tispy | 6d9d6e2f85b92c301041ba98e424b50022f62a6ced70ce70d51fe8db9e0ef1e6

Analysis

max time kernel
47s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bruno-wi.apk
Size

2.4MB
MD5

9ab3a8b3a3d59151c4c6a2a803c2d93d
SHA1

f34ffcfc9c605d1417ab2603f65f90bf9a5e4707
SHA256

6d9d6e2f85b92c301041ba98e424b50022f62a6ced70ce70d51fe8db9e0ef1e6
SHA512

a0b343f2180c49bf5a233729cf3c89044c8e46266613797d7357e03c340ac8177e4a9517799f4c98987958a228d68f90a15ff5b708f7e12bfbdc097d99070d9a
SSDEEP

49152:h7u1MhTSDiI9ipmMlUPUjNCCD9b2f6Vm9iEdVJ5TGxD:huqEDApsUBtbZVbKhKxD

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

T1430

T1627.001

Processes:

com.iymaljqb.vwnlavzv

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.iymaljqb.vwnlavzv
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.iymaljqb.vwnlavzv

description ioc process

File opened for read /proc/cpuinfo com.iymaljqb.vwnlavzv
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.iymaljqb.vwnlavzv

description ioc process

File opened for read /proc/meminfo com.iymaljqb.vwnlavzv

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.iymaljqb.vwnlavzv

description	ioc	process
File opened for read	/proc/cpuinfo	com.iymaljqb.vwnlavzv

description	ioc	process
File opened for read	/proc/meminfo	com.iymaljqb.vwnlavzv

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iymaljqb.vwnlavzv/files/dex/sJUMgquIKyEAFJvmp.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iymaljqb.vwnlavzv/files/dex/oat/x86/sJUMgquIKyEAFJvmp.odex --compiler-filter=quicken --class-loader-context=&com.iymaljqb.vwnlavzv

ioc	pid	process
/data/user/0/com.iymaljqb.vwnlavzv/files/dex/sJUMgquIKyEAFJvmp.zip	4291	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iymaljqb.vwnlavzv/files/dex/sJUMgquIKyEAFJvmp.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iymaljqb.vwnlavzv/files/dex/oat/x86/sJUMgquIKyEAFJvmp.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.iymaljqb.vwnlavzv/files/dex/sJUMgquIKyEAFJvmp.zip	4231	com.iymaljqb.vwnlavzv

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.iymaljqb.vwnlavzv

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.iymaljqb.vwnlavzv
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

com.iymaljqb.vwnlavzv

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.iymaljqb.vwnlavzv
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.iymaljqb.vwnlavzv

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.iymaljqb.vwnlavzv
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.iymaljqb.vwnlavzv

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.iymaljqb.vwnlavzv
Acquires the wake lock 1 IoCs

Processes:

com.iymaljqb.vwnlavzv

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.iymaljqb.vwnlavzv
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.iymaljqb.vwnlavzv

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.iymaljqb.vwnlavzv
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.iymaljqb.vwnlavzv

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.iymaljqb.vwnlavzv

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.iymaljqb.vwnlavzv

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.iymaljqb.vwnlavzv

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.iymaljqb.vwnlavzv

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.iymaljqb.vwnlavzv

com.iymaljqb.vwnlavzv
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4231

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iymaljqb.vwnlavzv/files/dex/sJUMgquIKyEAFJvmp.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iymaljqb.vwnlavzv/files/dex/oat/x86/sJUMgquIKyEAFJvmp.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4291

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.iymaljqb.vwnlavzv/databases/privatesms.db
Filesize
16KB

MD5
3621ce0aa81e37bc5c80e2cf881f1dd0

SHA1
00365f82dcada94caea07443656848baf60b3bd9

SHA256
8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

SHA512
76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

Download Submit
/data/data/com.iymaljqb.vwnlavzv/databases/privatesms.db-journal
Filesize
512B

MD5
3cedbb5fe110a923ed544f29a73cd0fb

SHA1
b300e3e25f0ba9068abddc0878b3c17e403c942f

SHA256
decdd85003a93aa1c401151a5f94e093e50a5c58be0593e0ea93a644632f32f3

SHA512
843122e7214bb84497aa075073b59e8b87343865b3911259336586ea09f0b465ccb65c246c91bffe86f0f6188b77d429c4005e275832dd7eb52d3fcd9f8f64d7

Download Submit
/data/data/com.iymaljqb.vwnlavzv/databases/privatesms.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.iymaljqb.vwnlavzv/databases/privatesms.db-wal
Filesize
28KB

MD5
51c00a2b5eb1d2f591bf27481478568f

SHA1
a39bde879b918f60f2fad74015015a5db38aaa49

SHA256
8ca6f2212a10f96e601a654e5811f6ac846a69bb96707f1394da4aa2b79183a8

SHA512
378b70fe040bbd1c599a55d2825846ac2aff46813d474edce19ed8717eb5d5e0c3c505db4bb7ec7e5448e4e05e8fde6b0dffce8388ae2b3523cc9e89c57a9f16

Download Submit
/data/data/com.iymaljqb.vwnlavzv/files/476759.so
Filesize
145KB

MD5
c1288220c0dc083b789018b4e07728c6

SHA1
d3c582ff5b97113eedd90d3d92169157ce6510ec

SHA256
6af455724177d047a3907b9d56bc6d4475dc201dfbb7ddd6bc2d02297758f594

SHA512
58c9186383fa1d0cdf254692407fb58350de0d805445387fb9c426c093c187c0d856795b1f9c751cbe401675a4c2a9422789ccf89e906c669a1b01825e2886a3

Download Submit
/data/data/com.iymaljqb.vwnlavzv/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
Filesize
3KB

MD5
4651e1fd4234ee465d6fe6349f2e178d

SHA1
1a86fbd1edd11fa983155172d484959760c1fc0e

SHA256
725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

SHA512
6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

Download Submit
/data/data/com.iymaljqb.vwnlavzv/files/dex/sJUMgquIKyEAFJvmp.zip
Filesize
531KB

MD5
19dddf82f7bd87ea4e3b94effde91721

SHA1
72f160c9cfec4916d8359a6fa49b7a2953e873c9

SHA256
de09a2c7006d4df62fc6c68beefa0b6ca4ab2d0c69e06f6687752f133283fcc1

SHA512
ecb25634ad0cce712622bf7b3e39bac372bc025932b1a9e0636c29eebf232c4f3b86a920d7d1ba7afdabebcb32c4e89d5dfafc2d773c04083f35cb0ee21bcf3d

Download Submit
/data/data/com.iymaljqb.vwnlavzv/logs/Sistema1716344656151.log
Filesize
17KB

MD5
1a2e82c317c9225138680d7a7c8386f2

SHA1
16d79b5eaf183426a923634b60e2ae6571e90d8a

SHA256
a87292747b5cbb076b25d634ddbc073f24fa7542f7483be31fdc2c056bd14811

SHA512
508901bdadeaf10b68b077a3e9d3e90416e4cd3a97db839b1128928771f8a3d38cea0eac7755ba762a3201855a65fccf7420a3f0d2a9449e4fef2c3e828d993f

Download Submit
/data/user/0/com.iymaljqb.vwnlavzv/files/dex/sJUMgquIKyEAFJvmp.zip
Filesize
1.3MB

MD5
d9cb8662b10b132a3617765057b2f8d5

SHA1
69717583f05f5e0b566600819f0e7703ae059e90

SHA256
4dfd4fd7e1e3d3806f47215274490b4f05c2a15c66c8cca8a28fc4d4a69f6a47

SHA512
41b54174b7a2b57d1d6d4a9de19e6dfa3283585ebd1d1f1a40711d57fbe79b95818ae1a551118259a3b23376fd81b9fbe0b09b21806d593bbd4524196bfc6aab

Download Submit
/data/user/0/com.iymaljqb.vwnlavzv/files/dex/sJUMgquIKyEAFJvmp.zip
Filesize
1.3MB

MD5
cf65d22a9b455288aeb6608e56368e09

SHA1
b9c3235250cd77cc67b30b95d9d2d4d5250727c3

SHA256
c2d1dbd3826eb93c2dc2075d6e72fa670ec772a83c49dfff8b4acfd2b92c9691

SHA512
83159fb08f2c311eb3c7ecb939a5ac8fd0b8e76b6454db33ebfb17a3c23399418295552fbb4ca2e554bdff83ec96446daf8c5ecab74a0fb1ba92db3200a99c57

Download Submit