Overview

overview

10

Static

static

6

41f45c29ae...4f.apk

android-9-x86

10

Analysis

  • max time kernel
    48s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    31/05/2024, 02:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    41f45c29ae6175b66c8203a62089885a2d02d8d7a43bf90705c866c840e3f84f.apk
  • Size 3.2MB
  • Sample240531-cfgyesbb7x
  • SHA256 41f45c29ae6175b66c8203a62089885a2d02d8d7a43bf90705c866c840e3f84f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

  • tispy

C2

  • https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_31May24&rtype=T

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • TiSpy payload 2 IoCs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Loads dropped Dex/Jar 1 TTPs 7 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
    discovery

Processes

  • com.xclcquan.xnvvgrzs
    1⤵
    • Requests cell location
    • Loads dropped Dex/Jar
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:4271
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xclcquan.xnvvgrzs/code_cache/1717120927215.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.xclcquan.xnvvgrzs/code_cache/oat/x86/1717120927215.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4336
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xclcquan.xnvvgrzs/files/dex/zMwYqGRbAmviHfZFM.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.xclcquan.xnvvgrzs/files/dex/oat/x86/zMwYqGRbAmviHfZFM.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4363
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.xclcquan.xnvvgrzs/code_cache/1717120934885.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.xclcquan.xnvvgrzs/code_cache/oat/x86/1717120934885.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4391

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1717120927215.dex
        • Path /data/data/com.xclcquan.xnvvgrzs/code_cache/1717120927215.dex
        • Size 4KB
        • SHA256 401f68f4448fd6288b7619a7a2ae4646493cd7268f16aa6714802833fbc1197e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1717120927215.dex
        • Path /data/data/com.xclcquan.xnvvgrzs/code_cache/1717120927215.dex
        • Size 8KB
        • SHA256 5dfcef0f59a512a9d88d21de81e5f9a20ff420d328736a1426b0a45f9459d832
        • MD5 SHA1 SHA512 SSDEEP
        Download

        1717120927215.dex
        • Path /data/data/com.xclcquan.xnvvgrzs/code_cache/1717120927215.dex
        • Size 8KB
        • SHA256 bc5290425eaa32b00a84a94c58976321e7643bc5d668817524ad68a1c7d2082b
        • MD5 SHA1 SHA512 SSDEEP
        Download

        privatesms.db
        • Path /data/data/com.xclcquan.xnvvgrzs/databases/privatesms.db
        • Size 16KB
        • SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        privatesms.db-journal
        • Path /data/data/com.xclcquan.xnvvgrzs/databases/privatesms.db-journal
        • Size 512B
        • SHA256 8762f3454342c2fd19a4148503cdc04eff71540bf54598fdbc967acc4bc33396
        • MD5 SHA1 SHA512
        Submit Download

        privatesms.db-shm
        • Path /data/data/com.xclcquan.xnvvgrzs/databases/privatesms.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        privatesms.db-wal
        • Path /data/data/com.xclcquan.xnvvgrzs/databases/privatesms.db-wal
        • Size 28KB
        • SHA256 b7ec6e505676eb70e5e52121b02f60638729bfd7048b0a69ae15c6d958116300
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        476976.so
        • Path /data/data/com.xclcquan.xnvvgrzs/files/476976.so
        • Size 145KB
        • SHA256 662802dba2042060bfa086232e04b57f273f51bf00b495230c61e0f77fd80125
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zMwYqGRbAmviHfZFM.zip
        • Path /data/data/com.xclcquan.xnvvgrzs/files/dex/zMwYqGRbAmviHfZFM.zip
        • Size 1.5MB
        • SHA256 1a3b43878dc9c6dadd6273c8d8ccb6676d18373528125b477e31cd977619a3e4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Sistema1717120938845.log
        • Path /data/data/com.xclcquan.xnvvgrzs/logs/Sistema1717120938845.log
        • Size 9KB
        • SHA256 41319f8a73690cf96fb41950362cf933b1f7e41cab50a3ad77bf5485bb7bcbce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zMwYqGRbAmviHfZFM.zip
        • Path /data/user/0/com.xclcquan.xnvvgrzs/files/dex/zMwYqGRbAmviHfZFM.zip
        • Size 3.7MB
        • SHA256 70414d1f0b60a81d1f2a833479bbb24112d6c2f721980670b2237e80ba32ec22
        • MD5 SHA1 SHA512 SSDEEP
        Download

        zMwYqGRbAmviHfZFM.zip
        • Path /data/user/0/com.xclcquan.xnvvgrzs/files/dex/zMwYqGRbAmviHfZFM.zip
        • Size 3.7MB
        • SHA256 84b60b7e8b9a2bad108f4a55a916a5cdc7bfd21a5eb7e77f18035cf6c1df52b5
        • MD5 SHA1 SHA512 SSDEEP
        Download