d87f540833ece3ada82613f63957a9a792b85ef29ebe41a40b4594fcf8257cb23784cd07ad6e392d2db9a9637e712f288c8ce4ddc
SSDEEP

393216:3xMU8OOsJA35z7A79L+eA31mbgafiubcEZrbRT9i/zVN2I+TXOlyKpPbNiRSKcsQ:32oJA35z7c54FmbBffcGrLi/zVN2Ik+j

Score

10^/10

andrmonitor banker collection defense_evasion discovery evasion execution infostealer persistence spyware stealth trojan

Malware Config

Signatures

AndrMonitor
AndrMonitor is an Android stalkerware.
trojan infostealer spyware andrmonitor
Andrmonitor family
andrmonitor

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	gzsiseqw.llrlhdvhbe
/sbin/su	gzsiseqw.llrlhdvhbe

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4217	gzsiseqw.llrlhdvhbe

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
Anonymous-DexFile@0xcf72c000-0xcf9e6514	4217	gzsiseqw.llrlhdvhbe
Anonymous-DexFile@0xcf1c5000-0xcf47f514	4217	gzsiseqw.llrlhdvhbe
Anonymous-DexFile@0xce6ba000-0xce7e6f24	4217	gzsiseqw.llrlhdvhbe

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	gzsiseqw.llrlhdvhbe

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	gzsiseqw.llrlhdvhbe

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs

flow	ioc
3	prog-money.com
5	anmon.name
8	andmon.name

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	gzsiseqw.llrlhdvhbe

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	gzsiseqw.llrlhdvhbe

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	gzsiseqw.llrlhdvhbe

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	gzsiseqw.llrlhdvhbe

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	gzsiseqw.llrlhdvhbe

gzsiseqw.llrlhdvhbe
1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Requests cell location
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
PID:4217
- su
  2⤵
  PID:4252

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB

Filesize
128KB

MD5
83f9d1be51c0ef0019952bd962f70f05

SHA1
8f9e2782d24b692b46e6aa8974e61fb6aa7d903e

SHA256
9623d7ebba654211ee8fe37878dba389a66331142db2401a66207d308d29528b

SHA512
586686fe26bac50335757548d758303a9adc54ccaf923f9ed977d05ffb927a4c406480b8fd8723a6d8adbad5d079843931d7b1d20aab2c369e88e6a62b928a53

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB

Filesize
100KB

MD5
437e613431bd05ed7b839797f4bd4d75

SHA1
e493b94b741b82a2a4db946342b0184a0df686ee

SHA256
273f60597823e6c52b415e19a41011903f47df857266353e9179c19325f6517a

SHA512
d19562ef40242bef114a4030d423627035e8e7a9cea4664fbb29d1596d96ecee8ba5e5b12da4e5bd66c145c40d1e5b2761f066a8902774f057d5cf04af6f28e2

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB

Filesize
60KB

MD5
b84ec3ac5c1e79f72c55ea19bb82f981

SHA1
2a911a0494b171906a25ce812a25847c9f550a2f

SHA256
cd2acafa436796594063fa7599247531a5a1faf91b5035d85bf692a395cd3841

SHA512
9faa7a08293d0d00f9d0ec1b8c217d86d99e938a0e81f6d0324befefaf8c3a4226a64c1f1ee44119c07035c643e46f7fab51b6421819f346619382bae75ad2fb

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB

Filesize
52KB

MD5
b6815b344f6926d458cea05acd052cdd

SHA1
88f524aff1d4c5fee979a203dd952427871a7097

SHA256
028666f28ae0086b18fb740f792e8a80ad05547f0c7cb9d2dc8080e5125db366

SHA512
0431375f80e9c467d0abb042e43681a973bce455fe8354f5a138f19a3b28d3adc7eac3fe4c20bf44f085810749569b87a393185cd8f8bf2687f0923b8de4dade

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB

Filesize
100KB

MD5
00340dff485a632dbaa2b6232975d1a0

SHA1
62045200ab1bc0a136142fee26c1718f42d75dec

SHA256
0fbe127ade0264d5864bb4bfa505c6f133982b627a45edd164452d2fd5b0ea35

SHA512
e60dca01c0301daf9cd19ba3bf6c32ca26f0ecf78ca4da70a42827e72a2bfdb4860a64f2c4f4ed68d6719f98d758ed0ae4c138ef0e3fbbbd6b6f572507120b43

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB

Filesize
148KB

MD5
4d731e2abb6e70601f0445e9c6416a13

SHA1
0a2c11993ea84f762cdc286d89aa23de5e2139eb

SHA256
9ebd9ac5fc354b9b6b29d3b0ce029a8bfda35cc7bc7e4fc2606ecffd8e259d27

SHA512
1906a0e2f19f499562a319135e3170d5553482015a60f2a2d2c474ffddf65adf212fdad37cf9e0ed873d22c091a95fdac661dd8443e8427e65b6bd265bd94650

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB-journal

Filesize
512B

MD5
a6cdadb409241a29261377467a5f3d80

SHA1
4fb33151739ef7dc1021ebf846bed6daa756305f

SHA256
c8305371d64e4b52d9ee3569e317c2de8b75b8b40d8ef5351fba43a2146eea9f

SHA512
0e913f8a6f87d593ceb941a5b3c1e8bfd4e7b25d6ed64f298dc8667bc07ea35cfbc9661676da6028ffbbc3185ffbfae444c124237b3dd2a41d44b74835466833

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB-wal

Filesize
410KB

MD5
300fbad9c0cade34c92760a9a94bbe74

SHA1
b0e167c9c18b67a62cf761fcbe473daac636cad9

SHA256
dcef40b8c7adb18491d0843c81c645a1c824f13027c97bf32a6a5413be43e4fe

SHA512
24461927d203599b0551bc630b8113f7e45201b043f37b6a1b84a60f0f35011118a8b350dc4311c2dadfebcd44ec298cddf659d4314744d671992a31bb081204

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB-wal

Filesize
8KB

MD5
192482497348ce43d187bdc93e2c4868

SHA1
ed74c543ad192d6a233e9485645c65013226ca0c

SHA256
80050375809badd68907f7ac67c7f404bee2bcfc8b0e572798d05c7f5dbf7dad

SHA512
ce59d42b07ff892f4824c3f1a77e9c0061274a271b2f74e1380b4500e04dda1d27f04edd7bfb557a5b4762ee9282e5a76ebb3b8440be4f07272b70fd4d335d6d

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB-wal

Filesize
4KB

MD5
b2770a52d36b129116f774823a250f7c

SHA1
516d0ab655855d6d3348d2551cfc79babd4fdb27

SHA256
bfbddc7f4001047526f8099681ab4611cca510e1be040707a38826a4152d64e8

SHA512
c27cc14d2e7bef5edd952692967062d7f20811fd78f63f1bcd74fae58062562d51e48f48a6d76395616f9ae354d059a5819ede9a199efa8e1270f360f06470f4

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB-wal

Filesize
4KB

MD5
992c0ef85c6108c60bd19c0f6f5606d8

SHA1
ab82d298cfaa943bf716916330b1a94f440d8758

SHA256
38c0de546bc73e8b3287f1a1a687815925c5ba9183c1632f6b370b621363da90

SHA512
2565b0a61521008e5083eadab730c748daa441e27bc3f17115c2e480a01f769316d52c3f8018d70e5d874aa60efaebe9ca57167f1ff3d48a308d69d09fd199cc

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB-wal

Filesize
8KB

MD5
9dfa3f1fe7156bd8aa33e61f7bc096e2

SHA1
47905e3465cea1c013936aa889666ac4f502feb0

SHA256
08ba58896b9cfe05bc798b7c0d3ec3874ecd9697257beb05eba36c6f2970b88e

SHA512
ff24bc49bd2e2f848515f94847171f0102398045b67720b4296c5ef13938329eb5894ebe7754ed9f4af3ae2420a48ded049f1ffcb447f0a03cf0412a90d2934c

Download Submit
/data/data/gzsiseqw.llrlhdvhbe/databases/SettingsDB-wal

Filesize
418KB

MD5
5b8c660084ac60d54333e5db4612c620

SHA1
5287427f02e85e2ca125aea81c206215c0ef26a7

SHA256
30ed97e4811c47fc1bd95f2390e8932dfd52f96da486a13aeae9f20268992ab1

SHA512
a60cebb7780ec8626e7fea82cf9c1f691e6b1b366da2fe1d0997cad2334f8de86890ec4cd0ad14f726975c1e6ed9552a3df115e6505e8d190e14915163615d9a

Download Submit
/storage/emulated/0/.am/dm/md/main.md

Filesize
2.7MB

MD5
3b8f44aab76b03f9ce67c3cf47025583

SHA1
600f55c2e141b15934f0cec78188911ca30c50b5

SHA256
a9306e582190a99b965bacce7a58f74442c59a6ba2ef33c29ef5202afc6a99f4

SHA512
a908c09a2215ff5b6ef4abe9ddf82a7631a011bf6657b7767e5d41178b333314b9c124d70a5c91a7a8ea7cf83d38ad8608ce21d8ff2cc82cd7717340f9a57d61

Download Submit
/storage/emulated/0/.am/dm/md/main_tools.md

Filesize
1.2MB

MD5
c81c51456766e174d6b23e17e56b3151

SHA1
2b8f21a13af6efdfe1bfa00c011ba6a1bc5d6f20

SHA256
79ceb49440a30e4e0b9ab83015384650cc535a1f54d457cf4a0873f9621c0822

SHA512
a88c8290d5804d10cbbe811eb3b041d122c66cb75b44c5095f3e03ebf90e8f39d58d6d7e20066df046e9999b3341337094336b35c987ed6af34852c8a049a13b

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
134B

MD5
d088c61e5442087bcccf40977b3254b1

SHA1
ff49b37e7edfbc14cfcfef8da69d61b17ebe390f

SHA256
bce2cb5616eaed03071b5084eb7c84e0856feb4d7b5832d2146831b569ffef28

SHA512
16bb36b364336ecceb05ca7c3e6d93eb68b05bf5e777f5fbd8b1eb8d246e538f17e8523695efa2cb115223f45b309958503512c901cd213500d047f60f6789ba

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
171B

MD5
c63b2d07b3784df54d74a7dd663765b9

SHA1
a7122ae84201158de8eb89cc13846aa9d130ed39

SHA256
0ccc90ee99fc3706ba4995c4705f88af90d7fdfd9b7fe8f27d8b47a76034428f

SHA512
92a475d35a62225db8ea30de4464d051cc89e199dd6a53237f4087db1c69113484c2efe2e410616e2107c67ce273661551f5c5fd0a757c129ccbab14a9e990ae

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
3KB

MD5
cca4f50ff46c3c84b24ac434c9bcb1a5

SHA1
99b9788b7ccf3900f1f201f622baa8f7d2eb38ac

SHA256
e49c2448c02a790fd630b98664226858ec1dfe45e682b3e74210b7e39a5a79c3

SHA512
ff5d8f56ed864ef7a1d0916b0503f82846d53436e46c551aeb30fffb39a77d7258f380fcd9c759a6664ae1b8aefc802ddcb201ec93014f20588b924fa67cbac2

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
62B

MD5
1004b038528c7d9ff4cb3b0ae528dfa2

SHA1
9c6419149aa0674c6c2d1a845d13ee43d00d9ef8

SHA256
f584462bef859e4970faae3df5188b92a30675659963878cc33b63debf7c00ce

SHA512
5ae78c86a99b30b3a4ee88f6e2bd205c3ef7a3c1b40ef54b16e77005f6f8a2226c50ea6136e5bb79894a8844f06779b15ec98205488b98ddb6da744345c2d51f

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
70B

MD5
ef8e4f7f3211f53db9566330a9a4bf35

SHA1
e0319aad47732c2ebb212376e0b070f45ad32e32

SHA256
769cdb7f3de1a9a66c502ba108f2067f032fbe8146aa8f32524683507ae762f6

SHA512
c6fdd3bee2311d760bdba9923dcd19ef2bdfcb4d274ef42c89428131b9a5d2e060dd08be40be8f603cd43a39ef9fbce3ecb11ac2b5c7352c9d37c0ffa97c00b2

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
59B

MD5
93fd74525eee2d2215ae7bb88cb386ce

SHA1
00142015076a8ca30a4c5bbe6fd6ef572af5a979

SHA256
5d45ebea034b30fb94f133b07bf1f65b646a610b83bd1187a7f18e2d4c8275f7

SHA512
d5a4588be0787bc808377970122c981842a46cea512f8e100b2a574d33da3a47be7e360840d20bba8cd009b482263e62e0d0eec851e24d0bf85c966411f25ebf

Download Submit
/storage/emulated/0/.am/log.txt

Filesize
165B

MD5
1c310e8deac03fe29a01556b75185544

SHA1
b8dc172226da22ec541fa0049b415e66decc5e35

SHA256
a6ff9d8339eb2631f9eac0fb4d949ae27e74ec2d48425b42cd2e22f2fe7943a4

SHA512
5272c84b23b0b7ee5039009c6aa77c127abf0cd5e2fd712a79ecfdd61320b1f5d06afe866bbdfb1c2b1e4efe1926c5c0cb627ca3cddf7ba414dab7e4dc9cd137

Download Submit
/storage/emulated/0/.am/log_.txt

Filesize
40KB

MD5
cdd1740c21eb4b6401c03be4a7872c93

SHA1
536007fc962abfbfcb56ea65b57e46b7446bdcd4

SHA256
1e0bc4cea0a58d8f4301347b1df432098ce2e993db918f134a33ba44c39ef8f3

SHA512
2a06de0e2868755ccb194a34ec5eb48b78a2cde5a9d0eb3f90383c1c2ee4575f4632a1e7627ddf2505ddc0beb458a8027dac6b196781ab9c6b0167cd363bfae7

Download Submit
/storage/emulated/0/.am/log_.txt.zip

Filesize
8KB

MD5
8eb8507c6563407ee146f6a2b28ee132

SHA1
04aa9372ae342f7b4371516f37267fc95ab24493

SHA256
0b86563b77ab7ab69e7038c9de4435dff674aeea9c9007285a1f68791ff25b25

SHA512
483c2f499ff52cf37f75a824f71e0bbbc739c8630f2e2637572f8a9a557176522c58f39708be9b2baaad034735a0bf61f47d99648abac105452d8e2840d0493e

Download Submit
/storage/emulated/0/.am/log_1741889964487.txt.zip

Filesize
217B

MD5
b7047858c702f8bffd8779301f0bd4cf

SHA1
b0ede62b3367c9f1d85f6ddd0277381ea2b1835c

SHA256
6fa2a4a1fc693a8f2fbbc33cfdfba12311327133b4098432543ea69199416761

SHA512
27c583d6540f5e0abe46fd1b07f88197d88eab617079e730bc2453c1c90101eb728d9dc1a79c07ab37118b09274a6b3bf089b5e7123966a030de526c8ae7449b

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
96B

MD5
9a7b2f3009638ea69bdc6a039140c59d

SHA1
7538e55dbfa9a4abff83e69ed179eedb9ffb8fa6

SHA256
e43c028722f303535f437e3e707dd68d2b1f312ea171dd10c5a72383d1e80227

SHA512
3e31af0f2de1d5c76b2cbc93cd0c2fa971f09c641b65c48e153c4ad8a096687706a44d3e8d18f412117699d102a3f642407dbf34146203bf2d496d9b44b0ff11

Download Submit
/storage/emulated/0/.am/prog_class.name

Filesize
94B

MD5
9ce04389dadce7e24c45bd0f7f251293

SHA1
d4496348f5648eb78b755d0eb4dca409f40d95da

SHA256
efd3040779dd20bec6946d2c0ad66ffcf7ed7a95c1c7787c1321f43d4a39404b

SHA512
c280ab057e73993c0cbcf46b106c63110dfcf65e4f44365a56e233a4642dc3037ca693ce33a3cb50af6f31c0dfdb2b10f85ff756e50f71afe899c105f9c33c5d

Download Submit
Anonymous-DexFile@0xce6ba000-0xce7e6f24

Filesize
1.2MB

MD5
4768956e02a41b7e2032707b7c65a52a

SHA1
eb730a2e6f2b0497ee9731c488b02f0e68105942

SHA256
c50c0434ac58766df76b0ffb3fdd9489a6d8ea7b8789f0bfbb3fb78299a00060

SHA512
afae3c09e482e6577f4e79013b6d2dc1ce89a00a2ef5571074931da9bc91aceb53a01298dd3072325034ecd1ea0ec92dda630c06433dcd458ba7ac574778848c

Download Submit
Anonymous-DexFile@0xcf72c000-0xcf9e6514

Filesize
2.7MB

MD5
5907bdc6596cfe0108c63176fefd23c4

SHA1
c4d71fe62de457f85bf8e084b0ed76090c92fca6

SHA256
398a1da4927ee13b67fda9f440b013bedd7169db36925ef057ae06ec1dd64094

SHA512
bbd04701e9652928ebf45468b027c211470c4cccc9333e644f42f27e97e4df2ebb4dd9301e35a7d4d744f570b9ad11951ba871f9812fcd6f85472c6f9dc42a44

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads