Analysis

  • max time kernel
    47s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    16-05-2024 02:04

General

  • Target

    bde78e6216ed553141aacd4e0d53383cdaacc61e055b3d3417a756312d19cb42.apk

  • Size

    2.4MB

  • MD5

    59aa2769b40f6241455cd9ffdde817bc

  • SHA1

    8614d972b4acd18261edc8d4bd4cec8763ffb398

  • SHA256

    bde78e6216ed553141aacd4e0d53383cdaacc61e055b3d3417a756312d19cb42

  • SHA512

    8339e42f05db3773d071cd8401d0332b945e9e4bc399803bded597b21c086e2e7f867d783ea3316f13a3d7fa4ef850911223306ee5303429940bcb144264f6b3

  • SSDEEP

    49152:s/6CEh/SZaea0RO8i7jy8/tuUK9zp/96U3NnM/QT7:K6x8Zba0RO823Aeci/07

Malware Config

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs

Processes

  • com.uryenovh.zlmdckww
    1⤵
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:4274
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uryenovh.zlmdckww/files/dex/gNXBwpMVtRVMPYmml.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.uryenovh.zlmdckww/files/dex/oat/x86/gNXBwpMVtRVMPYmml.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4301

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.uryenovh.zlmdckww/databases/privatesms.db

    Filesize

    16KB

    MD5

    3621ce0aa81e37bc5c80e2cf881f1dd0

    SHA1

    00365f82dcada94caea07443656848baf60b3bd9

    SHA256

    8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

    SHA512

    76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

  • /data/data/com.uryenovh.zlmdckww/databases/privatesms.db-journal

    Filesize

    512B

    MD5

    8eb150d0fdbe6a62ea5de4d9c4e5d0cb

    SHA1

    3b90e22c01164bc0b4bf75b9c4620ac536d5b08d

    SHA256

    7b6f23031750a03105e61e57d834176d11c87337b4fcb69710353b1ea71d9f3d

    SHA512

    174f0b7be7b5b6401b57886512b8378e15006763b532c6f98a775fad75a9fcb9cfda0b412bc0619c2469539d1ccd13edd0b51d54a348ed96346aed99e77e055d

  • /data/data/com.uryenovh.zlmdckww/databases/privatesms.db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.uryenovh.zlmdckww/databases/privatesms.db-wal

    Filesize

    28KB

    MD5

    1b201a439c58c4112bf51299ad4bf6f5

    SHA1

    9cdf3d0e048f6a04246f6b2e183296a8e01c8a27

    SHA256

    26e80a39650262c97ec995834d11c4e5c95f3f8b1f9408ac910356b599a4a796

    SHA512

    525d96edbd92f8527a916144a045515402b3172ba41b71d88db1f9c63dc0a637b2442351cf19c9a821ebd589a8e181a428a765d7544d3b1ead774f43ebc5336a

  • /data/data/com.uryenovh.zlmdckww/files/476615.so

    Filesize

    145KB

    MD5

    402c1c1e51a3067d85ee1583b0f6821e

    SHA1

    32046445a54f127d883ca27dad0de9e031dd62a8

    SHA256

    248ef771b4309dca9cb6461e20681cf0499d3f30a560e92710e1394aae662d9c

    SHA512

    886d03db4f8c37e3d557d7559ac6910d144f5a058e7133660c28f450b5c2701b72e2057c24d83588c76de19f97467f8ac03a74ea17c6f72b2a05c679a1048428

  • /data/data/com.uryenovh.zlmdckww/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg

    Filesize

    3KB

    MD5

    4651e1fd4234ee465d6fe6349f2e178d

    SHA1

    1a86fbd1edd11fa983155172d484959760c1fc0e

    SHA256

    725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

    SHA512

    6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

  • /data/data/com.uryenovh.zlmdckww/files/dex/gNXBwpMVtRVMPYmml.zip

    Filesize

    532KB

    MD5

    304a0906938aefc14dfb1ddbbbcb4f75

    SHA1

    8d9c9910e6b5803a0124e37edf29e0e4e91ac1da

    SHA256

    628b49d39f80452786270ad9bee88a42dda7ab154d60b197c12ff16ba0674ec3

    SHA512

    13d9dddbc0f5a17913096f04b58ebceb62991d34741cc89687353cd9b99ab6fa7701a239eeffaa444475be622afb629fc49f3cea66aae1004e512022a6e53265

  • /data/data/com.uryenovh.zlmdckww/logs/Sistema1715825094245.log

    Filesize

    17KB

    MD5

    38c69481f070bc4c9449ea0d0a091b06

    SHA1

    b18d4b218fed9f9586014d7252b9386b72d450a1

    SHA256

    cb9bfc6db00564e34e5fa70b234662255d473909bc8bc8456c0858bd8dcda4c9

    SHA512

    0338664e5cfbe999dcd72532a6e82c24f26b262577fbd9b3297a91ee1984927fec1c21f272c6188c7bea4b14c06cc614de6617080b76fb055ba872e2bebb5f2f

  • /data/user/0/com.uryenovh.zlmdckww/files/dex/gNXBwpMVtRVMPYmml.zip

    Filesize

    1.3MB

    MD5

    aba8a2b1761f63c17d01b6d0229552fc

    SHA1

    284ee3c9211a75e0198ca61a44218f7f0736d689

    SHA256

    424aaf943cc236e930e5c71f9d11255ae23cc9cb2f6f816e10e41d98ef9ae520

    SHA512

    e027bf7be9310ecb7fe94a593cd79c302d4afd7c2266caf51509cb6e046e82912ec2b513f8a23ee8be070f932cf2ce7eb44cc3d723f643062e57a94fd8d6c83c

  • /data/user/0/com.uryenovh.zlmdckww/files/dex/gNXBwpMVtRVMPYmml.zip

    Filesize

    1.3MB

    MD5

    fdd1432f89433b9d195ab2fdb069fb5e

    SHA1

    a912a1e78bf3863aa5d5e3fdc21a1a3bd24d7fe2

    SHA256

    9bd76d9e28103f27f560138c4f4a400d8b4b89ab07de44285d3528014086f03e

    SHA512

    cad286a3b2fa1baaa7ea55e25d57969c10ab3149fd41d9ed2e62351d66ea5bedf1650ce07f79616e1a18d6c1122585283894f1b857d41dbb9cbeeb646f0f3221