tispy

General

Target

bac466da56f0c61f8bd7fc4c7e4a52395c32183c2e855e48e7c44724b39e2d0a
Size

3.2MB
Sample

240517-ckyrqscf61
MD5

473018b7cfd7de294d7f7b6cccd84ed4
SHA1

0ed5214a52ba8a0db3b067c8274d6e0640262416
SHA256

bac466da56f0c61f8bd7fc4c7e4a52395c32183c2e855e48e7c44724b39e2d0a
SHA512

ac8d5e5e1014c4570bc28668b6af796435d3377d6f84fd130d8a73151e0b56f98f5b97c61cc3212a5c32ad1e4f6a580ce25e057b34ceff37465c72dec365aa74
SSDEEP

49152:x/zFchcWnA2wqs/+PewZzJbCMlsFufhast8VflSHv/3n1scdx3hqFWIFlRoU7z:x/zFcDnTts/+PewZnskastwNSXaqmoa

Score

10^/10

Malware Config

Extracted

Family

tispy

C2

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_17May24&rtype=T

Targets

- Target
  
  bac466da56f0c61f8bd7fc4c7e4a52395c32183c2e855e48e7c44724b39e2d0a
- Size
  
  3.2MB
- MD5
  
  473018b7cfd7de294d7f7b6cccd84ed4
- SHA1
  
  0ed5214a52ba8a0db3b067c8274d6e0640262416
- SHA256
  
  bac466da56f0c61f8bd7fc4c7e4a52395c32183c2e855e48e7c44724b39e2d0a
- SHA512
  
  ac8d5e5e1014c4570bc28668b6af796435d3377d6f84fd130d8a73151e0b56f98f5b97c61cc3212a5c32ad1e4f6a580ce25e057b34ceff37465c72dec365aa74
- SSDEEP
  
  49152:x/zFchcWnA2wqs/+PewZzJbCMlsFufhast8VflSHv/3n1scdx3hqFWIFlRoU7z:x/zFcDnTts/+PewZnskastwNSXaqmoa
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- TiSpy payload
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
behavioral1