tispy | 1f29b4a43b7219cb6adfcbae9162916f651f33dcb097fad91999733adaecc821

Analysis

max time kernel
47s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
28/05/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bruno-sis1.apk
Size 2.4MB
Sample240528-chvbjaah2w
SHA256 1f29b4a43b7219cb6adfcbae9162916f651f33dcb097fad91999733adaecc821
MD5 cb76f94aa78320a78340a2b368670372
SHA1 fed3861e47201fda164e2c75d0dde23e41b8a27f
SHA512 b6cc901f8b8a81681f2344550e97462a1e148d182c276848c9c2a511a50b4cd23260c6752f907297a145f5acb05993942d61009150aaa5ca00ee85909b9cbb4f
SSDEEP 49152:/bxJIz3SanWKf5Sxw6i4wIR13p8pvoF28PHjs:/bxS2Pfxw6B313Ss2ojs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.hpijayax.mmmqojfl

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hpijayax.mmmqojfl

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hpijayax.mmmqojfl

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hpijayax.mmmqojfl/files/dex/CBFpUUKjQSrkuSlPK.zip	4341	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hpijayax.mmmqojfl/files/dex/CBFpUUKjQSrkuSlPK.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.hpijayax.mmmqojfl/files/dex/oat/x86/CBFpUUKjQSrkuSlPK.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.hpijayax.mmmqojfl/files/dex/CBFpUUKjQSrkuSlPK.zip	4299	com.hpijayax.mmmqojfl

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hpijayax.mmmqojfl

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.hpijayax.mmmqojfl

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hpijayax.mmmqojfl

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hpijayax.mmmqojfl

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hpijayax.mmmqojfl

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hpijayax.mmmqojfl

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.hpijayax.mmmqojfl
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4299
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hpijayax.mmmqojfl/files/dex/CBFpUUKjQSrkuSlPK.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.hpijayax.mmmqojfl/files/dex/oat/x86/CBFpUUKjQSrkuSlPK.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4341

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

privatesms.db

Path /data/data/com.hpijayax.mmmqojfl/databases/privatesms.db
Size 16KB
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
SSDEEP 6:l9FClq1pO64yXsfzhd6mQLuCeC9F8KCPzRtSzxERX4PBX4ogLugMBX4suuK0Dqif:TgqfO6PstjVC7nCjRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-journal

Path /data/data/com.hpijayax.mmmqojfl/databases/privatesms.db-journal
Size 512B
SHA256 83b0fab4462734234d04236f01d679c829ce3ed79fa55044f7500a803d4ae8d5
MD5 e6571b015962850efa66cb79b52233c4
SHA1 c964deaed8f70e36bae03015c74f08d3feeea774
SHA512 c3732e6809c1d29ea2e1a08b708cf6432f49aef8c4f68875322aef875ce635fbbdca1e8407785b37cecf164823c27c507a9cead6dea2a24663399ee71a020168
MD5 SHA1 SHA512

Submit Download

privatesms.db-shm

Path /data/data/com.hpijayax.mmmqojfl/databases/privatesms.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-wal

Path /data/data/com.hpijayax.mmmqojfl/databases/privatesms.db-wal
Size 28KB
SHA256 45766832df43547a952552b61b86085e868494f84af1a68e2506b00fa1b9e226
MD5 d96bf04d884d06d354d1a7cbbaaed5e8
SHA1 d559c05cf3ccffdb33ce89f88176338eafd83324
SHA512 9e676ddc2e6803f90aea6f8f4feb51ee090f2cb16d03d37533b6851d5d81dd8b7ed8baa32cde1aab65a48b43a9a852cd9fc52e8576d3b96473f203128eaca3c9
SSDEEP 12:KAplKgb1uzdTRmBEyPbP/udgOgOwClKg7gqfO6PstjVC7nCjRmBEyPbP/uHmH:KSlyzyGSP/Xu16YJGSP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

