Analysis
-
max time kernel
48s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
24-05-2024 02:15
General
-
Target
8cf8e9710be9a7e2655badc9a43135f76dc9dddd8a9eeba0b92611e381203611.apk
-
Size
3.0MB
-
MD5
82ef343412ba55c99cca1eb038946c21
-
SHA1
4c055e05dc6a1648316e464ba9316c2309118cd4
-
SHA256
8cf8e9710be9a7e2655badc9a43135f76dc9dddd8a9eeba0b92611e381203611
-
SHA512
7081a040c219249c5b0dedbf108d25e615821bba4bfd3f5918916def093bb6c852b347e87c8cfa6a9f1b2a978bdbf8283cb4c88a18562f707c225b59ab74bb6e
-
SSDEEP
98304:+4pm83M0jDsVhPpsDh1C/iRmPWkrqcBI4I2jLa:Jdc0jQVhGDaiRmOkmvQu
Malware Config
Signatures
-
TiSpy
TiSpy is an Android stalkerware.
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.wuppquad.qwcdbmhl1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wuppquad.qwcdbmhl/files/dex/374121b8f4fdc26f.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.wuppquad.qwcdbmhl/files/dex/oat/x86/374121b8f4fdc26f.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wuppquad.qwcdbmhl/files/dex/DNsygzydYowxsDAMk.zip --output-vdex-fd=43 --oat-fd=45 --oat-location=/data/user/0/com.wuppquad.qwcdbmhl/files/dex/oat/x86/DNsygzydYowxsDAMk.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD53621ce0aa81e37bc5c80e2cf881f1dd0
SHA100365f82dcada94caea07443656848baf60b3bd9
SHA2568620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA51276bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
-
Filesize
512B
MD53f1eb1f83124650680ba838434a488f6
SHA1de1d367de7de3054c5110405e396e0763c571cfe
SHA25658d9e8601ed26bd6a37cce829bb944525278f354a52c4ebcefb66b6d3fe688d0
SHA512a723028883306f59e12ad36214fb71cddf6fab231c6de1bbf4c47b7d45288455b92ce9dc80385d8747653293027f56bab4c3e1401aa6d8d3c660ec822c1adb5e
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
28KB
MD52722e95eea38f38627320f7d98889750
SHA1b34a86e8300efc32aeda84b1e029621344b217a2
SHA2569f41b445e09b90e5e50c296d2bfc55609d816c4e258b976f05a9f79aac6437f3
SHA5129cee6cc5089d28f92d04e02434fe91c91a59ff3b1f2a5461845edfaea60571b2243f8d6e3635df59ef493542f47eeca867032b28258a2986434eef91095e494d
-
Filesize
145KB
MD5f02cfa4c095a42b27d287d7b141beea4
SHA1c9fb42c9641ddd8f09947f4679773e7702f30cc7
SHA2566114e1c2091c66002c0e7be2693c5058931dfb28c3a0468d6818bd0f97d966a4
SHA5121e56eccea6b252fbf07acfa153da4b3f9ef429bfaf35a6af10a3334f2e25a572f33f4443946263a542d1f0d267eda56d6187fbbaa93562c4c8841dd43f191da4
-
Filesize
547KB
MD59514192fd443c898e256dbf9ac2368fe
SHA19d3aa86fc5d3f95c7e65d97d037185b177ba3d68
SHA2569e651588159c687a7c1aa136e604880c2fe031158cb295af8de4b58075687e2b
SHA5126b92d6c9bca7376ed4c197d043ad54081cc37ce0289909ef962b74852cdaf6e7e03c16664e4e4d6fc3d70ebbea0f15dfc6ac6ca9b3a9808671e402e8cb4e600f
-
Filesize
649KB
MD5e6f8db72e6501faa93e0e396f87ddbb6
SHA11aa4e455fc6910c2bb32b7ebac8d870817a09d09
SHA2567f164c0c680fb31fef9d6c841e5d1b65ea3e861976a8bb49a4fae6625532b927
SHA512a4039beb16b45f76d1633d12b3d445cecd066091fb2c2a1ed366790feb7e62e8c3e1dad70fcef79c7fa2fe88daca491b39cec682bf618b10c26df69e0bb331be
-
Filesize
8KB
MD57c20a2b01bf3f9df1f0abb72ebbe82be
SHA1e601b2e41434623edbeece32867517a3cdec5449
SHA2561a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
SHA5123faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4
-
Filesize
15KB
MD5a013bbe4a572a8fefa5af9a5e3ee961d
SHA15add70583d2676068fe8f7cc623130ae26b4d4e1
SHA2565d55090b9984d3bbfd47be685368118030c12656bdbca63626207a9f01a2c283
SHA512c86944de1adca37589de2e177874f42881a2bfacc1681992fc4b5d936ba49052b87a1ccb352d8005edca0d03e7d70028813d8d5b017d9adce9d22978af78783b
-
Filesize
1.3MB
MD565992fbc2a1525309951b31b46a06520
SHA146b41ec9017c65db43446674f2338521e444e162
SHA25674884adb2b5a467b30a0ab095f501e750be0c388b444b22b628471c7c4e08e7a
SHA5123920decabfe0b5c744dae9fa94e50e14b1950b7c65e345350d5759648b932e69e35478930765615c4432646e776f59b6d45883d32d4e19711c28c03f0da126b7
-
Filesize
1.3MB
MD563945b00ff5504117ec1bd44b418802d
SHA1971877266a32cb1d4bf7066736d31be6b9e62900
SHA256dac405c12926efcf21467adcd384dea7965e16b9f76bc15a9386e92779b77533
SHA512ef4dcd6a6577147a26f9baa9a61ee597db0393ae5d44286be9a679cf937efac4aec696bae1fef0b3041e91ecbb38e96a805582a7eed3515c6891c93c09aafe69
-
Filesize
1.7MB
MD55a8f42acba8d2298b165d12448e46742
SHA102e671896fe4cd7c486ae3114389abe8e7db5800
SHA2563845be9cd658586b5c3ec6edeec58592a8c3609e6a06514dc41f4da2d8d1e5b7
SHA5124be43e7e573e54a51623ca6793e4d9e121ba6f9d4d3444261117dd573bd8a0f22a604f82e34062a65a72df170cd2d9b123147cb375bb4fec0e1e3a295bdd5a3c
-
Filesize
1.7MB
MD55849790ef7965d28be8b7be20ab8da7c
SHA125d73a2192f66da9408cb5cb7e607e0b816728bc
SHA25655fc2c47034ee35c4c1677a3ac9531fc1592ace6cde700372eb4c094c084986e
SHA512b15a0209aaccc13f139d929a794b414da9e43b6c9e6d74680cf372008a2b5d8b21315479f01f23a232881ad5a98b580cd0cdddac0ed69debcf5af7d462b39107
