tispy | 8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65

Analysis

max time kernel
47s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
09-06-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65.apk
Size

3.7MB
MD5

04966506847082191728faaeb103a702
SHA1

1688e33eded1c7a7ab599a8fae43aca916277bf4
SHA256

8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65
SHA512

788ef82550093758583db96dd287b0bc5baecfd677ef0c645b0d9a3a424778e5c88262a62635dbcdbb718910116c9856b1d055a23fb4c891cf57e007a0ce92d3
SSDEEP

98304:NDmrZtDjvPToFQmz+mbQiYb9/SO1CvBUzk252NTPl:NYPDjvb6QmzDQ1111CZMsNTl

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/20a56d66df1cc793.odex --compiler-filter=quicken --class-loader-context=&com.iqxpqygg.kczlvqli/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/ZeHWAvIvQGhZpikMk.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip	4307	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/20a56d66df1cc793.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip	4278	com.iqxpqygg.kczlvqli
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip	4332	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/ZeHWAvIvQGhZpikMk.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip	4278	com.iqxpqygg.kczlvqli
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip	4278	com.iqxpqygg.kczlvqli
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip	4278	com.iqxpqygg.kczlvqli

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.iqxpqygg.kczlvqli
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

T1430

T1627.001

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.iqxpqygg.kczlvqli
Acquires the wake lock 1 IoCs

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.iqxpqygg.kczlvqli
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.iqxpqygg.kczlvqli
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.iqxpqygg.kczlvqli
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.iqxpqygg.kczlvqli
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.iqxpqygg.kczlvqli

com.iqxpqygg.kczlvqli
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4278

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/20a56d66df1cc793.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4307

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/ZeHWAvIvQGhZpikMk.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db
Filesize
16KB

MD5
3621ce0aa81e37bc5c80e2cf881f1dd0

SHA1
00365f82dcada94caea07443656848baf60b3bd9

SHA256
8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

SHA512
76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

Download Submit
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-journal
Filesize
512B

MD5
d96e0e7cbbe3b00222b1038b91a2c408

SHA1
8590c64162b34210760a9e3f0ae7835e5c1aff74

SHA256
e0cb04f418790e6974839bab4b750249bfebbed769c54a0a1ceb730d5cf9f797

SHA512
125c948f4a1df71dda625e855d0cbd12f44b5341299eb7e11d81211a2caf9bcadaac7669fbecd9142077d9e2ff2c951c0c183fc05fc83f5632bf955b1273a19c

Download Submit
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-wal
Filesize
28KB

MD5
11c78386462cef7e211d5b9ef40195ee

SHA1
a8d184accfbd2007ff3e5f11b1ce620e9e5cbfde

SHA256
4fb2a47664bcd8435eaf7b6ca32e017df55173090801223e0b8bfed9a6a79d45

SHA512
8c44b125490a7006e82d1e69c5b89770fc075ea7a7652bf6cde8f8c479551465f07afc583f2c07c56b58c2fc28a771a6cd2994bd2a9454b4461ace51e03888b0

Download Submit
/data/data/com.iqxpqygg.kczlvqli/files/477171.so
Filesize
145KB

MD5
c24d9a40ec1aa0148e77e3199bfc5219

SHA1
081f7bb03e49dc73f70b4529abe726a60c25ad5d

SHA256
8cc1b45075203b089c1360a9a550480f4f7a961d9b64af45aee01c60bc9b3770

SHA512
b62f7eb20035e0b9781e43f0ea48f5f0fb8e6614d1db20f48e958913947cfba3737d321085be145882d4a5c02725b2a923dc59693e9b321533558d03a9383f0f

Download Submit
/data/data/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip
Filesize
548KB

MD5
901c1337546498ed45196abc57f5f0e2

SHA1
6dc6e42f57eb022d481e4d61cd47e6aacffe2606

SHA256
9e904cdd57bde708961e1f344995b38703876703599852a141a140db4f7ef355

SHA512
ebd196dd283530d0c2269d79466293a9d9b8687caa21bbbe5547a65b7e4f7689165dfa417561a8cfbbdd8504333f69c79f35e754425792d18d8a632225622f04