476903.so

Path /data/data/com.hpijayax.mmmqojfl/files/476903.so
Size 145KB
SHA256 8dd2c70189724ca19af1837be688b9185fc20046cb2ac751c97e07e67f9b2b35
MD5 d0606a0e622c83f113dc748448f79034
SHA1 a6b3f142a2e6cabf61f03a0e211e3e3e5e003807
SHA512 6fee06da844e134f3e798ce3b56cef683d281775374a448cdac29a770ef45c9f57a486e6d7cd81e91f62d19a4d2354f5e4ab99674b2049a6897e4d4740632898
SSDEEP 3072:8LBuzFYnl6Tqs9Wn9OLgT4toCDEhL0Ci/7NOK0D8u2Gn6eu5cQ3lMVCe5gt5SBsI:8LAzFYnl6Tqs9Wn9OLgT4toCDEhL0CiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

black-wallpapers-for-smartphone-102-700x990.jpg

Path /data/data/com.hpijayax.mmmqojfl/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
Size 3KB
SHA256 725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b
MD5 4651e1fd4234ee465d6fe6349f2e178d
SHA1 1a86fbd1edd11fa983155172d484959760c1fc0e
SHA512 6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c
MD5 SHA1 SHA512

Submit Download

CBFpUUKjQSrkuSlPK.zip

Path /data/data/com.hpijayax.mmmqojfl/files/dex/CBFpUUKjQSrkuSlPK.zip
Size 531KB
SHA256 7e3503373f51e9ab328440dec956b795b38f3cbcfe5499b6cb3e35e17c055a4b
MD5 115974686fc5ede31473eeebac87a5d2
SHA1 9a47b476376a27e87264c289cba29db8f2cf2e9a
SHA512 f649331c32b82d274bfb571412009e84fd09ced140f08ed20cdd507777cb285aa6f8aac460198beaa3cd8b3a3dd7c38820bf163df49d7699158937b3d29491a6
SSDEEP 12288:xjUpPTBSHC1/hF8On73tvqvIsfyHJJdD30oKMA9kFV4EXPl3J:ezdZNn73tvqvNKHndD3yQZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sistema1716861915358.log

Path /data/data/com.hpijayax.mmmqojfl/logs/Sistema1716861915358.log
Size 17KB
SHA256 13049ac391152b372380e915abcedfe1527b026d7067af5b359fa34cc4cd09a9
MD5 fd413f474ef8ec8538c2ba734a5609ad
SHA1 57e083cf6d030974afda0736f283fadacda9c4ba
SHA512 359a2dbee2c4fb3791a16a076572a5e47754f93e5f299f0a8faf94749aa87174df7d5e6b7aadb245a409341b002cc56e6794aa6c37fafdc4a50a173986ef8c2e
SSDEEP 384:TKCM1yv25WhkWWbRgIlmDYZiusRul9uhu9enuYZNq7WvHNZJdBOjeiSr:HkWWbRY25Gc9euuMKNZJdBOjeiSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

CBFpUUKjQSrkuSlPK.zip

Path /data/user/0/com.hpijayax.mmmqojfl/files/dex/CBFpUUKjQSrkuSlPK.zip
Size 1.3MB
SHA256 1224c2dff425de8c113c45f84dadf1056131592d663e753960d78d215704092d
MD5 9af0477e1d287d277bca5dc425f20d2e
SHA1 faf95c7d607281e8f50fd44c62c6dd24101afa71
SHA512 fab492dd3212e223f61478ff7adfce3db7bc18a917fefc4ba6bb47b495f2c1d20ace03dcc78799bfd9940e6ea64e93caeff6b944bb4b246f2ad66a07b5812a20
SSDEEP 12288:SHk4A6WblofOiVbkrD3y9GK9WFLGb97sF31GmNaZuLS9Do0dkxMVEmx3DPdwpE:yk5TloffkkGK9zpiWNooP6K
MD5 SHA1 SHA512 SSDEEP

Download

CBFpUUKjQSrkuSlPK.zip

Path /data/user/0/com.hpijayax.mmmqojfl/files/dex/CBFpUUKjQSrkuSlPK.zip
Size 1.3MB
SHA256 7075f5ca6bb189578d7b631102a3d83fb112491c5f4fd79a627171de00d8850a
MD5 c05fad63aaa1ac7f7dbadd203a377c1b
SHA1 d10cd581a618f9f911333f75dfb63313c581af8a
SHA512 11f99289f412d97f31f9b23a4996f69031c6ebc4d2a95e6a99a06cb8c4056e1a4f91332a558df6d94fa5ab98fb0b2bf7bdd294f87da0f6b7abf997b495b1b1db
SSDEEP 12288:SHk4A6WblofOiVbkrD3y9GK9WFLGb97I+3X9HBWBI7XNxQkwV0cuEHhpfQoxiLpN:yk5TloffkkGK9zp1SgjARK
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads