General

  • Target

    7af1f390b64437d0a16980897a480b906d2a9d94c394d86c0855aa1012ad3c9b

  • Size

    2.4MB

  • Sample

    240519-cg13pada52

  • MD5

    33eb52bbb721d4502ab114d4e4bac5c2

  • SHA1

    9a34d8d8ef1cee54738773d7b6ffcb276997a8a2

  • SHA256

    7af1f390b64437d0a16980897a480b906d2a9d94c394d86c0855aa1012ad3c9b

  • SHA512

    d146f5046a9455e9b1b388b17bc7c7d8798dc82c98f2691bd3ac40dba4bbc610fc7a0650e08e2187ff85b3479180502fc6ef5c588b19faf42bad22d41d0a418f

  • SSDEEP

    49152:Nec8pt3S9Knxo3MoZhOEyUvduVwuy716cfiZrS:NerLi9Knm3rKSwikc6tS

Malware Config

Targets

    • Target

      7af1f390b64437d0a16980897a480b906d2a9d94c394d86c0855aa1012ad3c9b

    • Size

      2.4MB

    • MD5

      33eb52bbb721d4502ab114d4e4bac5c2

    • SHA1

      9a34d8d8ef1cee54738773d7b6ffcb276997a8a2

    • SHA256

      7af1f390b64437d0a16980897a480b906d2a9d94c394d86c0855aa1012ad3c9b

    • SHA512

      d146f5046a9455e9b1b388b17bc7c7d8798dc82c98f2691bd3ac40dba4bbc610fc7a0650e08e2187ff85b3479180502fc6ef5c588b19faf42bad22d41d0a418f

    • SSDEEP

      49152:Nec8pt3S9Knxo3MoZhOEyUvduVwuy716cfiZrS:NerLi9Knm3rKSwikc6tS

    • TiSpy

      TiSpy is an Android stalkerware.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Queries the mobile country code (MCC)

    • Queries the phone number (MSISDN for GSM devices)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Checks if the internet connection is available

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks