tispy

General

Target

WiFiService.apk
Size

3.2MB
Sample

240518-cnzs7sfe66
MD5

94930cf08fee0b858b8602a00fa26615
SHA1

75fd467e593c1bf0f0de37df074e378f64154b36
SHA256

949db2c48108a3d805ccf2fc0651555ac61cb55e8fea56f95ae624774f0298b1
SHA512

fc51e3326689f9f5957478af30f9032a15514cec41fd40c3f3d23a50c491910a6750bdcbe2711397971bcb07c114b0d0820132b8d2d4384b6087096442cf1f28
SSDEEP

49152:h0Vh6nA8syPUypQSDI80L8Vp5g5dOXQaTa0sx3C6objWipCKOcEIQo6Y1dZH3:h0VQnt5PPBI8VbU6la0s3C66yoSCuY7Z

Score

10^/10

Malware Config

Extracted

Family

tispy

C2

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_18May24&rtype=T

Targets

- Target
  
  WiFiService.apk
- Size
  
  3.2MB
- MD5
  
  94930cf08fee0b858b8602a00fa26615
- SHA1
  
  75fd467e593c1bf0f0de37df074e378f64154b36
- SHA256
  
  949db2c48108a3d805ccf2fc0651555ac61cb55e8fea56f95ae624774f0298b1
- SHA512
  
  fc51e3326689f9f5957478af30f9032a15514cec41fd40c3f3d23a50c491910a6750bdcbe2711397971bcb07c114b0d0820132b8d2d4384b6087096442cf1f28
- SSDEEP
  
  49152:h0Vh6nA8syPUypQSDI80L8Vp5g5dOXQaTa0sx3C6objWipCKOcEIQo6Y1dZH3:h0VQnt5PPBI8VbU6la0s3C66yoSCuY7Z
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- TiSpy payload
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
behavioral1