tispy | 0f46b14a3800a8949445b301cde151199e64ecdbb7e17f6a30cee2a001f0bef3

Analysis

max time kernel
47s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22/05/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f46b14a3800a8949445b301cde151199e64ecdbb7e17f6a30cee2a001f0bef3.apk
Size

3.2MB
MD5

a17505c301dec57350bb37dfba55cbda
SHA1

92d80644379a506e4af26be74ef12f519ac033c8
SHA256

0f46b14a3800a8949445b301cde151199e64ecdbb7e17f6a30cee2a001f0bef3
SHA512

bb59ca113469f8417319ab92c30f24b875b1e462f35503134b806d12ac3802acd53c2712d3676e22a608fd693870d02e958106106ef292b2b35f66c05b648178
SSDEEP

49152:l5dhLnAtqy/Psrr0xBBUd29G6DKtzb2vImQGpMRV2ZkkCIPVQr0NT8:l5dFncN/PDxfUr6NAmMUkrINQgi

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_21May24&rtype=T

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

TiSpy payload 2 IoCs

resource	yara_rule
behavioral1/memory/4354-0.dex	family_tispy
behavioral1/memory/4210-1.dex	family_tispy

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.tzhsrvvf.qowxjgjy

Loads dropped Dex/Jar 1 TTPs 7 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340064136.dex	4323	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340064136.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.tzhsrvvf.qowxjgjy/code_cache/oat/x86/1716340064136.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340064136.dex	4210	com.tzhsrvvf.qowxjgjy
/data/user/0/com.tzhsrvvf.qowxjgjy/files/dex/dBJukbYxbSUnKwXLg.zip	4354	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tzhsrvvf.qowxjgjy/files/dex/dBJukbYxbSUnKwXLg.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.tzhsrvvf.qowxjgjy/files/dex/oat/x86/dBJukbYxbSUnKwXLg.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tzhsrvvf.qowxjgjy/files/dex/dBJukbYxbSUnKwXLg.zip	4210	com.tzhsrvvf.qowxjgjy
/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340069898.dex	4439	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340069898.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.tzhsrvvf.qowxjgjy/code_cache/oat/x86/1716340069898.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340069898.dex	4210	com.tzhsrvvf.qowxjgjy
/data/user/0/com.tzhsrvvf.qowxjgjy/files/dex/dBJukbYxbSUnKwXLg.zip	4210	com.tzhsrvvf.qowxjgjy

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tzhsrvvf.qowxjgjy

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.tzhsrvvf.qowxjgjy

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tzhsrvvf.qowxjgjy

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tzhsrvvf.qowxjgjy

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tzhsrvvf.qowxjgjy

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tzhsrvvf.qowxjgjy

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tzhsrvvf.qowxjgjy
1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4210
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340064136.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.tzhsrvvf.qowxjgjy/code_cache/oat/x86/1716340064136.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4323
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tzhsrvvf.qowxjgjy/files/dex/dBJukbYxbSUnKwXLg.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.tzhsrvvf.qowxjgjy/files/dex/oat/x86/dBJukbYxbSUnKwXLg.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4354
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340069898.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.tzhsrvvf.qowxjgjy/code_cache/oat/x86/1716340069898.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4439

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340064136.dex

Filesize
4KB

MD5
d3364728f634bf71c4b16542c02c60cb

SHA1
f23088362b69935f404f2b81eaa40ed3172efca5

SHA256
401f68f4448fd6288b7619a7a2ae4646493cd7268f16aa6714802833fbc1197e

SHA512
9378bbda71abcb437676a2d4095d7d3ab6a5a1c1682ec95f3f6d050b9226692cd1a29ba8e7a65dac441c29cfb7b1d5e69e34b5cc32989c90c025909567a662af

Download Submit
/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340064136.dex

Filesize
8KB

MD5
cf790c0dfb1361b86d4b8bfca1f8814c

SHA1
d452d9d6504f6af0c9408d6fdb1ced0ff3c45dee

SHA256
5dfcef0f59a512a9d88d21de81e5f9a20ff420d328736a1426b0a45f9459d832

SHA512
e2194cf4ab22064206d9df3523afd3b247f4ce72b7fed17056029746d1f79c1a25d340f8f9c7ec77b9590d05dc7549a735d631a368f82c472cd54bb8a1396c47

Download Submit
/data/data/com.tzhsrvvf.qowxjgjy/code_cache/1716340064136.dex

Filesize
8KB

MD5
a137b5568de65b8fef35329930d8617f

SHA1
49a2d6e95d447ba1d448c81691f6a609fb2859ed

SHA256
bc5290425eaa32b00a84a94c58976321e7643bc5d668817524ad68a1c7d2082b

SHA512
9dd6c25dea7b3424e8ca0150a9f1f6f85ed5fccef69e7fadfa05324014b74cc350365b788cee2a8ce25afccee084908e679eafa7f449e7791c6288485d2c5338

