tispy | ce716204328919afbaf52312e5039b150b24049a922b9acef44badd53bbbe5e2

Analysis

max time kernel
47s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
04/06/2024, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf59b6b132b39e51221cd201bc042e3b75ee481c3d8810aa3f9a37d2de66a3ce.apk
Size 2.4MB
Sample240604-dvpr9abd6w
SHA256 cf59b6b132b39e51221cd201bc042e3b75ee481c3d8810aa3f9a37d2de66a3ce
MD5 9bb9e19f8f64c5985540d220121ecbab
SHA1 1263a9e0edca505dd4bea877967c199feae4d87c
SHA512 16d4e97f1197d3a921394f9c88f031c3eaf78e69d23291ab323ec2f077364559d21265a6f7e8c30e9be005a8e625a0e3b83506f338d9e1c93ee922796a7b2d5f
SSDEEP 49152:oYEra8J9rSapHhvZrtPSchNaVtUxHmz7fEoftfQEPZFf:SrBawHBZcIN64HmH9f5QI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.eqnveere.xbvhfgdp

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.eqnveere.xbvhfgdp

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.eqnveere.xbvhfgdp

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.eqnveere.xbvhfgdp/files/dex/huhyzSrOYEEAmavGB.zip	4306	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.eqnveere.xbvhfgdp/files/dex/huhyzSrOYEEAmavGB.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.eqnveere.xbvhfgdp/files/dex/oat/x86/huhyzSrOYEEAmavGB.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.eqnveere.xbvhfgdp/files/dex/huhyzSrOYEEAmavGB.zip	4279	com.eqnveere.xbvhfgdp

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.eqnveere.xbvhfgdp

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.eqnveere.xbvhfgdp

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.eqnveere.xbvhfgdp

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.eqnveere.xbvhfgdp

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.eqnveere.xbvhfgdp

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.eqnveere.xbvhfgdp

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.eqnveere.xbvhfgdp
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4279
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.eqnveere.xbvhfgdp/files/dex/huhyzSrOYEEAmavGB.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.eqnveere.xbvhfgdp/files/dex/oat/x86/huhyzSrOYEEAmavGB.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4306

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

privatesms.db

Path /data/data/com.eqnveere.xbvhfgdp/databases/privatesms.db
Size 16KB
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
SSDEEP 6:l9FClq1pO64yXsfzhd6mQLuCeC9F8KCPzRtSzxERX4PBX4ogLugMBX4suuK0Dqif:TgqfO6PstjVC7nCjRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-journal

Path /data/data/com.eqnveere.xbvhfgdp/databases/privatesms.db-journal
Size 512B
SHA256 0ea359dd1c4bb94d8b36679a5e153c69e6ade9bb73f528d598f6cf9c85e24ee6
MD5 b668f753d72fdbb7f287dd286d854fdc
SHA1 4ce827d1e5a9004d9e3f784657e3193cd5844cb5
SHA512 07e23ee1dea569e7330571a22138f01947bc73143ee9c2422b65c7c183a2ea245f5b0e42cf2b7db22883be5b7e9d18071cbd581f415d1ef4120e8a2c63aec06d
MD5 SHA1 SHA512

Submit Download

privatesms.db-shm

Path /data/data/com.eqnveere.xbvhfgdp/databases/privatesms.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-wal

Path /data/data/com.eqnveere.xbvhfgdp/databases/privatesms.db-wal
Size 28KB
SHA256 5e67597ec9bc5b7467feab747543a6e2d9236cfd2b034a936f8fc835095f8ab6
MD5 c806417e3fc4a96c63e044d2bd3534f1
SHA1 f2b366c36d7fc5efb821c403231038783dfecc1c
SHA512 733df5f5e4477987649ad7bd53981e8fe11270737a7451d6c456079d3a364c4d89b2d5d1263dc4f6cf0d323d5bccf18ac8a909fd60c9d6dbe906a1629abc1eef
SSDEEP 12:K3XzdTRmBEyPbP/GjUaw/OwClgblgqfO6PstjVC7nCjRmBEyPbP/89EE:KnzyGSP/0UasNbl16YJGSP/7
MD5 SHA1 SHA512 SSDEEP

