Overview

overview

10

Static

static

6

b5a9bf764f...cf.apk

android-9-x86

10

Analysis

  • max time kernel
    47s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    07-06-2024 02:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b5a9bf764f474caeeb366f32a7eef7e73408f91ebc44ea8986f79f9c5adb2bcf.apk

  • Size

    2.4MB

  • MD5

    d0e92d937b48f8f99c5df2ae38aa0478

  • SHA1

    295edd583e5ba81a1de622f452ee47c171a32019

  • SHA256

    b5a9bf764f474caeeb366f32a7eef7e73408f91ebc44ea8986f79f9c5adb2bcf

  • SHA512

    d2db850fcd80f545bf5ce6245d5cb1e91656394603a20db937864421b4b4c2a93239aefea6c9d3ae972f34ad5b363f731aff3a36dc66f46fd3004a094e5417e5

  • SSDEEP

    49152:+nJiQRNSMcnI1gonYuzsT1bx9NpVp0ekBHg1TuS:+nJVaMcnS/zGb3zUIf

Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tispy

C2

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.wzzsedkm.xkzgxkrp
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4292
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wzzsedkm.xkzgxkrp/files/dex/VLcwfTMvBVKhaTVym.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.wzzsedkm.xkzgxkrp/files/dex/oat/x86/VLcwfTMvBVKhaTVym.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.wzzsedkm.xkzgxkrp/databases/privatesms.db
    Filesize

    16KB

    MD5

    3621ce0aa81e37bc5c80e2cf881f1dd0

    SHA1

    00365f82dcada94caea07443656848baf60b3bd9

    SHA256

    8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

    SHA512

    76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

    Download Submit
  • /data/data/com.wzzsedkm.xkzgxkrp/databases/privatesms.db-journal
    Filesize

    512B

    MD5

    03da2c7adec0e7799d146ddebd6b6dde

    SHA1

    908cb289ae2bdaa2ea6b4fc8a83646d2abf9f132

    SHA256

    5c6b9fa54cff186c3fed6741f28b8c8e69b2846105048a1fdc35b5d321973186

    SHA512

    07c736d90145489e82f61a5a12139d496188640c277b3241d115a4f6a966f56b80d091e72028aefce3a4a23727d65e7ab137924f917e31b7f2a65631a2e8af28

    Download Submit
  • /data/data/com.wzzsedkm.xkzgxkrp/databases/privatesms.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.wzzsedkm.xkzgxkrp/databases/privatesms.db-wal
    Filesize

    28KB

    MD5

    655a801ba55b401967199319e29cfe3c

    SHA1

    150b1be80f80c70306d68dc1ec40620d23db5663

    SHA256

    cf0d22e84ceead55cd49131b3de33383c0924708701a79366da2789f05150434

    SHA512

    60ee438dc5f3080da762201da2a7e975f7114a25503f9e229aa7913931f3aa6d806384aed24af405eb4288bb63af8617a81978c65343ad22a39992bca9aa26ff

    Download Submit
  • /data/data/com.wzzsedkm.xkzgxkrp/files/477119.so
    Filesize

    145KB

    MD5

    0aa7e264fd7b20349a0ed519bfe467d3

    SHA1

    7628357681539fcee6c8a06899f239f08eed0b29

    SHA256

    4dd7cd17f4a367092a1add1bfb5fad0307f684166bed09b07d3193d69153eca0

    SHA512

    b40851328eadadef55d48e65a014f9518896360aa944effe910a98f9a03106b96457cff570be23f918a2a48a7539bba1709d3f5452e6c1b0edd6c9f0cbecebf7

    Download Submit
  • /data/data/com.wzzsedkm.xkzgxkrp/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
    Filesize

    3KB

    MD5

    4651e1fd4234ee465d6fe6349f2e178d

    SHA1

    1a86fbd1edd11fa983155172d484959760c1fc0e

    SHA256

    725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

    SHA512

    6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

    Download Submit
  • /data/data/com.wzzsedkm.xkzgxkrp/files/dex/VLcwfTMvBVKhaTVym.zip
    Filesize

    532KB

    MD5

    d44aef72c5d5986bf8e5612232d18217

    SHA1

    0bdef40aa82a77bba1f45e4b29e3d066360813d5

    SHA256

    a3d30755385b62c07617e8034b3cca8eb5708d9c5233ecb27472aacfb40c69c7

    SHA512

    7b6cb1809af77e7a1740297088da210ce6a3e2a3b2b40ff2ab78e3fb748082ea55d2d528c7ebb75eea03b1cdd70fe28268a0202defbf59ff88d3ba019c6ae5d1

    Download Submit
  • /data/data/com.wzzsedkm.xkzgxkrp/logs/Sistema1717727920396.log
    Filesize

    17KB

    MD5

    ce0b26734e8efae3d441f62306eab31a

    SHA1

    dd3e26a4f9edb0a0b2c6bfa805203b5933be3d99

    SHA256

    2ad8b64daf88c162dd19d3914f805c702b32cc6090c324df25a9733758831a1a

    SHA512

    ed0271b02c3d45a7d1525c81fe2e906e859711f0ab88b93daac017dcdaf54cb63a7b9b74277118a6734d2cae1503ef72fc358d2b706c4097e04e0b6667225a44

    Download Submit
  • /data/user/0/com.wzzsedkm.xkzgxkrp/files/dex/VLcwfTMvBVKhaTVym.zip
    Filesize

    1.3MB

    MD5

    1511db0310827f2d652bf7d276057502

    SHA1

    edbc770c9f9a08e6dc5f6cafbb92820fcb67dba3

    SHA256

    c810e1ab7cdf6c1523ac9d033902c8ef9dc1719282f605c89249f93f77ac94de

    SHA512

    36b4ed340e13eee065e92146efd74b8704432c413c5133e300216dc277b5193791545e0a132593aeaebc00e2b41814e8386bfe7b979fc06dccb7d4db344be2e1

    Download Submit
  • /data/user/0/com.wzzsedkm.xkzgxkrp/files/dex/VLcwfTMvBVKhaTVym.zip
    Filesize

    1.3MB

    MD5

    a1377e9015dc065ff081ce2e994704ee

    SHA1

    8f19412bf4e1fa93b8a6a2b0160df0d2544a107a

    SHA256

    468f0e983e7617fcb2a737f5fba8778448648c040105528827541d0e895d34b6

    SHA512

    b576ff19ff7ecafbc688f3e5bd787ac0a62e9522d7f9d7099478e4d3f328e76af4207c8077ae43184616d20c254aa83dc8d7c4ac330d66b87537e598c54224b1

    Download Submit