tispy | 83ad44797a53ffdd06a1960f08dadbebd69d4f50984749f84446e9f697510813

Analysis

max time kernel
47s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
24-05-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83ad44797a53ffdd06a1960f08dadbebd69d4f50984749f84446e9f697510813.apk
Size

2.4MB
MD5

db2b53c4436da6437a14f85f138354cc
SHA1

97c32cc366d79164ba671fb498c8ddba44c7009e
SHA256

83ad44797a53ffdd06a1960f08dadbebd69d4f50984749f84446e9f697510813
SHA512

a623ff95366da1b7ec7331d9fb324ddad558db5b2723c5155b16e5dda1ef392318905208f36e67111659be1e2e6303e85f560835111bea08c1c3eb2d865c1226
SSDEEP

49152:lW6EP9S0244JYimS/5GGhV1zJ2/zKy0EZxa7NTQqKHA5k1PxT/mvGHfOM:lWJc0sYimS/5Gc1z80Ie5Q0kzT00

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

T1430

T1627.001

Processes:

com.nephjihb.jaqnxwlc

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.nephjihb.jaqnxwlc
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.nephjihb.jaqnxwlc

description ioc process

File opened for read /proc/cpuinfo com.nephjihb.jaqnxwlc
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.nephjihb.jaqnxwlc

description ioc process

File opened for read /proc/meminfo com.nephjihb.jaqnxwlc

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.nephjihb.jaqnxwlc

description	ioc	process
File opened for read	/proc/cpuinfo	com.nephjihb.jaqnxwlc

description	ioc	process
File opened for read	/proc/meminfo	com.nephjihb.jaqnxwlc

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nephjihb.jaqnxwlc/files/dex/TWMCwyHpMORlQnBDZ.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.nephjihb.jaqnxwlc/files/dex/oat/x86/TWMCwyHpMORlQnBDZ.odex --compiler-filter=quicken --class-loader-context=&com.nephjihb.jaqnxwlc

ioc	pid	process
/data/user/0/com.nephjihb.jaqnxwlc/files/dex/TWMCwyHpMORlQnBDZ.zip	4311	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nephjihb.jaqnxwlc/files/dex/TWMCwyHpMORlQnBDZ.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.nephjihb.jaqnxwlc/files/dex/oat/x86/TWMCwyHpMORlQnBDZ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.nephjihb.jaqnxwlc/files/dex/TWMCwyHpMORlQnBDZ.zip	4279	com.nephjihb.jaqnxwlc

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.nephjihb.jaqnxwlc

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.nephjihb.jaqnxwlc
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

com.nephjihb.jaqnxwlc

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.nephjihb.jaqnxwlc
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.nephjihb.jaqnxwlc

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.nephjihb.jaqnxwlc
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.nephjihb.jaqnxwlc

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.nephjihb.jaqnxwlc
Acquires the wake lock 1 IoCs

Processes:

com.nephjihb.jaqnxwlc

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.nephjihb.jaqnxwlc
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.nephjihb.jaqnxwlc

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.nephjihb.jaqnxwlc
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nephjihb.jaqnxwlc

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.nephjihb.jaqnxwlc

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nephjihb.jaqnxwlc

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.nephjihb.jaqnxwlc

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nephjihb.jaqnxwlc

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nephjihb.jaqnxwlc

com.nephjihb.jaqnxwlc
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4279

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nephjihb.jaqnxwlc/files/dex/TWMCwyHpMORlQnBDZ.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.nephjihb.jaqnxwlc/files/dex/oat/x86/TWMCwyHpMORlQnBDZ.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4311

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nephjihb.jaqnxwlc/databases/privatesms.db
Filesize
16KB

MD5
3621ce0aa81e37bc5c80e2cf881f1dd0

SHA1
00365f82dcada94caea07443656848baf60b3bd9

SHA256
8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

SHA512
76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

Download Submit
/data/data/com.nephjihb.jaqnxwlc/databases/privatesms.db-journal
Filesize
512B

MD5
6916bbd4bd2be212cfee3e11b4126d6e

SHA1
d10f73d98bebf28a27ca383cc43ea55344d178ac

SHA256
d4d4048f2d285ec527e1b002a70d4660a3415bef45a308f67d05d3963aca2c3d

SHA512
0400ebf111ea394a1102ae8525cf58d5e9a0a3face998754806305b2187102fb9fb1f698fac2b5248e7dc4f3dff3187f88e5b02bf5987e859950e4bd0341a17e

