tispy | 1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c

Analysis

max time kernel
47s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
09-06-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c.apk
Size

2.4MB
MD5

110a7c811689311ed3f22b528268b273
SHA1

f65b139be6803642d9f67cfc0594e50ccf5b1770
SHA256

1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c
SHA512

d08c01e192232b64ef56a39beb2bff5542012cf71cfdd3e6391d27b81d0f6dbced4381893f2ceb1381a86ceb67f5371f1739126a7839be3550b852aa959dd175
SSDEEP

49152:tQ0XUBgSrmrUWmAV5QYq2rmHgLGiCmBlHjELQDv:20EDrGUWmLYKYGilALQDv

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/oat/x86/VNDeWFWAXpAdJZejW.odex --compiler-filter=quicken --class-loader-context=&com.lmfgqgty.rltuadcl

ioc	pid	process
/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip	4297	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/oat/x86/VNDeWFWAXpAdJZejW.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip	4271	com.lmfgqgty.rltuadcl

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

com.lmfgqgty.rltuadcl

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.lmfgqgty.rltuadcl
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

T1430

T1627.001

Processes:

com.lmfgqgty.rltuadcl

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.lmfgqgty.rltuadcl
Acquires the wake lock 1 IoCs

Processes:

com.lmfgqgty.rltuadcl

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.lmfgqgty.rltuadcl
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.lmfgqgty.rltuadcl

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.lmfgqgty.rltuadcl
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.lmfgqgty.rltuadcl

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.lmfgqgty.rltuadcl
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.lmfgqgty.rltuadcl

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.lmfgqgty.rltuadcl
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.lmfgqgty.rltuadcl

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.lmfgqgty.rltuadcl
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.lmfgqgty.rltuadcl

description ioc process

File opened for read /proc/cpuinfo com.lmfgqgty.rltuadcl
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.lmfgqgty.rltuadcl

description ioc process

File opened for read /proc/meminfo com.lmfgqgty.rltuadcl

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.lmfgqgty.rltuadcl

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.lmfgqgty.rltuadcl

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lmfgqgty.rltuadcl

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lmfgqgty.rltuadcl

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lmfgqgty.rltuadcl

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.lmfgqgty.rltuadcl

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.lmfgqgty.rltuadcl

description	ioc	process
File opened for read	/proc/cpuinfo	com.lmfgqgty.rltuadcl

description	ioc	process
File opened for read	/proc/meminfo	com.lmfgqgty.rltuadcl

com.lmfgqgty.rltuadcl
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4271

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/oat/x86/VNDeWFWAXpAdJZejW.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4297

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db
Filesize
16KB

MD5
3621ce0aa81e37bc5c80e2cf881f1dd0

SHA1
00365f82dcada94caea07443656848baf60b3bd9

SHA256
8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

SHA512
76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

Download Submit
/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-journal
Filesize
512B

MD5
ecab364f81e3a9a2158f177e55a68043

SHA1
a16e9c6dc07f0e82628f0df5203fcc76798c0e3a

SHA256
0f4c121e04e4cc8deca0e26fbff245c80190d656ac1337f010227d3e87e191f8

SHA512
4060166215409619badee75b31f74db6129d341bba44e04878cbd837836441ff85743451654ef8bb66e5c86932c8648bd5208ed43369384f11ff88e446f9a3f3

Download Submit
/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-wal
Filesize
28KB

MD5
1fb7765cb9876137e68126bb3d25b6c4

SHA1
62a6a65f810db919ba9bccacb865a28688b731ad

SHA256
cd2af1c4a675e116741266caed5400d76caa66c889df4ebfa5bd1e724390a306

SHA512
60d00a06be331b9cc3d28645e0d0f65beed3fd2d68d0ff2ebf92baf8162f5c879d8ea7fb640a8370ed09b53930b605730dbca8edd64262bf929f0dd9f30443c7

Download Submit
/data/data/com.lmfgqgty.rltuadcl/files/477162.so
Filesize
145KB

MD5
25083313ad3eed03263c3ea25cf724df

SHA1
d7dc6152b665211456fafeffc043ababee70b6bc

SHA256
49375bef5e691fa9833d1c8d6a264374bde3b0f72c3e5a24d36d977b9db9be94

SHA512
a4b5581c97842aeb907d462586b535014b600a15db8e1d1abd1501a8aba17ccf33ae91fe6d9b6eb60fcb8e6c42bd8d59a18406d47c98d1afa3b679fb36344b8e

Download Submit
/data/data/com.lmfgqgty.rltuadcl/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
Filesize
3KB

MD5
4651e1fd4234ee465d6fe6349f2e178d

SHA1
1a86fbd1edd11fa983155172d484959760c1fc0e

SHA256
725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

SHA512
6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

Download Submit
/data/data/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
Filesize
533KB

MD5
29c437be3a477af81e8e2b106a42c046

SHA1
aba9b0c6ee636b871c0caf1e266980f167ff0c48

SHA256
ab8117a70c9c2933d3a50ff95d0e6c958c281a1a2f9873304d9ea9a9b095a70a

SHA512
582b8fe106bc273c5a5898587345f684e9d67d6933b83048b34efdbe4a363274d24d36a7deb33e81011e7047ec9fad266fb5369547d546f1985d58a6162f2a51

Download Submit
/data/data/com.lmfgqgty.rltuadcl/logs/Sistema1717895482003.log
Filesize
17KB

MD5
ce695c703606caccd22f855edf2be68b

SHA1
3c8af8501868753ffedafbe99b943634dcfbf518

SHA256
241953ff2f520b835a7ca5d67dd6d1ad56786190468fba1f94610ae3e0fcb2f4

SHA512
c268b6a323cd36b3a698dbbf1c57ecb391f45ed5fb94e0c8494f9d7a02db6bc9e61f51b34e2284dbfffa43ad1dcb2219472a32e73dfc8023b078cf7a1d9e8669

Download Submit
/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
Filesize
1.3MB

MD5
745da5b8d4f1bdc25982c999a1641b56

SHA1
699b09628a66ac2a300b14dd7bccd16bd23e466f

SHA256
dc76f95418983da1ccd1d0168661b90f9879b96ef03c3ef1292e35fe6282e0b6

SHA512
2e3a700b84293e8ddf442a88fd5cfcbabc05f7eb1d1aa8ac2b891e94d82eb8a22341cc65c3dd519929e84822cdd7b242b026f7a04ed746626a5d6907c7e189ea

Download Submit
/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
Filesize
1.3MB

MD5
82fb7b860fe3170b54e432c2b3973e76

SHA1
27943ca2023d0ec4ad57d11200e1b93ebc26e66c

SHA256
5aeb372bb370518ed943aacf48704b8d096194fd27c4a9d8e8b55c616e037c44

SHA512
74b132827d230bd2300fb79b4a9a8a618059125d64e10e23d8585731c7b533f967b5c5bd655f3197be380cd3db14822defdd9fbedc8163e594aa2a47d711fa5b

Download Submit