tispy

General

Target

WiFiService.apk
Size

3.2MB
Sample

240523-ctkapsaf33
MD5

4b2c76b9181f2bd8c47fd5e97a8f0154
SHA1

a6e25ab429f93e5e03bc546c111e653e6569d451
SHA256

3f51f79ff23d9fb9fe401fab525a418340da8a07a0c20937da619ec34bb6e56c
SHA512

acccb94a864ea19eab77a660ab36e9175b45b95089d5bba1ebe75031e31a2aa59c29d0755e4335ca59144046d89f8beaf607a7777d1b62212a30f836684f3f7b
SSDEEP

98304:kngWOn1DPEpN3dcw9l5ij2rUeMIwf/Zw0U:mo1DKT5isUFq0U

Score

10^/10

Malware Config

Extracted

Family

tispy

C2

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_23May24&rtype=T

Targets

- Target
  
  WiFiService.apk
- Size
  
  3.2MB
- MD5
  
  4b2c76b9181f2bd8c47fd5e97a8f0154
- SHA1
  
  a6e25ab429f93e5e03bc546c111e653e6569d451
- SHA256
  
  3f51f79ff23d9fb9fe401fab525a418340da8a07a0c20937da619ec34bb6e56c
- SHA512
  
  acccb94a864ea19eab77a660ab36e9175b45b95089d5bba1ebe75031e31a2aa59c29d0755e4335ca59144046d89f8beaf607a7777d1b62212a30f836684f3f7b
- SSDEEP
  
  98304:kngWOn1DPEpN3dcw9l5ij2rUeMIwf/Zw0U:mo1DKT5isUFq0U
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
behavioral1