Analysis
-
max time kernel
47s -
max time network
139s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
17-05-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
bde78e6216ed553141aacd4e0d53383cdaacc61e055b3d3417a756312d19cb42.apk
Resource
android-x86-arm-20240514-en
General
-
Target
bde78e6216ed553141aacd4e0d53383cdaacc61e055b3d3417a756312d19cb42.apk
-
Size
2.4MB
-
MD5
59aa2769b40f6241455cd9ffdde817bc
-
SHA1
8614d972b4acd18261edc8d4bd4cec8763ffb398
-
SHA256
bde78e6216ed553141aacd4e0d53383cdaacc61e055b3d3417a756312d19cb42
-
SHA512
8339e42f05db3773d071cd8401d0332b945e9e4bc399803bded597b21c086e2e7f867d783ea3316f13a3d7fa4ef850911223306ee5303429940bcb144264f6b3
-
SSDEEP
49152:s/6CEh/SZaea0RO8i7jy8/tuUK9zp/96U3NnM/QT7:K6x8Zba0RO823Aeci/07
Malware Config
Signatures
-
TiSpy
TiSpy is an Android stalkerware.
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.uryenovh.zlmdckwwdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.uryenovh.zlmdckww -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.uryenovh.zlmdckwwdescription ioc process File opened for read /proc/cpuinfo com.uryenovh.zlmdckww -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.uryenovh.zlmdckwwdescription ioc process File opened for read /proc/meminfo com.uryenovh.zlmdckww -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uryenovh.zlmdckww/files/dex/gNXBwpMVtRVMPYmml.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.uryenovh.zlmdckww/files/dex/oat/x86/gNXBwpMVtRVMPYmml.odex --compiler-filter=quicken --class-loader-context=&com.uryenovh.zlmdckwwioc pid process /data/user/0/com.uryenovh.zlmdckww/files/dex/gNXBwpMVtRVMPYmml.zip 4306 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uryenovh.zlmdckww/files/dex/gNXBwpMVtRVMPYmml.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.uryenovh.zlmdckww/files/dex/oat/x86/gNXBwpMVtRVMPYmml.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.uryenovh.zlmdckww/files/dex/gNXBwpMVtRVMPYmml.zip 4276 com.uryenovh.zlmdckww -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.uryenovh.zlmdckwwdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.uryenovh.zlmdckww -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
com.uryenovh.zlmdckwwdescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults com.uryenovh.zlmdckww -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.uryenovh.zlmdckwwdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.uryenovh.zlmdckww -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.uryenovh.zlmdckwwdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.uryenovh.zlmdckww -
Acquires the wake lock 1 IoCs
Processes:
com.uryenovh.zlmdckwwdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.uryenovh.zlmdckww -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.uryenovh.zlmdckwwdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.uryenovh.zlmdckww -
Reads information about phone network operator. 1 TTPs
Processes
-
com.uryenovh.zlmdckww1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4276 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.uryenovh.zlmdckww/files/dex/gNXBwpMVtRVMPYmml.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.uryenovh.zlmdckww/files/dex/oat/x86/gNXBwpMVtRVMPYmml.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4306
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD53621ce0aa81e37bc5c80e2cf881f1dd0
SHA100365f82dcada94caea07443656848baf60b3bd9
SHA2568620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA51276bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
-
Filesize
512B
MD5dbf07b1723da4b3dbee8f5e82ceeba00
SHA1ca372cc3299da049b7d44e93f0f428ff500f133b
SHA25613cfc0756fa3f1e1430dc26e5a238291dce285892b2eb28680b0b52be634fde0
SHA512e9b60057f9da45868b88654645ac6e228d707744b7226c87c524285d6ac4ab917ea01ec8f99273598bfc18382134e22fe2b306007b0422b98af033489015cd3e
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
28KB
MD50da2d885389a168d44d4f5bce84896e8
SHA19d89860d90512e2e1cd811a0b96ccc9f870be706
SHA256bf442f5c244634010de9cb3d68461f659fa3544d27a2dc00c79c9641495e004a
SHA5123704d9b1312286fcda47f2fd6a4104de6510bb6caa1d157f79be32d220652b40a5144cbda616a45fe844895feac588b02baf6b7c07df964f810ed6d7c3a766aa
-
Filesize
145KB
MD5402c1c1e51a3067d85ee1583b0f6821e
SHA132046445a54f127d883ca27dad0de9e031dd62a8
SHA256248ef771b4309dca9cb6461e20681cf0499d3f30a560e92710e1394aae662d9c
SHA512886d03db4f8c37e3d557d7559ac6910d144f5a058e7133660c28f450b5c2701b72e2057c24d83588c76de19f97467f8ac03a74ea17c6f72b2a05c679a1048428
-
Filesize
3KB
MD54651e1fd4234ee465d6fe6349f2e178d
SHA11a86fbd1edd11fa983155172d484959760c1fc0e
SHA256725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b
SHA5126962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c
-
Filesize
532KB
MD5304a0906938aefc14dfb1ddbbbcb4f75
SHA18d9c9910e6b5803a0124e37edf29e0e4e91ac1da
SHA256628b49d39f80452786270ad9bee88a42dda7ab154d60b197c12ff16ba0674ec3
SHA51213d9dddbc0f5a17913096f04b58ebceb62991d34741cc89687353cd9b99ab6fa7701a239eeffaa444475be622afb629fc49f3cea66aae1004e512022a6e53265
-
Filesize
17KB
MD563c2ac9700fc59ef1dadcb711bb0ba45
SHA10c41182b314f50ed372daf638785a73d01a2e80d
SHA256837fcc64be1c613f6b1eccf66baa6b26f6497eb9f3b09e4e1d15742312b1d3e8
SHA512729eeeae1efe56b111091cb610afa1ecac3686960463345ca27e613b47e465407e79a700f24afe270cea02d249d7659c61dc040970b8d0b0d216a407beca2527
-
Filesize
1.3MB
MD5aba8a2b1761f63c17d01b6d0229552fc
SHA1284ee3c9211a75e0198ca61a44218f7f0736d689
SHA256424aaf943cc236e930e5c71f9d11255ae23cc9cb2f6f816e10e41d98ef9ae520
SHA512e027bf7be9310ecb7fe94a593cd79c302d4afd7c2266caf51509cb6e046e82912ec2b513f8a23ee8be070f932cf2ce7eb44cc3d723f643062e57a94fd8d6c83c
-
Filesize
1.3MB
MD5fdd1432f89433b9d195ab2fdb069fb5e
SHA1a912a1e78bf3863aa5d5e3fdc21a1a3bd24d7fe2
SHA2569bd76d9e28103f27f560138c4f4a400d8b4b89ab07de44285d3528014086f03e
SHA512cad286a3b2fa1baaa7ea55e25d57969c10ab3149fd41d9ed2e62351d66ea5bedf1650ce07f79616e1a18d6c1122585283894f1b857d41dbb9cbeeb646f0f3221