Overview

overview

10

Static

static

6

WiFiService.apk

android-9-x86

10

Analysis

  • max time kernel
    48s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    04/06/2024, 02:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WiFiService.apk
  • Size 3.2MB
  • Sample240604-cxevdsac3s
  • SHA256 b335458bdc3904b0cd554cef56bef1f0733d47a1cedef04673a7d33191a5a6e4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

  • tispy

C2

  • https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_04Jun24&rtype=T

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • TiSpy payload 2 IoCs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Loads dropped Dex/Jar 1 TTPs 7 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.dzlbolgi.gtqhbvin
    1⤵
    • Requests cell location
    • Loads dropped Dex/Jar
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:4236
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.dzlbolgi.gtqhbvin/code_cache/1717468141776.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.dzlbolgi.gtqhbvin/code_cache/oat/x86/1717468141776.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4307
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dzlbolgi.gtqhbvin/files/dex/RZLyVqHekfriDYHQz.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.dzlbolgi.gtqhbvin/files/dex/oat/x86/RZLyVqHekfriDYHQz.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4332
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.dzlbolgi.gtqhbvin/code_cache/1717468147636.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.dzlbolgi.gtqhbvin/code_cache/oat/x86/1717468147636.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4357

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1717468141776.dex
        • Path /data/data/com.dzlbolgi.gtqhbvin/code_cache/1717468141776.dex
        • Size 4KB
        • SHA256 401f68f4448fd6288b7619a7a2ae4646493cd7268f16aa6714802833fbc1197e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1717468141776.dex
        • Path /data/data/com.dzlbolgi.gtqhbvin/code_cache/1717468141776.dex
        • Size 8KB
        • SHA256 5dfcef0f59a512a9d88d21de81e5f9a20ff420d328736a1426b0a45f9459d832
        • MD5 SHA1 SHA512 SSDEEP
        Download

        1717468141776.dex
        • Path /data/data/com.dzlbolgi.gtqhbvin/code_cache/1717468141776.dex
        • Size 8KB
        • SHA256 bc5290425eaa32b00a84a94c58976321e7643bc5d668817524ad68a1c7d2082b
        • MD5 SHA1 SHA512 SSDEEP
        Download

        privatesms.db
        • Path /data/data/com.dzlbolgi.gtqhbvin/databases/privatesms.db
        • Size 16KB
        • SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        privatesms.db-journal
        • Path /data/data/com.dzlbolgi.gtqhbvin/databases/privatesms.db-journal
        • Size 512B
        • SHA256 7d5ecc4cb63e224531642c26ec02de3fea3b0ff7d2f4dcd8ff23153b9af7cfe5
        • MD5 SHA1 SHA512
        Submit Download

        privatesms.db-shm
        • Path /data/data/com.dzlbolgi.gtqhbvin/databases/privatesms.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        privatesms.db-wal
        • Path /data/data/com.dzlbolgi.gtqhbvin/databases/privatesms.db-wal
        • Size 28KB
        • SHA256 839a27b0080d95ec2b9b3f8081f689391336d055863a2a6a083ef429e9639749
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        477072.so
        • Path /data/data/com.dzlbolgi.gtqhbvin/files/477072.so
        • Size 145KB
        • SHA256 17ebce8aefe2689e07f18ba36e791c331cc4eda83a3057fddf9a34d776f2038d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RZLyVqHekfriDYHQz.zip
        • Path /data/data/com.dzlbolgi.gtqhbvin/files/dex/RZLyVqHekfriDYHQz.zip
        • Size 1.5MB
        • SHA256 438dfec5a20fafe2957c082abff3cf657bd05eab055fab2e271c4f4e07064ee6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Sistema1717468150709.log
        • Path /data/data/com.dzlbolgi.gtqhbvin/logs/Sistema1717468150709.log
        • Size 9KB
        • SHA256 eb8a73f1bf38b120ef0b5c725e322709d01877227326bcf6e331fa47a43869b1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RZLyVqHekfriDYHQz.zip
        • Path /data/user/0/com.dzlbolgi.gtqhbvin/files/dex/RZLyVqHekfriDYHQz.zip
        • Size 3.7MB
        • SHA256 f1e700ea366f9d4d6fb0eb7ee5b1742d1a8c44b153b3c06b5b0c581b9c0b1ab0
        • MD5 SHA1 SHA512 SSDEEP
        Download

        RZLyVqHekfriDYHQz.zip
        • Path /data/user/0/com.dzlbolgi.gtqhbvin/files/dex/RZLyVqHekfriDYHQz.zip
        • Size 3.7MB
        • SHA256 24b2c524590484f3bbdae6dc037e9870126d196f5aa9ca35c66a6e7b16362357
        • MD5 SHA1 SHA512 SSDEEP
        Download