Overview

overview

10

Static

static

10

prog.apk

android-9-x86

10

prog.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    prog.apk

  • Size

    20.5MB

  • Sample

    240301-cc9t2aad64

  • MD5

    3306391950192abec178615e5dfcee53

  • SHA1

    73d7d97fa7943be3fb1a09021579de25f101d6f8

  • SHA256

    4b38232db89ffc202f41fee493a84b056f1115339439efb6635d170e05bfa85b

  • SHA512

    67e19e7dbaec8d102cd41a693a86203bf1b2ca4147d29b5d4d5b30e24969d937c1e3ef67f88ad1ecfee75fdd80ef5849ce56d10d55f9abec58f6933063932ddb

  • SSDEEP

    393216:oyNMhsJA35z7A79L+oIv1mbgafiubcbZLbhT9i/zVN2I+TX296KpPbNiRSKcsgJk:jM6JA35z7c5KtmbBffcFLbi/zVN2Ikm4

Score
10/10
andrmonitorandroidbankercollectiondiscoveryevasioninfostealerspywarestealthtrojan

Malware Config

Extracted

Family

andrmonitor

C2

https://anmon.name/mch.html

Targets

    • Target

      prog.apk

    • Size

      20.5MB

    • MD5

      3306391950192abec178615e5dfcee53

    • SHA1

      73d7d97fa7943be3fb1a09021579de25f101d6f8

    • SHA256

      4b38232db89ffc202f41fee493a84b056f1115339439efb6635d170e05bfa85b

    • SHA512

      67e19e7dbaec8d102cd41a693a86203bf1b2ca4147d29b5d4d5b30e24969d937c1e3ef67f88ad1ecfee75fdd80ef5849ce56d10d55f9abec58f6933063932ddb

    • SSDEEP

      393216:oyNMhsJA35z7A79L+oIv1mbgafiubcbZLbhT9i/zVN2I+TX296KpPbNiRSKcsgJk:jM6JA35z7c5KtmbBffcFLbi/zVN2Ikm4

    Score
    10/10
    andrmonitorbankercollectiondiscoveryevasioninfostealerspywarestealthtrojan

    • AndrMonitor

      AndrMonitor is an Android stalkerware.

      trojaninfostealerspywareandrmonitor

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Acquires the wake lock

    • Queries the unique device ID (IMEI, MEID, IMSI)

      discovery

    • Reads information about phone network operator.

      discovery

    • Requests cell location

      Uses Android APIs to to get current cell information.

      collectiondiscovery

    • Requests dangerous framework permissions

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks