General

  • Target

    492fd88ed4d79a68d8f9f3ed3fe136e1975f1503e2c858936bd0aee9499daeb1.apk

  • Size

    2.4MB

  • Sample

    240530-bjlv4shh22

  • MD5

    d6d4464b802da6ac3802e48a8326880e

  • SHA1

    dcbe7d7124d96aa74956a52c7b917349579ff82c

  • SHA256

    492fd88ed4d79a68d8f9f3ed3fe136e1975f1503e2c858936bd0aee9499daeb1

  • SHA512

    9f06e1d9156fcf10a9eb0f6b41e4e4ed39e752930c64ace5ca005bf4124906b74282d63c8b84e59bfcfe088e1f29b10b3f1c8dbf3e53305b2fc7d1d9840637c9

  • SSDEEP

    49152:qoh9YZg4cSLRi6qoKfGJT036lqeKahezcbJHl7nsX5Q4:qohGJJ46TKfGJT06PKaha1O4

Malware Config

Extracted

Family

tispy

C2

https://brunoespiao.com.br/esp/appprofile.jsp

Targets

    • Target

      492fd88ed4d79a68d8f9f3ed3fe136e1975f1503e2c858936bd0aee9499daeb1.apk

    • Size

      2.4MB

    • MD5

      d6d4464b802da6ac3802e48a8326880e

    • SHA1

      dcbe7d7124d96aa74956a52c7b917349579ff82c

    • SHA256

      492fd88ed4d79a68d8f9f3ed3fe136e1975f1503e2c858936bd0aee9499daeb1

    • SHA512

      9f06e1d9156fcf10a9eb0f6b41e4e4ed39e752930c64ace5ca005bf4124906b74282d63c8b84e59bfcfe088e1f29b10b3f1c8dbf3e53305b2fc7d1d9840637c9

    • SSDEEP

      49152:qoh9YZg4cSLRi6qoKfGJT036lqeKahezcbJHl7nsX5Q4:qohGJJ46TKfGJT06PKaha1O4

    • TiSpy

      TiSpy is an Android stalkerware.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Queries the mobile country code (MCC)

    • Queries the phone number (MSISDN for GSM devices)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Checks if the internet connection is available

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks