Stalkerware

iKeyMonitor

iKeyMonitor is a stalkerware family tracked by GuestSpy under danger code GS-STK-AND-3041.

iKeyMonitor is a stalkerware family: software built to monitor a phone without the owner knowing. It typically hides its icon, runs at boot and sends messages, call logs, location and media to a web dashboard that the person who installed it logs into.

Danger codeGS-STK-AND-3041
ClassStalkerware
PlatformAndroid
Known samples7
Package names (8)
  • com.android.internet.a20200817
  • com.android.internet.a20210916
  • com.android.internet.a20220729
  • com.android.internet.a20220829
  • com.android.internet.a20220914
  • com.sec.android.internet.im.service.im20190118
  • com.sec.android.internet.im.service.im20190419
  • com.sec.android.internet.im.service.im20210815
Signing certificates (SHA-1) (9)
  • C1D83F5FFE3EC319FF103EC7346CDDF218B5634D
  • 4DAD108F915E237CA2834FAC70C077AD8105E804
  • B8F5FDFAE5920C4CFB6ACE214D39327F299FA76D
  • 9284CB43B87E9F9C77DA509F1672E884BD6CA876
  • 786325AB3E614F868CA2A7F2F0E75EC76A047311
  • F747F0BBEF33FFEE6AFC4E7CFA03B28215985F24
  • 0C422F0025F866C311DF61A7549FCD519683898D
  • 98ED5841256A44FB1525FE154C0516ACED82FFF3
  • ACB2CA50376456FD81B5C6C19CF6D717CFBB888B
Domains (dashboard, download, C2) (10)
  • easemon.com
  • 83dd4.appspot.com
  • awsapi.io
  • em.awsapi.io
  • ikm.awsapi.io
  • emcpanel.com
  • users.easemon.com
  • ikeymonitor.com
  • ikeymonitor.fr
  • users.awosoft.com
IP addresses (9)
  • 172.67.82.183
  • 104.25.170.109
  • 104.25.169.109
  • 104.26.15.56
  • 172.67.73.2
  • 104.26.14.56
  • 172.67.194.85
  • 104.18.54.129
  • 104.18.55.129

How GuestSpy detects it

The Web Scanner and the GuestSpy apps match this family on up to five levels of evidence. Any one of them is enough for a verdict; the stronger the level, the higher the confidence shown in the report.

  • Exact file hash: 7 known samples (SHA-256).
  • Signing certificate: 9 developer certificate fingerprints. A rebuilt or renamed APK signed with the same key is still caught.
  • Package name: 8 known package identifiers.
  • Network indicators: 10 domains and 9 IP addresses used for its dashboard, downloads or command-and-control traffic.
  • Behaviour rules: the heuristic rules (GS-R-0xx) that catch hidden icons, accessibility abuse, device-admin persistence and surveillance permission combinations, which also catch new builds that have not been seen before.

If GuestSpy reports this on your phone

Safety first. Removing monitoring software can alert the person who installed it. If that person could hurt you, make a plan before you remove anything: talk to someone you trust, a local domestic-violence service or the resources at stopstalkerware.org. In the US the National Domestic Violence Hotline is 1-800-799-7233.
  1. Preserve evidence if you may need it: screenshots of the app, its permissions, the report from GuestSpy, dates.
  2. Remove device-admin rights: Settings › Security › Device admin apps (names vary by manufacturer). Deactivate the app so Android lets you uninstall it.
  3. Revoke accessibility and notification access: Settings › Accessibility › Downloaded apps, and Settings › Notifications › Device & app notifications / Notification access.
  4. Force stop and uninstall from Settings › Apps. If "Uninstall" is greyed out, use Safe mode or adb shell pm uninstall -k --user 0 <package>.
  5. Check accounts and sharing: unknown Google accounts, Find My Device sharing, Family Link, work profiles.
  6. Re-scan with GuestSpy, then change your passwords from a device you trust and turn on two-factor authentication with an authenticator app.

The full walkthrough is in the Android removal guide and the iPhone guide.

Indicators are drawn from the open-source stalkerware indicator database maintained by Echap (CC-BY 4.0) and from GuestSpy research. Indicator lists are never perfect; if you believe an entry is wrong, use the community report form on the scanner page.