General

  • Target

    fb4bf5cc39c4e3bdeeacfa28d338c9aa6a41a90aab39a2a782e345008cb1e0c9.apk

  • Size

    2.4MB

  • Sample

    240522-c6d98ahg36

  • MD5

    950ce1e022607946c1c38365ecfe0058

  • SHA1

    73dec30a312871b20eead477e905c101f19ebcc6

  • SHA256

    fb4bf5cc39c4e3bdeeacfa28d338c9aa6a41a90aab39a2a782e345008cb1e0c9

  • SHA512

    21b9e62ce0e72fb314136c1ff084e0420dd66fb76998fc3a38a556bd8477086fab6aeb3fbf2af0fc58852f8128880f436606d2273fa4bf82018f9f9822460e74

  • SSDEEP

    49152:PtP5spgSDdS7jDCpy6C1Pmg1W+24DoMOx9T9PczNHIuOfv8R:PtPm3sKpfCtmMWhX9TiBb28R

Malware Config

Targets

    • Target

      fb4bf5cc39c4e3bdeeacfa28d338c9aa6a41a90aab39a2a782e345008cb1e0c9.apk

    • Size

      2.4MB

    • MD5

      950ce1e022607946c1c38365ecfe0058

    • SHA1

      73dec30a312871b20eead477e905c101f19ebcc6

    • SHA256

      fb4bf5cc39c4e3bdeeacfa28d338c9aa6a41a90aab39a2a782e345008cb1e0c9

    • SHA512

      21b9e62ce0e72fb314136c1ff084e0420dd66fb76998fc3a38a556bd8477086fab6aeb3fbf2af0fc58852f8128880f436606d2273fa4bf82018f9f9822460e74

    • SSDEEP

      49152:PtP5spgSDdS7jDCpy6C1Pmg1W+24DoMOx9T9PczNHIuOfv8R:PtPm3sKpfCtmMWhX9TiBb28R

    • TiSpy

      TiSpy is an Android stalkerware.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Queries the mobile country code (MCC)

    • Queries the phone number (MSISDN for GSM devices)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Checks if the internet connection is available

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks