Overview

overview

10

Static

static

6

bruno-sis1.apk

android-9-x86

10

Analysis

  • max time kernel
    47s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    08-06-2024 02:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bruno-sis1.apk

  • Size

    2.4MB

  • MD5

    110a7c811689311ed3f22b528268b273

  • SHA1

    f65b139be6803642d9f67cfc0594e50ccf5b1770

  • SHA256

    1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c

  • SHA512

    d08c01e192232b64ef56a39beb2bff5542012cf71cfdd3e6391d27b81d0f6dbced4381893f2ceb1381a86ceb67f5371f1739126a7839be3550b852aa959dd175

  • SSDEEP

    49152:tQ0XUBgSrmrUWmAV5QYq2rmHgLGiCmBlHjELQDv:20EDrGUWmLYKYGilALQDv

Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tispy

C2

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.lmfgqgty.rltuadcl
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4262
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/oat/x86/VNDeWFWAXpAdJZejW.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4290

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db
    Filesize

    16KB

    MD5

    3621ce0aa81e37bc5c80e2cf881f1dd0

    SHA1

    00365f82dcada94caea07443656848baf60b3bd9

    SHA256

    8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

    SHA512

    76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-journal
    Filesize

    512B

    MD5

    bae45e4f3ef7adbb9240a28affaa1575

    SHA1

    b03b0cd7d6a98bd46e233e75498f8cee4cab7d29

    SHA256

    ebb8b6446cd8b3c5b4a759c99794b2cf136d1b02c095aa57e81c635885b5d34a

    SHA512

    f958d912b837879771f46dc0a3c06223c58caf5f4aa06b73bbdadad41e27d8cc2d69985ae8ad7c64551fed4197f3c452e3b3eae7d487932e8bf69ca071cc1dad

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-wal
    Filesize

    28KB

    MD5

    08f6842915761819e0d040cf9931a8b4

    SHA1

    29cb6a77f2329e5085ced4024b54a5d569247341

    SHA256

    d62e8ad7b1953dd4340232cf78467b42a331f30b02acef1657cd7667dc128f73

    SHA512

    973971a145d8e95426c9378e76b58f686e4d3a3242801b88b1469cb26a82018e624d545da5a9f85dc7adb712e462933a5d898edc32a6ba1cf11fc22a285246fb

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/files/477162.so
    Filesize

    145KB

    MD5

    25083313ad3eed03263c3ea25cf724df

    SHA1

    d7dc6152b665211456fafeffc043ababee70b6bc

    SHA256

    49375bef5e691fa9833d1c8d6a264374bde3b0f72c3e5a24d36d977b9db9be94

    SHA512

    a4b5581c97842aeb907d462586b535014b600a15db8e1d1abd1501a8aba17ccf33ae91fe6d9b6eb60fcb8e6c42bd8d59a18406d47c98d1afa3b679fb36344b8e

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
    Filesize

    3KB

    MD5

    4651e1fd4234ee465d6fe6349f2e178d

    SHA1

    1a86fbd1edd11fa983155172d484959760c1fc0e

    SHA256

    725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

    SHA512

    6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
    Filesize

    533KB

    MD5

    29c437be3a477af81e8e2b106a42c046

    SHA1

    aba9b0c6ee636b871c0caf1e266980f167ff0c48

    SHA256

    ab8117a70c9c2933d3a50ff95d0e6c958c281a1a2f9873304d9ea9a9b095a70a

    SHA512

    582b8fe106bc273c5a5898587345f684e9d67d6933b83048b34efdbe4a363274d24d36a7deb33e81011e7047ec9fad266fb5369547d546f1985d58a6162f2a51

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/logs/Sistema1717813218782.log
    Filesize

    17KB

    MD5

    367add9e8282cae0869f9daa9f43d48c

    SHA1

    2ade53c20570929e7e53bc5c95103eff5d952c3d

    SHA256

    8fa438109b171040387a192183429831e14634e5e2af22664edc6bbc37ae947a

    SHA512

    8a73398294a86096b282368a7bf48f0c7d50fff8e31536c0f84b044f1b070fc3f62b6ca6c67c4441bd1cfe9e14d43ef93784fa0e6d82440689b7cfadf12a0a15

    Download Submit
  • /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
    Filesize

    1.3MB

    MD5

    745da5b8d4f1bdc25982c999a1641b56

    SHA1

    699b09628a66ac2a300b14dd7bccd16bd23e466f

    SHA256

    dc76f95418983da1ccd1d0168661b90f9879b96ef03c3ef1292e35fe6282e0b6

    SHA512

    2e3a700b84293e8ddf442a88fd5cfcbabc05f7eb1d1aa8ac2b891e94d82eb8a22341cc65c3dd519929e84822cdd7b242b026f7a04ed746626a5d6907c7e189ea

    Download Submit
  • /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
    Filesize

    1.3MB

    MD5

    82fb7b860fe3170b54e432c2b3973e76

    SHA1

    27943ca2023d0ec4ad57d11200e1b93ebc26e66c

    SHA256

    5aeb372bb370518ed943aacf48704b8d096194fd27c4a9d8e8b55c616e037c44

    SHA512

    74b132827d230bd2300fb79b4a9a8a618059125d64e10e23d8585731c7b533f967b5c5bd655f3197be380cd3db14822defdd9fbedc8163e594aa2a47d711fa5b

    Download Submit