Download Submit
/data/data/com.nephjihb.jaqnxwlc/databases/privatesms.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.nephjihb.jaqnxwlc/databases/privatesms.db-wal
Filesize
28KB

MD5
ddde9409324a08e2c7a354a24d215fbe

SHA1
da4ba309fe81d5b8d049533dc714c2deac197fb2

SHA256
dc3f029d879a205fb27a005ada1a29b1869f4f19dc16599907dfcafe3f557429

SHA512
34b2f6843b4cb4c2832652aacbff4c51bd17673efb7b5b6aafff626f35cafa53669a4088b6f1cab0f2abf997f56a70c0b351109efc381b8aadf4fb47e2f08b2e

Download Submit
/data/data/com.nephjihb.jaqnxwlc/files/476807.so
Filesize
145KB

MD5
7ceea80210d73fb188bd5ac304a25cd2

SHA1
9c0fb6dbc4aecafcf7d59575834db6f67f36edac

SHA256
1c93ef549f627ced937a3880750558a9ce89981fe78caecfeff55aab9d42e1b3

SHA512
366bec846c2e23f4743a50d26c28a2ce9117ff858817cf2983eb0831625a846ae043ffb1afcabed5c84cc40af4e869984e0210d8a77f395bd2eed1558e99c5bf

Download Submit
/data/data/com.nephjihb.jaqnxwlc/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
Filesize
3KB

MD5
4651e1fd4234ee465d6fe6349f2e178d

SHA1
1a86fbd1edd11fa983155172d484959760c1fc0e

SHA256
725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

SHA512
6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

Download Submit
/data/data/com.nephjihb.jaqnxwlc/files/dex/TWMCwyHpMORlQnBDZ.zip
Filesize
531KB

MD5
fed6f3b9eb8e21506baf205c5b329d7f

SHA1
c34fcc8c2663d146dec716c7fc22cd8c2e2a50da

SHA256
65821b78b73932c18543f92a26422135f4c9c9971c15d2100b951d578c5d1009

SHA512
70cd7bec76cc9cb17c5e0c4151748f67326d597fcb89d2aca5c6a40d97b5f5e8cce428654c72bab59693916d3ae0524be3b9572723b710b8ed2b253d0d96616a

Download Submit
/data/data/com.nephjihb.jaqnxwlc/logs/Sistema1716516568891.log
Filesize
17KB

MD5
c69cc4f34b9273ecb356d3bdcb586c66

SHA1
129c08f8de27251a1a6576e91e3801699c931e57

SHA256
34cba8ed56bde0c4b8d90597796a43eac4da09cce2f0a7ec44ce2f0de41e2f33

SHA512
8fe83643d2705bead130427f79a7561d1b84fd9052141f7a34b8965e7a313cbf033b5ebac19f2e1ffb209133adf433549d489ce4f4d36fbd48351b72112a125f

Download Submit
/data/user/0/com.nephjihb.jaqnxwlc/files/dex/TWMCwyHpMORlQnBDZ.zip
Filesize
1.3MB

MD5
fd57bb1f3bba1490a14955789cdda741

SHA1
941c7e0359b270297855d74863759dc1c3412bfa

SHA256
7f97c9fe2b287d14a435134bd79d829fe8e76dd6ec5ff1828cd653c22fabc34a

SHA512
8459a03dffc53156493087bb336b397d759b424351eecb15294f94cb303112b0abcec7630df8bd5bf42ade017b08f1f5017e6e0ccf8a47e2de3c959729e0e13b

Download Submit
/data/user/0/com.nephjihb.jaqnxwlc/files/dex/TWMCwyHpMORlQnBDZ.zip
Filesize
1.3MB

MD5
517e1fdd2115080729a86c21b8d8dd8b

SHA1
02feaae0dc153846e3ce37bc8564317528c196f3

SHA256
3b684b3b72a0ed9d7a2dab606dc80831c3d42094f7fcba1e964e34303c4bbd4a

SHA512
caf8d89013ba7aa05a9b8f93e5e782818382b680067c028166c601bb5f41494dd9c44c05d09c6e32c99c7af732fddc6f3d60b722c53081b3a397906e038a9c14

Download Submit