Download Submit
/data/data/com.tzhsrvvf.qowxjgjy/databases/privatesms.db

Filesize
16KB

MD5
3621ce0aa81e37bc5c80e2cf881f1dd0

SHA1
00365f82dcada94caea07443656848baf60b3bd9

SHA256
8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

SHA512
76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

Download Submit
/data/data/com.tzhsrvvf.qowxjgjy/databases/privatesms.db-journal

Filesize
512B

MD5
14ad69c4e2982a145bb8286209971f1e

SHA1
9e24feb5bda8bd0a3faf521e85cae61f93d0693b

SHA256
d33e79c85303053b4dc81719208b7dfc37775a8149637360e15f65f29d6647c1

SHA512
f05e768639ac0003d2846f88ad4510312485fc57a41d890dcf130872e3d5880d9f521f9987aad2e0ea35f145e1a530d58978417575558f4a7974afb5960a6b36

Download Submit
/data/data/com.tzhsrvvf.qowxjgjy/databases/privatesms.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.tzhsrvvf.qowxjgjy/databases/privatesms.db-wal

Filesize
28KB

MD5
05de9ca89c288e8103f0880e062e8583

SHA1
caf4b981d67ab3ba9e8b5831616de0e5c0a2e9f5

SHA256
98908932fa91ab54215b04a24ddad2873e328025fc023f36611bbb4494094991

SHA512
72f856c58613fdd6b6bda1df5a018c27cb754c858031617397f7bcc0ff3f7521ed5618609255dd0525ae47e230a1e8a28510a58aa6b5eec1aa3271f893f36ea0

Download Submit
/data/data/com.tzhsrvvf.qowxjgjy/files/476736.so

Filesize
145KB

MD5
636162646d994492711b6bbb130a4e18

SHA1
870c7129da1f8bfe3caa5f8d89c9a698917f4b7c

SHA256
4cc84a54406786086c558d4f04dbd89c749ea295864b43bf95874f1c4872004a

SHA512
5ce368850573e313c34ed6f73c02991e6ab71e7a2abadd7e843601e4870f1ddc5899a7e06f8eb33025338b1f1a7fdda5e1e376b1a2295301be75029e167a2749

Download Submit
/data/data/com.tzhsrvvf.qowxjgjy/files/dex/dBJukbYxbSUnKwXLg.zip

Filesize
1.5MB

MD5
518cbf644762b881ad7181daa959c824

SHA1
134cb8c29149aacdeeb391d081ab708f9e8c8b84

SHA256
600251897a28f70f92d630ee59156747bba4a8b48a39a0bcce9ceb65beaab1f2

SHA512
b79c91e00ec70c325abcc8ab4cce8d52313e6673e66d25a535adbda37c7b2447582741103971b5637726ca2ee69863dec62a4956284c6a94aea98c116385c253

Download Submit
/data/data/com.tzhsrvvf.qowxjgjy/logs/Sistema1716340072846.log

Filesize
9KB

MD5
b3e9b1379182ba8cedb31b85b3402d81

SHA1
0802e231263e019d9c58172d29da774cd3a6f4a8

SHA256
52a614967bb1300fd7673150732fedcdd8ec8a1a4181fd33ae40eab26d261e48

SHA512
c500ab48bac2d6452510eeb4c4af2545983a4a3d23ca1c012192a96a8a81da07597383ff925ebeb59b973e55f8942b69d7fefdb542fcef0744a0d448d1054577

Download Submit
/data/user/0/com.tzhsrvvf.qowxjgjy/files/dex/dBJukbYxbSUnKwXLg.zip

Filesize
3.7MB

MD5
a972c70146e76a0ab324573e7e8cbec0

SHA1
c4bbf7558a0dd838ec2ca13be10cc9ece19f6108

SHA256
09e8dad9ee1515f1ff80fed508a9946a46056396e42ecff2138f0f26f037a255

SHA512
48f21656e12ca892e2878d7f4d41c3195346b71bdc4d8c77a3d723b0e16e11fdbbd7d21205993e1c697934aba49af005bd52135a69572781539dac75278e3812

Download Submit
/data/user/0/com.tzhsrvvf.qowxjgjy/files/dex/dBJukbYxbSUnKwXLg.zip

Filesize
3.7MB

MD5
8bb0ed3a1a8da1ebba689b277cb01c5c

SHA1
cb45ad58dc82358d78b5d606d62c86e9a00944c8

SHA256
a745b5128fee1681cb9f2b520fc0fa9f09fe23243d297d0b2d8a514ad2a3724c

SHA512
a0eaeaa69b8b6849136709b7a9d8c3650baa6d452b9d8b7919f8f608fe8b1d5c0e7c410ff88a57802d8c2584f04f8efec012cab799bacf38f4c9c6064d2809eb

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads