tispy | 8b8351f544ec6727484b42715dfb1b205d78fc466f228928df62c81e68cec34b

Analysis

max time kernel
48s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
31/05/2024, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b8351f544ec6727484b42715dfb1b205d78fc466f228928df62c81e68cec34b.apk
Size 3.7MB
Sample240531-csec3acg92
SHA256 8b8351f544ec6727484b42715dfb1b205d78fc466f228928df62c81e68cec34b
MD5 78c51f9e1e00e8946c9017adf4a47a1c
SHA1 05141b68f90819c403d358028eed205ab1fc953c
SHA512 782ae666c349d6a142bf73e8a32b5248754fe5c6aed1813546880d82dbc7fa7e70d5d0c6109b654af4517bfbb59be602e8e54343d814bac3e4ece3190b07e160
SSDEEP 49152:hmXG9PEvhjAoB5PKJGQAs+79Q1TCrKF5AM1OshSBKkWiQeFs9fxI0LRbJxe9Je:hmXGiZj7PzQZ1TvlhSBKcQ39prl7ue
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.isrigzxj.cbtqprrg

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.isrigzxj.cbtqprrg/files/dex/4e980369f2fbb29b.zip	4341	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.isrigzxj.cbtqprrg/files/dex/4e980369f2fbb29b.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.isrigzxj.cbtqprrg/files/dex/oat/x86/4e980369f2fbb29b.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.isrigzxj.cbtqprrg/files/dex/4e980369f2fbb29b.zip	4280	com.isrigzxj.cbtqprrg
/data/user/0/com.isrigzxj.cbtqprrg/files/dex/inhsgJPxCwtVVqzwD.zip	4365	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.isrigzxj.cbtqprrg/files/dex/inhsgJPxCwtVVqzwD.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.isrigzxj.cbtqprrg/files/dex/oat/x86/inhsgJPxCwtVVqzwD.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.isrigzxj.cbtqprrg/files/dex/inhsgJPxCwtVVqzwD.zip	4280	com.isrigzxj.cbtqprrg
/data/user/0/com.isrigzxj.cbtqprrg/files/dex/4e980369f2fbb29b.zip	4280	com.isrigzxj.cbtqprrg
/data/user/0/com.isrigzxj.cbtqprrg/files/dex/inhsgJPxCwtVVqzwD.zip	4280	com.isrigzxj.cbtqprrg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.isrigzxj.cbtqprrg

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.isrigzxj.cbtqprrg

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.isrigzxj.cbtqprrg

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.isrigzxj.cbtqprrg

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.isrigzxj.cbtqprrg

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.isrigzxj.cbtqprrg

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.isrigzxj.cbtqprrg
1⤵
- Requests cell location
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4280
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.isrigzxj.cbtqprrg/files/dex/4e980369f2fbb29b.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.isrigzxj.cbtqprrg/files/dex/oat/x86/4e980369f2fbb29b.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4341
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.isrigzxj.cbtqprrg/files/dex/inhsgJPxCwtVVqzwD.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.isrigzxj.cbtqprrg/files/dex/oat/x86/inhsgJPxCwtVVqzwD.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4365

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

privatesms.db

Path /data/data/com.isrigzxj.cbtqprrg/databases/privatesms.db
Size 16KB
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
SSDEEP 6:l9FClq1pO64yXsfzhd6mQLuCeC9F8KCPzRtSzxERX4PBX4ogLugMBX4suuK0Dqif:TgqfO6PstjVC7nCjRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-journal

Path /data/data/com.isrigzxj.cbtqprrg/databases/privatesms.db-journal
Size 512B
SHA256 977e83d9af268fd2576ac3dc4a3f6f758232b3066a163a8d9bbfe2ef3cc3d08c
MD5 bd5cfbd4b82d4616a53f58a55d40241a
SHA1 a9565659c95d1e5e4a002cba1501fe11376b5ccf
SHA512 4c2c6711a5a682b324cf8cb557038a0d4bdbc5cf4aee669924eec3f64d47ea8e68a465d09e0213fb8bf2d55a4401217337631a8c13cf4f70521bfa37f73870d0
MD5 SHA1 SHA512

Submit Download

privatesms.db-shm

Path /data/data/com.isrigzxj.cbtqprrg/databases/privatesms.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-wal

Path /data/data/com.isrigzxj.cbtqprrg/databases/privatesms.db-wal
Size 28KB
SHA256 c352aa9b9c64f9eb65500efb33e0197a39500e7c28307adc05631104d24eaa4b
MD5 2ff847fd33eaedf58695631e001c27a9
SHA1 f75a8a3711dc168ce88740ebac29548291586197
SHA512 68d9cf1d11beba4ffc38a33d78220ad5eb217e458796db49269b36287bef5a777cc6a0ce6a5030e91d4d485640ad86ddc3560180f46baa8aa5ddca7072db1a17
SSDEEP 12:KLTTzdTRmBEyPbP/2WIF5UUNOwClTZgqfO6PstjVC7nCjRmBEyPbP/UgwS:KzzyGSP/2W+UUZ216YJGSP/UW
MD5 SHA1 SHA512 SSDEEP

Submit Download

476930.so

Path /data/data/com.isrigzxj.cbtqprrg/files/476930.so
Size 145KB
SHA256 e7bf368d0b6f671b30a52659c1c0808efedd80f9d6ab2d7ebf7d135eb4f018cf
MD5 f74953102f58b152b02f105be430863b
SHA1 aa8ffd18a7b41d78b70dd02c66e99c8d46936647
SHA512 d6251a916869a1474531e56e910b38988f650ae8c74d6ce64e35d5ce63ce5a99d120c6c0dc0b7854c964716d33ae577560be46a44302304cc00751e41df93310
SSDEEP 3072:jLBuzFYnl6Tqs9Wn9OLgT4toCDEhL0Ci/7NOK0D8u2Gn6Ou5cQ3lMVCe5gt5SBs:jLAzFYnl6Tqs9Wn9OLgT4toCDEhL0Cig
MD5 SHA1 SHA512 SSDEEP

Submit Download

4e980369f2fbb29b.zip

Path /data/data/com.isrigzxj.cbtqprrg/files/dex/4e980369f2fbb29b.zip
Size 549KB
SHA256 4b44d4e08342d15ddd6dd119633b02ad8eac9181595ef67e26f30a4c6b006377
MD5 62c866a108367ae783d929466f09e520
SHA1 b10089574302e09e181b115e6d8f459a0ddb1289
SHA512 e4822da4a14907b0ee374ee08a6cc6becfa3b4b126b5f905374dc5233acf57da2bb42050f751a45a5a2d42d79b61eb075ee414d8143a7a7dc707855de30459c8
SSDEEP 12288:MvfTQ3az/yG/gcX7jsKobH8wheVvX/HH4g632h50o1Wg76zP:ME3aOQPQlgvvnh63do1Wg7wP
MD5 SHA1 SHA512 SSDEEP

Submit Download

inhsgJPxCwtVVqzwD.zip

Path /data/data/com.isrigzxj.cbtqprrg/files/dex/inhsgJPxCwtVVqzwD.zip
Size 649KB
SHA256 e33014c1ea38fe32cd60a59859fad9221be4da7dd964b1d05d350b3cd396d8be
MD5 47ceb452a01d8c194fa7f533c3e61419
SHA1 042ec91a633cfef544f19962000220b8d1803465
SHA512 8097fe583cf1edeb60d892471b6b0e84e35dd431e096e53ae505f69ba3be5b572a7d55723f2214dff8556ab32c7c08420305600fd67cf2b564ec60de84141d07
SSDEEP 12288:NK5y7pcCbPU+C3iho6E3I4yxsHZQW1QerClU6HqRyCYv89i4ZcBLb+9R6DeD3ett:NK5ylcC+3WoRJyCHO7UHXTyXqwr9ft9
MD5 SHA1 SHA512 SSDEEP

Submit Download

pro_btn_bg_animation_img_0.jpg.zip

Path /data/data/com.isrigzxj.cbtqprrg/files/dex/pro_btn_bg_animation_img_0.jpg.zip
Size 8KB
SHA256 1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
MD5 7c20a2b01bf3f9df1f0abb72ebbe82be
SHA1 e601b2e41434623edbeece32867517a3cdec5449
SHA512 3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4
SSDEEP 192:cWweY+9BMmN65SAb/ykGoNcHLX3GdY955BFpsQixzZsANHM9ndkr:F3Yo3JO/edaqbtaHx1sAtM7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sistema1717122020026.log

Path /data/data/com.isrigzxj.cbtqprrg/logs/Sistema1717122020026.log
Size 15KB
SHA256 a1428257ab06f9fae2758db8b7aeb2efe4d3d355c4483458381f6f6fb88b7f84
MD5 7613dfc2de51741e8dc9e0d1d1f4d5db
SHA1 28126f1dff5fe7a74c46473a435635dd5ee6337e
SHA512 9899bf346d04128311f1813384d604e55f6fa9536b9332b3508bb2a7a076f855c2edf142a6b8d9cea9b0e3eec46cbba65163f2c6cbdbb6ee93351f68dbc48f4a
SSDEEP 384:GgJA1yv25WhkWWbRgIlmDRnfuaeu5zuUu9e3uZns:jkWWbRYUAgj9e+Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

4e980369f2fbb29b.zip

Path /data/user/0/com.isrigzxj.cbtqprrg/files/dex/4e980369f2fbb29b.zip
Size 1.3MB
SHA256 b7f516dd7642d84757bd90344056ab33023461bef6aa83c6525f8e690a5fd2cc
MD5 5d406a89b3f279a04a4979a8e2616285
SHA1 f113cce18c373f2ebf5547512fd9113000595782
SHA512 c11f99cbf360960e99cbf75cf83b604291e71b7881bdf6d864dfce8bb6f58c697e8473f045b88d54905d8118a3a2aacf4a4ebd60145ca8fd18078495b5fef933
SSDEEP 24576:pxUGAASv6C/IC7e+3ItXO8bSxZLbshSEcTTH:wHFLbn5TTH
MD5 SHA1 SHA512 SSDEEP

Download

4e980369f2fbb29b.zip

Path /data/user/0/com.isrigzxj.cbtqprrg/files/dex/4e980369f2fbb29b.zip
Size 1.3MB
SHA256 5a97c14f0f065e1a76385da045cbde4eb796b0e7fb14108a26158a6db5484d94
MD5 1d68cee2d48c35b6d1ecab77514c7038
SHA1 0bfe331e5587925f8c059ae1d49c6f74dd46b6df
SHA512 9220c3e5cce2e45738d30a8c0b50b9398d4ee6f7ed67ca3e15aa16608dfb148aaefceadc8f2d4c2862f0e53d5411cf75ab231972d8ea93f80ee8da4714e8f95e
SSDEEP 12288:vsCZ79UGo9l2NzTNBP72w9tTTlvnxT4697Sjql3NdP/uIvOhQk4kcTI80jpNGMZ+:pxUGAAJT5xSmJ0hSEcTTH
MD5 SHA1 SHA512 SSDEEP

Download

inhsgJPxCwtVVqzwD.zip

Path /data/user/0/com.isrigzxj.cbtqprrg/files/dex/inhsgJPxCwtVVqzwD.zip
Size 1.7MB
SHA256 eb81cf25922948ce723b7c6660933eb4029f52c808e7d84e2e8cff2eb0749a0b
MD5 bc6c40ec39e4232f450c7130aee50f86
SHA1 c69aa5570e552b87c8daf20b6e4aa870b3954bb0
SHA512 2f3e2aa11d682972a59e3a4929433cb31ed1bce2e5a76dfcbadba2c02cb3df6b65e029c9b60613542ecbfba8578cf8884d88a5b4f5eac53695a17a5838721e78
SSDEEP 24576:7GeR2pmEKBU4+XAXQXUXyPUIHh+DorW7DN+ACvjV:hQKBh8K62y86+srSNtCZ
MD5 SHA1 SHA512 SSDEEP

Download

inhsgJPxCwtVVqzwD.zip

Path /data/user/0/com.isrigzxj.cbtqprrg/files/dex/inhsgJPxCwtVVqzwD.zip
Size 1.7MB
SHA256 bef099bbba7d5eef8f99a2a604da109fab85b1acfc548494fdcf9a5b70ff711f
MD5 2c9a66cccee940a9d97e022d58e42a31
SHA1 41b803435dcd32c6a9d34b3cdc0a5303f558462a
SHA512 aca9db3a864f49d50ae061bcce01cef6b8fd9c9fefcb5cce6ffadfef18ed64abb09c01da84bb7abc8e5251f989b06d556a19d91b708a88b010aefef155312429
SSDEEP 24576:7GeR2pmEKBU4+XAXQXUXyPUIrrgxaKSCuwdarSmxC9I0tiAEACvjV:hQKBh8K62y8ph9ArETCZ
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads