Malware Analysis Report

2024-09-09 12:32

Sample ID 240609-bjfzvsbc5s
Target 1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c.apk
SHA256 1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c
Tags
tispy collection discovery evasion infostealer persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c

Threat Level: Known bad

The file 1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c.apk was found to be: Known bad.

Malicious Activity Summary

tispy collection discovery evasion infostealer persistence spyware trojan

TiSpy

Queries the phone number (MSISDN for GSM devices)

Loads dropped Dex/Jar

Queries information about the current nearby Wi-Fi networks

Requests cell location

Queries information about the current Wi-Fi connection

Declares services with permission to bind to the system

Requests dangerous framework permissions

Acquires the wake lock

Queries the mobile country code (MCC)

Declares broadcast receivers with permission to handle system events

Queries information about active data network

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-09 01:11

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 01:10

Reported

2024-06-09 01:14

Platform

android-x86-arm-20240603-en

Max time kernel

47s

Max time network

131s

Command Line

com.lmfgqgty.rltuadcl

Signatures

TiSpy

trojan infostealer spyware tispy

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip N/A N/A
N/A /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.lmfgqgty.rltuadcl

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/oat/x86/VNDeWFWAXpAdJZejW.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 brunoespiao.com.br udp
US 104.21.49.104:443 brunoespiao.com.br tcp
US 1.1.1.1:53 thypix.com udp
US 104.21.19.250:443 thypix.com tcp
US 1.1.1.1:53 pc.brunoespiao.com.br udp
US 34.200.160.51:443 pc.brunoespiao.com.br tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp

Files

/data/data/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip

MD5 29c437be3a477af81e8e2b106a42c046
SHA1 aba9b0c6ee636b871c0caf1e266980f167ff0c48
SHA256 ab8117a70c9c2933d3a50ff95d0e6c958c281a1a2f9873304d9ea9a9b095a70a
SHA512 582b8fe106bc273c5a5898587345f684e9d67d6933b83048b34efdbe4a363274d24d36a7deb33e81011e7047ec9fad266fb5369547d546f1985d58a6162f2a51

/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip

MD5 82fb7b860fe3170b54e432c2b3973e76
SHA1 27943ca2023d0ec4ad57d11200e1b93ebc26e66c
SHA256 5aeb372bb370518ed943aacf48704b8d096194fd27c4a9d8e8b55c616e037c44
SHA512 74b132827d230bd2300fb79b4a9a8a618059125d64e10e23d8585731c7b533f967b5c5bd655f3197be380cd3db14822defdd9fbedc8163e594aa2a47d711fa5b

/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip

MD5 745da5b8d4f1bdc25982c999a1641b56
SHA1 699b09628a66ac2a300b14dd7bccd16bd23e466f
SHA256 dc76f95418983da1ccd1d0168661b90f9879b96ef03c3ef1292e35fe6282e0b6
SHA512 2e3a700b84293e8ddf442a88fd5cfcbabc05f7eb1d1aa8ac2b891e94d82eb8a22341cc65c3dd519929e84822cdd7b242b026f7a04ed746626a5d6907c7e189ea

/data/data/com.lmfgqgty.rltuadcl/files/477162.so

MD5 25083313ad3eed03263c3ea25cf724df
SHA1 d7dc6152b665211456fafeffc043ababee70b6bc
SHA256 49375bef5e691fa9833d1c8d6a264374bde3b0f72c3e5a24d36d977b9db9be94
SHA512 a4b5581c97842aeb907d462586b535014b600a15db8e1d1abd1501a8aba17ccf33ae91fe6d9b6eb60fcb8e6c42bd8d59a18406d47c98d1afa3b679fb36344b8e

/data/data/com.lmfgqgty.rltuadcl/logs/Sistema1717895482003.log

MD5 ce695c703606caccd22f855edf2be68b
SHA1 3c8af8501868753ffedafbe99b943634dcfbf518
SHA256 241953ff2f520b835a7ca5d67dd6d1ad56786190468fba1f94610ae3e0fcb2f4
SHA512 c268b6a323cd36b3a698dbbf1c57ecb391f45ed5fb94e0c8494f9d7a02db6bc9e61f51b34e2284dbfffa43ad1dcb2219472a32e73dfc8023b078cf7a1d9e8669

/data/data/com.lmfgqgty.rltuadcl/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg

MD5 4651e1fd4234ee465d6fe6349f2e178d
SHA1 1a86fbd1edd11fa983155172d484959760c1fc0e
SHA256 725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b
SHA512 6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-journal

MD5 ecab364f81e3a9a2158f177e55a68043
SHA1 a16e9c6dc07f0e82628f0df5203fcc76798c0e3a
SHA256 0f4c121e04e4cc8deca0e26fbff245c80190d656ac1337f010227d3e87e191f8
SHA512 4060166215409619badee75b31f74db6129d341bba44e04878cbd837836441ff85743451654ef8bb66e5c86932c8648bd5208ed43369384f11ff88e446f9a3f3

/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db

MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-wal

MD5 1fb7765cb9876137e68126bb3d25b6c4
SHA1 62a6a65f810db919ba9bccacb865a28688b731ad
SHA256 cd2af1c4a675e116741266caed5400d76caa66c889df4ebfa5bd1e724390a306
SHA512 60d00a06be331b9cc3d28645e0d0f65beed3fd2d68d0ff2ebf92baf8162f5c879d8ea7fb640a8370ed09b53930b605730dbca8edd64262bf929f0dd9f30443c7