Overview

overview

10

Static

static

6

0274cc5018...03.apk

android-9-x86

10

Analysis

  • max time kernel
    47s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    06-06-2024 14:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0274cc5018d4f45a76d60272efb05856e76fadac90cfd8fb8acd81a2abac2903.apk

  • Size

    2.4MB

  • MD5

    aed9f14f250dbf59522dc978cd0fcadf

  • SHA1

    17213e9db6a573d405392a406ce379ca876ccf3f

  • SHA256

    0274cc5018d4f45a76d60272efb05856e76fadac90cfd8fb8acd81a2abac2903

  • SHA512

    c67001010e36a6bf6ae7353037d5f451cf83d523120d0af83bae1795bd37b32b8bfb9d0ec489cde3ebaa26923e19182ed6305385693e1ff6b081e51821e3f00f

  • SSDEEP

    49152:vD/gRWSst5RlsSMY3KsOIyu8E/Cc+cy+LApZTkB+oLo:vDIxst51MY3KIac+cy+LA/TJo8

Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tispy

C2

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.znlvfgal.lvymyhhp
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4300
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.znlvfgal.lvymyhhp/files/dex/qfQQpsLRWpLcAhSvx.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.znlvfgal.lvymyhhp/files/dex/oat/x86/qfQQpsLRWpLcAhSvx.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.znlvfgal.lvymyhhp/databases/privatesms.db
    Filesize

    16KB

    MD5

    3621ce0aa81e37bc5c80e2cf881f1dd0

    SHA1

    00365f82dcada94caea07443656848baf60b3bd9

    SHA256

    8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

    SHA512

    76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

    Download Submit
  • /data/data/com.znlvfgal.lvymyhhp/databases/privatesms.db-journal
    Filesize

    512B

    MD5

    358ac216a2b8db19d3233a443f7015b3

    SHA1

    a0100bec3eca0244e1067d87936ddbfd2d9848e4

    SHA256

    f535e0628355cb328877eb405ab2021312aa0ad3b0a2c9e9b515cb80e56daddc

    SHA512

    88da6c931a6f40da8c0c2fc4445ae8b26e42388202beeec5567eda185c57c0ad8a255545656906222866dfd460218e3259bade543d57d1c0633df75bf50b7e49

    Download Submit
  • /data/data/com.znlvfgal.lvymyhhp/databases/privatesms.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.znlvfgal.lvymyhhp/databases/privatesms.db-wal
    Filesize

    28KB

    MD5

    59d442ec7a34ea0603f83f85ca724eac

    SHA1

    73347d67613b6f55b3dfbd8be4adfd428530eaec

    SHA256

    51c6e835667b2bb0a8cf6d5488982c20cd0ab3088e5017998fd2b3270dc6e4fe

    SHA512

    8cdc83ec4c009c7c009e45f6062aab9bde06f89a398b59de67e911a18b461f8e542331d1e9d980724b4ebfb150d02a489f24c92df230f919ccab3cc64bd59aad

    Download Submit
  • /data/data/com.znlvfgal.lvymyhhp/files/477095.so
    Filesize

    145KB

    MD5

    5e5fe3305c695750c7e4cd9075bd9df8

    SHA1

    37533db5007c644a493df3d8ea27f7f867ef1d9d

    SHA256

    5dd333720b90f3c6ab8ead662a7758790c3d4d3976f11c94a52339a617355854

    SHA512

    ed94c0807217798eba6ca77815adb5e4bc174e2b016ea59564d759663674547b90cb7bdfde40973dbac55f263fdc4cd2aa6138352ba561c9f869713efcb2cca5

    Download Submit
  • /data/data/com.znlvfgal.lvymyhhp/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
    Filesize

    3KB

    MD5

    4651e1fd4234ee465d6fe6349f2e178d

    SHA1

    1a86fbd1edd11fa983155172d484959760c1fc0e

    SHA256

    725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

    SHA512

    6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

    Download Submit
  • /data/data/com.znlvfgal.lvymyhhp/files/dex/qfQQpsLRWpLcAhSvx.zip
    Filesize

    531KB

    MD5

    c363993e4084c908f032b948dca7a73c

    SHA1

    c80df3a5a9424b62c4b7546a5c6386f3cb374ef3

    SHA256

    798f8f54d1645a775d70a1f2ff242c68dcc13186b3cc7b46b51de6a0b1cf82b1

    SHA512

    3a995e335dec292b4e3091d563e654642b1053191721a1a0050786f1673f97a5cb051f7574137f414381cd30109db5a06091fc23906a5cf89e23d08ad054df2b

    Download Submit
  • /data/data/com.znlvfgal.lvymyhhp/logs/Sistema1717683301126.log
    Filesize

    17KB

    MD5

    81e87d456069ae97f4896493a77bb279

    SHA1

    0af8e8d5f5af8b429e250a3ccd7c86eb806e77f9

    SHA256

    437915cf176f462a150b7066c28c51aa63f17065231c08b90c2623c7ab92004d

    SHA512

    8addc92553a827030bc1d27173b815756835273b448c8bb14d9c2a593677f004e23f7e8a8759ed5a45fada73b6bc2f00603088d17d6d7ff8b09e6c296de4ee0c

    Download Submit
  • /data/user/0/com.znlvfgal.lvymyhhp/files/dex/qfQQpsLRWpLcAhSvx.zip
    Filesize

    1.3MB

    MD5

    2d9e707b2f8137c69bf330e123ff3551

    SHA1

    a54428bba1b311d5f2a4b5541ba145f64417a43a

    SHA256

    4f75c3f55073839774388914a287005d1280c9962114545215702ebdd8eaf589

    SHA512

    987b6af176e044d108e718f16e44dd5e39dad20407107feca2e377bdc8b1193b356e266c37f862ec9fad414f71dbe6c0b6d7650641e7a1db5dbc761d7732bfdc

    Download Submit
  • /data/user/0/com.znlvfgal.lvymyhhp/files/dex/qfQQpsLRWpLcAhSvx.zip
    Filesize

    1.3MB

    MD5

    864e3083f6f99a490359a416f7fe1579

    SHA1

    76df2cd058b3887fbd7c87646d28f063e0c478c8

    SHA256

    fc57f4625b867d0c325743998041ed563b8c85466453d500869d365051e84070

    SHA512

    b5200c22d8d95c1a69be119ff3eb392f494104ef36b4cc3baefdda68a4562713a6ce371772d5407c41ef3ab9e2d21cf7d773dcbac50a6ac70c83042b5815eee3

    Download Submit