Submit Download

477023.so

Path /data/data/com.eqnveere.xbvhfgdp/files/477023.so
Size 145KB
SHA256 24902206e14f32e225f124e98c84dcb7db51d1aa94a6c5eaf876c4a524e210f2
MD5 7fa0d1c6952f45878c903a41321de660
SHA1 f57a8f916c3a48e30146a3f1459f8ac75fd5d2f3
SHA512 28e5da354cbd8592080b78867ac922e29536de6a1cc1e7d14400147eaff783e3c905934190c5ead1af492d197132de05c7a6626f24414160ce9886c0bc399006
SSDEEP 3072:QLBuzFYnl6Tqs9Wn9OLgT4toCDEhL0Ci/7NOK0D8u2Gn6fu5cQ3lMVCe5gt5SBs9:QLAzFYnl6Tqs9Wn9OLgT4toCDEhL0CiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

black-wallpapers-for-smartphone-102-700x990.jpg

Path /data/data/com.eqnveere.xbvhfgdp/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
Size 3KB
SHA256 725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b
MD5 4651e1fd4234ee465d6fe6349f2e178d
SHA1 1a86fbd1edd11fa983155172d484959760c1fc0e
SHA512 6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c
MD5 SHA1 SHA512

Submit Download

huhyzSrOYEEAmavGB.zip

Path /data/data/com.eqnveere.xbvhfgdp/files/dex/huhyzSrOYEEAmavGB.zip
Size 530KB
SHA256 ca88ab16afa23a61216025c7e68dfb991f52aa16a01184ad06c4bcf2fad53950
MD5 9f7757191bed997a5d94a38997eff5ed
SHA1 23a28b98145fd81d61fc40c4ea56836497664fa0
SHA512 b81bef2725ac1ace24d3d2f694ecb8e41548fae2e0f2f35be502e0602fd59fef303b6f40b5d6a783153ba7d438f940a86e1ef1480cad88b5ad2234769e185557
SSDEEP 12288:9TxQExaEKgsOBETh2uZsSuoJVpGOeQhMSju574j7hBVbyiu0VHu:9TxQEx1rEh2j/wtb257AhBVbJu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sistema1717471211305.log

Path /data/data/com.eqnveere.xbvhfgdp/logs/Sistema1717471211305.log
Size 17KB
SHA256 1dc0aa5e81e636cdb693ca4c273f6b54ec4ddcb686df14a4b878a311c978d3ac
MD5 5a12c4f5cd7e2ed7226518337185f647
SHA1 26c28a989d58729d9e682ce599656c4a0e904dda
SHA512 2665fdf5fa0ae3fe5b22532c16af8afe86a5a8f8e66ed4dc3892a8f7aa550df5c5deba554eabed0b30a1624f9836b5d0dac9fcb6a33fbeba25c08d6cf8932e42
SSDEEP 384:92Ys1yv25WhkWWbRgIlmDY4vNuOlquDlCu+Gu9eWuK7/JW1ZvHgl:rkWWbRY+YHq9eRuhWRgl
MD5 SHA1 SHA512 SSDEEP

Submit Download

huhyzSrOYEEAmavGB.zip

Path /data/user/0/com.eqnveere.xbvhfgdp/files/dex/huhyzSrOYEEAmavGB.zip
Size 1.3MB
SHA256 f35b336b216a0716f9e746c01ba830aab205199a758a2107c978defe7f236377
MD5 96247aaa0c36c4304a3f8ab0897cd6ab
SHA1 0d312e958ac5f91308e3c7f359cbea988b3a2580
SHA512 02592eb597f65c672e7ea444118d9d52d3dbdf59d6fce43433bf819135ba77dce29dee4d362ab6121f0893a2750e88643ad9bbb64ebc4c96fabe34f05eb7c863
SSDEEP 12288:dFTMbgH01CQ9P1Wldgn2fR2BjhnaGhGyP7mDwtVYr0XNR1dryQZCMT/rTSxwnZKl:/TMbLfgibhnvnNR1Zjb+EG/dfN
MD5 SHA1 SHA512 SSDEEP

Download

huhyzSrOYEEAmavGB.zip

Path /data/user/0/com.eqnveere.xbvhfgdp/files/dex/huhyzSrOYEEAmavGB.zip
Size 1.3MB
SHA256 69744ff77f871d0634915dcafe081c7260ba09fe809faf4d7f59a98554fc0c04
MD5 ea02f7d75eeacfdadef3d7bc97f3df04
SHA1 7b8283dde7190b38ab32552cd0a1f769c17158a8
SHA512 5b7276a98b6a4ade2c5be32152e471988b06210995003708af53716ff2a6cda7a0a2626910d74616e348429a230e70e3881a982af20d5e7399727af0755595c5
SSDEEP 12288:dFTMbgH01CQ9P1Wldgn2fR2BjhnaGhGyP7mDMtbokOAD9s6XBGUm3CMLu8+XPsOB:/TMbLfgibhnDd9s/3j4J/dfN
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads