General

  • Target

    4e3e24dcd83d8ab0fcedb625bbc4ed75b99161cf0bc60153fa4ebbf13d60636a

  • Size

    3.2MB

  • Sample

    240510-ckapxaga63

  • MD5

    ce48f58dbae28bcb25677b8add0ddf64

  • SHA1

    e868c6fcaff35940e338e86e41494aea88797aa8

  • SHA256

    4e3e24dcd83d8ab0fcedb625bbc4ed75b99161cf0bc60153fa4ebbf13d60636a

  • SHA512

    367fd782ca81ac3c5a58f21d1615a6a60776773f6db24caa47a6e5267e83d474c2f7504bb7ff0e06455760d209a598138ad0496c82849825e018763ca67ae7d9

  • SSDEEP

    98304:P3/ynojPcxrkRN+wsKUHAUrFPW9/cZ+OEf:P6ojkxrkahFPW9/hOEf

Malware Config

Targets

    • Target

      4e3e24dcd83d8ab0fcedb625bbc4ed75b99161cf0bc60153fa4ebbf13d60636a

    • Size

      3.2MB

    • MD5

      ce48f58dbae28bcb25677b8add0ddf64

    • SHA1

      e868c6fcaff35940e338e86e41494aea88797aa8

    • SHA256

      4e3e24dcd83d8ab0fcedb625bbc4ed75b99161cf0bc60153fa4ebbf13d60636a

    • SHA512

      367fd782ca81ac3c5a58f21d1615a6a60776773f6db24caa47a6e5267e83d474c2f7504bb7ff0e06455760d209a598138ad0496c82849825e018763ca67ae7d9

    • SSDEEP

      98304:P3/ynojPcxrkRN+wsKUHAUrFPW9/cZ+OEf:P6ojkxrkahFPW9/hOEf

    • TiSpy

      TiSpy is an Android stalkerware.

    • TiSpy payload

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Queries the mobile country code (MCC)

    • Queries the phone number (MSISDN for GSM devices)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Checks if the internet connection is available

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks