Overview

overview

10

Static

static

6

1ccbe52642...7c.apk

android-9-x86

10

Analysis

  • max time kernel
    29s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    08-06-2024 02:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c.apk

  • Size

    2.4MB

  • MD5

    110a7c811689311ed3f22b528268b273

  • SHA1

    f65b139be6803642d9f67cfc0594e50ccf5b1770

  • SHA256

    1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c

  • SHA512

    d08c01e192232b64ef56a39beb2bff5542012cf71cfdd3e6391d27b81d0f6dbced4381893f2ceb1381a86ceb67f5371f1739126a7839be3550b852aa959dd175

  • SSDEEP

    49152:tQ0XUBgSrmrUWmAV5QYq2rmHgLGiCmBlHjELQDv:20EDrGUWmLYKYGilALQDv

Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tispy

C2

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.lmfgqgty.rltuadcl
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4273
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/oat/x86/VNDeWFWAXpAdJZejW.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4303

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db
    Filesize

    16KB

    MD5

    3621ce0aa81e37bc5c80e2cf881f1dd0

    SHA1

    00365f82dcada94caea07443656848baf60b3bd9

    SHA256

    8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

    SHA512

    76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-journal
    Filesize

    512B

    MD5

    9ac5201e81e3bf59902185eed8167371

    SHA1

    2076578cba2449260e2d2efab56675a2251f44d5

    SHA256

    f185a8b06f4f5aeca1573394f2d6094ea1d8fb116f9f3877082d02f7d9fdcf4d

    SHA512

    d89bd372275a9088be3ce7a0449473babf02629688bba93d1cd8b976f0bf77e2338517f55c93a363761f3aa21eb46cbae820035f3e97b93a5e68901686f24a4c

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-wal
    Filesize

    28KB

    MD5

    5f75371dd2f6e0b36a453b5fd0a2a482

    SHA1

    1c8ddc24e448c361587d2206a8c6877a22d1857a

    SHA256

    f385b41553454f1635e49a531746dc736e1601e5f0a65b199aa26d6fbdb01f24

    SHA512

    3a8bb8b7bbc4c937508ceae25836e413226df15d4ebf3a997aeb6adcb19913ca9c86806c305ee73f6becc651236806b57bd391a32e2d2bf85b184c29e5e516ea

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/files/477162.so
    Filesize

    145KB

    MD5

    25083313ad3eed03263c3ea25cf724df

    SHA1

    d7dc6152b665211456fafeffc043ababee70b6bc

    SHA256

    49375bef5e691fa9833d1c8d6a264374bde3b0f72c3e5a24d36d977b9db9be94

    SHA512

    a4b5581c97842aeb907d462586b535014b600a15db8e1d1abd1501a8aba17ccf33ae91fe6d9b6eb60fcb8e6c42bd8d59a18406d47c98d1afa3b679fb36344b8e

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
    Filesize

    3KB

    MD5

    4651e1fd4234ee465d6fe6349f2e178d

    SHA1

    1a86fbd1edd11fa983155172d484959760c1fc0e

    SHA256

    725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

    SHA512

    6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
    Filesize

    533KB

    MD5

    29c437be3a477af81e8e2b106a42c046

    SHA1

    aba9b0c6ee636b871c0caf1e266980f167ff0c48

    SHA256

    ab8117a70c9c2933d3a50ff95d0e6c958c281a1a2f9873304d9ea9a9b095a70a

    SHA512

    582b8fe106bc273c5a5898587345f684e9d67d6933b83048b34efdbe4a363274d24d36a7deb33e81011e7047ec9fad266fb5369547d546f1985d58a6162f2a51

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/logs/Sistema1717813253382.log
    Filesize

    17KB

    MD5

    d9feaa29d79baefe7d5ba3f6ea6782ee

    SHA1

    446bff37faa7400a0715657b49a13da6016e1cba

    SHA256

    8a27cb79eca36afa61248094a79c050521ba6dd8b63f0f90f2746ddbfd30ead7

    SHA512

    68f16aae2302fd6de2177e376e1363fed13cbec1e8d4da8e6f9d3407ca7571c9a0107b1752f683526699a532139a3fd8748aa0c12c5596702354e06967b93f9b

    Download Submit
  • /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
    Filesize

    1.3MB

    MD5

    745da5b8d4f1bdc25982c999a1641b56

    SHA1

    699b09628a66ac2a300b14dd7bccd16bd23e466f

    SHA256

    dc76f95418983da1ccd1d0168661b90f9879b96ef03c3ef1292e35fe6282e0b6

    SHA512

    2e3a700b84293e8ddf442a88fd5cfcbabc05f7eb1d1aa8ac2b891e94d82eb8a22341cc65c3dd519929e84822cdd7b242b026f7a04ed746626a5d6907c7e189ea

    Download Submit
  • /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
    Filesize

    1.3MB

    MD5

    82fb7b860fe3170b54e432c2b3973e76

    SHA1

    27943ca2023d0ec4ad57d11200e1b93ebc26e66c

    SHA256

    5aeb372bb370518ed943aacf48704b8d096194fd27c4a9d8e8b55c616e037c44

    SHA512

    74b132827d230bd2300fb79b4a9a8a618059125d64e10e23d8585731c7b533f967b5c5bd655f3197be380cd3db14822defdd9fbedc8163e594aa2a47d711fa5b

    Download Submit