Download Submit
/data/data/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip
Filesize
649KB

MD5
30d0c0544b01c53832c846595f6ca36f

SHA1
ef7e0689e57cd65842b55bc18148061e0fc23576

SHA256
a56a4e427d449054f1b09eedcc6b66727ede3bffb986c2190b6b6076ae8aeffe

SHA512
d627412b88dd075b65f738ee17c4673d361007b52f1712d4a6cdb5cd16194f0a141fc0d3880d916cce342b1936b5ccc27437e87f7d441762cb095f2630e8c56a

Download Submit
/data/data/com.iqxpqygg.kczlvqli/files/dex/pro_btn_bg_animation_img_0.jpg.zip
Filesize
8KB

MD5
7c20a2b01bf3f9df1f0abb72ebbe82be

SHA1
e601b2e41434623edbeece32867517a3cdec5449

SHA256
1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e

SHA512
3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4

Download Submit
/data/data/com.iqxpqygg.kczlvqli/logs/Sistema1717899132617.log
Filesize
15KB

MD5
e815f850a1875203ce304fa87ae3894f

SHA1
2fb2f13e6a1aa3486a97796befaa67a1c9000708

SHA256
78c297289d773037c6f148710fe146923a4812d77f2bbb5b9fd9771e232ebf18

SHA512
96dfb7dae8c9d75cb6e56f530bf5da4e65c2eb697b7afd380ef836df80c8ab6d543160a41148228c1973a7472b3baaf9c7300b680cd0100035856ee9eb38926f

Download Submit
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip
Filesize
1.3MB

MD5
c9b7b3c1515ee639262e585752ca685c

SHA1
cbd5fd393554dc80e190b53d4a12f30858ac94b2

SHA256
89ebe9ce815eb01c34c1cd2c00d3b136f8d25d4a627cabae45bdaa165eee2c32

SHA512
583ae0f0ba69ab816217a2d6034a67af8595e79f52b6a6c32d9563b6d55275ddef42e1ae79af6405a2ee98761964b6e2671e0365dad075c77c8cb96fd0f7c08e

Download Submit
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip
Filesize
1.3MB

MD5
d767d83c25d97d132415e2bcd4580059

SHA1
44849528aaf6a2b53042987010e802ea0227f0b8

SHA256
9325cae8d286344ae5092984ccbaaa0638d37dd0899a246c28bd0014e7c6ced3

SHA512
f0989a7cf81be3a666f17989c95121c2b641ec2e1b79011c7d4fa08e67a1011678a6f56987a99cbc4113ed17f4d821b2e30c4795175bb23aa2aae31af3110eec

Download Submit
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip
Filesize
1.7MB

MD5
922dfc78d375e0d820ad57be7e3831b9

SHA1
7e7da656c9c487eaedbb12f09bfdc2b50f7c742f

SHA256
13190477ad18c7a32130aaad6925b427cd8f8d1cf1ad23e35634a754df809a85

SHA512
df88fc10f8b343e8c244c7ff3095eadc93eac280c64667626e33d6caabc6f617a05a927df5b5af332ec0c9050bcb3e4d6cdf5007889eabe14bbb0d58511254cf

Download Submit
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip
Filesize
1.7MB

MD5
14f20fda78ed35c6a23b0d0e0ce4ff44

SHA1
e6f2a3e618414b137a8095fd798d5d7a16751a54

SHA256
737f15f362f81f7bb35e9a7f20efecb270c3c329480609d26bb20a654dc9da3f

SHA512
04891c5b833e54b8138f5ec9c6ced26e2a13d62696b0c6f5f856504ac37fa26de613dc45db846ed19ac226e2cfe9c0001f0f5f554b205436b8d302914d64e891

Download Submit