tispy | 5b36bb475c08ed159c3c12821aeeedfa4939f00ee74cdc375d238fdcad9736ef

Analysis

max time kernel
28s
max time network
140s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
24-05-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b36bb475c08ed159c3c12821aeeedfa4939f00ee74cdc375d238fdcad9736ef.apk
Size

2.4MB
MD5

2c82df9a565970b1b9b8344a0b9b2e64
SHA1

0ec2572885a39693e60fc6d1f9de4885d39e5b6c
SHA256

5b36bb475c08ed159c3c12821aeeedfa4939f00ee74cdc375d238fdcad9736ef
SHA512

3eae95d5b3173a6f94564ed1da5b66af51ae508476d5233e22ae3b604400f1bd35fffe8b62c50dd7fb41a41d95cf9250c2844103a98c9f3be312e9d523594ae5
SSDEEP

49152:nwt4s1tS3eIFS5m0qmvtMRaopu6S8BllTIvhCf3SDNxBe:nwtP+rFMimtMRa8u6znw0IRe

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

Location Tracking
T1430

Geofencing
T1627.001

Processes:

com.ujetjuyx.deccppfe

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.ujetjuyx.deccppfe
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.ujetjuyx.deccppfe

description ioc process

File opened for read /proc/cpuinfo com.ujetjuyx.deccppfe
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.ujetjuyx.deccppfe

description ioc process

File opened for read /proc/meminfo com.ujetjuyx.deccppfe
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.ujetjuyx.deccppfe

ioc pid process

/data/user/0/com.ujetjuyx.deccppfe/files/dex/eyYCEHkBwSlORMusX.zip 4239 com.ujetjuyx.deccppfe
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.ujetjuyx.deccppfe

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.ujetjuyx.deccppfe
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

System Network Connections Discovery
T1421

Processes:

com.ujetjuyx.deccppfe

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.ujetjuyx.deccppfe
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.ujetjuyx.deccppfe

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.ujetjuyx.deccppfe
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.ujetjuyx.deccppfe

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.ujetjuyx.deccppfe
Acquires the wake lock 1 IoCs

Processes:

com.ujetjuyx.deccppfe

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.ujetjuyx.deccppfe
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.ujetjuyx.deccppfe

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ujetjuyx.deccppfe
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.ujetjuyx.deccppfe

description	ioc	process
File opened for read	/proc/cpuinfo	com.ujetjuyx.deccppfe

description	ioc	process
File opened for read	/proc/meminfo	com.ujetjuyx.deccppfe

ioc	pid	process
/data/user/0/com.ujetjuyx.deccppfe/files/dex/eyYCEHkBwSlORMusX.zip	4239	com.ujetjuyx.deccppfe

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ujetjuyx.deccppfe

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.ujetjuyx.deccppfe

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ujetjuyx.deccppfe

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.ujetjuyx.deccppfe

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ujetjuyx.deccppfe

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ujetjuyx.deccppfe

com.ujetjuyx.deccppfe
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4239

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ujetjuyx.deccppfe/databases/privatesms.db
Filesize
16KB

MD5
3621ce0aa81e37bc5c80e2cf881f1dd0

SHA1
00365f82dcada94caea07443656848baf60b3bd9

SHA256
8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

SHA512
76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

Download Submit
/data/data/com.ujetjuyx.deccppfe/databases/privatesms.db-journal
Filesize
512B

MD5
e7af2b512882703f364077f48d17a9d3

SHA1
aa2d42107101c5e30e1c9a3458201fb5caf0752b

SHA256
638cedf92e4a31dc5f3d2cb0c13783abe903551347c4517fbac62c9fe16bc603

SHA512
0a8040e35f6bee74a54f5537541b882a29acca222236121b4b06576d032cc7f566ae8107d1506efa0a8d697d7da08ef19bdc4563be7a139d034f2cfebaa08380

Download Submit
/data/data/com.ujetjuyx.deccppfe/databases/privatesms.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.ujetjuyx.deccppfe/databases/privatesms.db-wal
Filesize
28KB

MD5
5d368352e8e835fbf1dfb06b730e3853

SHA1
e3fec5790c43556b9a55efc7a4e60e79f02cc4d6

SHA256
1a4719c8e96f3a9d96a03d79c13625c501d78d0c92f619fe0782f245d3d3bd31

SHA512
1e21deef0955334f6490cb7736c2d2defb7d53d058322e50e9d01aad508b50553d4cf6141666c8a615e2e4e9a0115d9e548d00cfd42a9972a24a37f6169a0643

Download Submit
/data/data/com.ujetjuyx.deccppfe/files/476783.so
Filesize
145KB

MD5
28ed2db7599c385fe39eff1cdbb3f58c

SHA1
c9ed30081404839259aab91a2590c186b98d04d3

SHA256
698f2651721037b417f16320853f4e4b0fc394157655ab072959946adc9b843f

SHA512
e09a5520c44e1e1e2a269d00b6c06bee60b0b5ab085dc4e3ad037ce92f98b6d8bb26f257513aaa97ecb5ddca22bbc61fe4435bec0f3949a8c69c39030ececf9a

Download Submit
/data/data/com.ujetjuyx.deccppfe/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
Filesize
3KB

MD5
4651e1fd4234ee465d6fe6349f2e178d

SHA1
1a86fbd1edd11fa983155172d484959760c1fc0e

SHA256
725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

SHA512
6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

Download Submit
/data/data/com.ujetjuyx.deccppfe/files/dex/eyYCEHkBwSlORMusX.zip
Filesize
531KB

MD5
eab92624c9efc7b06f2a17894427071e

SHA1
3f78057a5c7dc8b1fe2a54e3f45a40ffea7b034b

SHA256
390070859a8a89cc4b5bee26283eca6db3a8aa95fa39781f0c71f4302d24f84e

SHA512
629716909ca0660c8cb5fb13127bac3cee678f751ff91987ca9a0d55d46fa87c0a59ed22b483dbfc88f4c36ce8f14d1316209a680b50a7a13ea8fe5c9f67c0b0

Download Submit
/data/data/com.ujetjuyx.deccppfe/logs/Sistema1716513621535.log
Filesize
17KB

MD5
3697ca4d61ca522361397a7edbac6a10

SHA1
a8858c7389ae66c2bbd365a9f5f04fcec6db2f19

SHA256
92d1259f94f01850f9b91246f0e7027227e68b88e86796f40764e54aec5eea5e

SHA512
d4571bfe18c1f520fa51ae5dfc483eb67e20b0f24ae148c16cad5fb5ee5e80554c40935dc4f878db4e1518ffafc420a54479578bf5eb535b8323d8087fccbbbc

Download Submit
/data/user/0/com.ujetjuyx.deccppfe/files/dex/eyYCEHkBwSlORMusX.zip
Filesize
1.3MB

MD5
2839ac73f36a47866a45125de1c9eb0f

SHA1
d286f60ab14dfe78f7fef29e9fca0653d5cbc6fa

SHA256
7a9fc29949b3ade40340a24c744d69afe436e563693bf4815e423f4ee1510757

SHA512
7ae38d3e29dbe88f8a2d8b314aa308a21660eca9882412b02066d06e7bf1c1f0fbf541952d67bbc19e4b9446a96a8eba3bacc3e287cd5ee5767505b43da976a3

Download Submit