Analysis
-
max time kernel
28s -
max time network
140s -
platform
android_x86 -
resource
android-x86-arm-20240603-en -
resource tags
-
submitted
09-06-2024 02:10
General
-
Target
k.apk
-
Size
3.7MB
-
MD5
04966506847082191728faaeb103a702
-
SHA1
1688e33eded1c7a7ab599a8fae43aca916277bf4
-
SHA256
8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65
-
SHA512
788ef82550093758583db96dd287b0bc5baecfd677ef0c645b0d9a3a424778e5c88262a62635dbcdbb718910116c9856b1d055a23fb4c891cf57e007a0ce92d3
-
SSDEEP
98304:NDmrZtDjvPToFQmz+mbQiYb9/SO1CvBUzk252NTPl:NYPDjvb6QmzDQ1111CZMsNTl
Malware Config
Signatures
-
TiSpy
TiSpy is an Android stalkerware.
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.iqxpqygg.kczlvqli1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.dbFilesize
16KB
MD53621ce0aa81e37bc5c80e2cf881f1dd0
SHA100365f82dcada94caea07443656848baf60b3bd9
SHA2568620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA51276bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
-
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-journalFilesize
512B
MD501157f3f2cd7d55a5630481462fccf59
SHA1e1d6382163b52d038b49d1608bff57c9de07469b
SHA256f2c161f82fac42baee3fb8e6e0e8b4e83d29910a911bedd7e685af634784f765
SHA5121f74e42b8589d30f89dbcb150fcdf8750330e3e535a1268f8b3dd3219f9b3fd0c6274227a0b8a280449b953c783d57e7cc120a5a49a7e19692d88bce2dfd80c3
-
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-walFilesize
28KB
MD5bb57408b9949a17355d560d612909698
SHA16cae7357561608cd919135b3d2d9a63dd8eb00e6
SHA256e855aa80f4de29a66b71e815ce38bda98065b629be8f58a847ea5c1780b6bf1b
SHA512cbc9dd53b0b23a1e1d2b7aee88f87a64edd15617b01468b7622678fbcb16ce95b22bdcff1066ab59fb0d14098c737e25a70b3356cc715ca6e18dd008618fd42f
-
/data/data/com.iqxpqygg.kczlvqli/files/477171.soFilesize
145KB
MD5c24d9a40ec1aa0148e77e3199bfc5219
SHA1081f7bb03e49dc73f70b4529abe726a60c25ad5d
SHA2568cc1b45075203b089c1360a9a550480f4f7a961d9b64af45aee01c60bc9b3770
SHA512b62f7eb20035e0b9781e43f0ea48f5f0fb8e6614d1db20f48e958913947cfba3737d321085be145882d4a5c02725b2a923dc59693e9b321533558d03a9383f0f
-
/data/data/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zipFilesize
548KB
MD5901c1337546498ed45196abc57f5f0e2
SHA16dc6e42f57eb022d481e4d61cd47e6aacffe2606
SHA2569e904cdd57bde708961e1f344995b38703876703599852a141a140db4f7ef355
SHA512ebd196dd283530d0c2269d79466293a9d9b8687caa21bbbe5547a65b7e4f7689165dfa417561a8cfbbdd8504333f69c79f35e754425792d18d8a632225622f04
-
/data/data/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zipFilesize
649KB
MD530d0c0544b01c53832c846595f6ca36f
SHA1ef7e0689e57cd65842b55bc18148061e0fc23576
SHA256a56a4e427d449054f1b09eedcc6b66727ede3bffb986c2190b6b6076ae8aeffe
SHA512d627412b88dd075b65f738ee17c4673d361007b52f1712d4a6cdb5cd16194f0a141fc0d3880d916cce342b1936b5ccc27437e87f7d441762cb095f2630e8c56a
-
/data/data/com.iqxpqygg.kczlvqli/files/dex/pro_btn_bg_animation_img_0.jpg.zipFilesize
8KB
MD57c20a2b01bf3f9df1f0abb72ebbe82be
SHA1e601b2e41434623edbeece32867517a3cdec5449
SHA2561a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
SHA5123faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4
-
/data/data/com.iqxpqygg.kczlvqli/logs/Sistema1717899672856.logFilesize
15KB
MD5723979ec59b7edc663e2456a767f4389
SHA179bc504de9ebef4e1f77b53b29c3ba0f6bdc0573
SHA256e928cf574a2607684c1413f58f7699e2e5f7bdf0ddc3d5c4a7d17b71d5155b0d
SHA5122ecbb08e3770a2a7797567b2b15473979ec21cf08713603822e23039bb66e0daa72e1febadd1e028100789ec9650348c52b2a7eab63f127c4efa5ce6ac4d1a5e
-
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zipFilesize
1.3MB
MD5d767d83c25d97d132415e2bcd4580059
SHA144849528aaf6a2b53042987010e802ea0227f0b8
SHA2569325cae8d286344ae5092984ccbaaa0638d37dd0899a246c28bd0014e7c6ced3
SHA512f0989a7cf81be3a666f17989c95121c2b641ec2e1b79011c7d4fa08e67a1011678a6f56987a99cbc4113ed17f4d821b2e30c4795175bb23aa2aae31af3110eec
-
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zipFilesize
1.7MB
MD514f20fda78ed35c6a23b0d0e0ce4ff44
SHA1e6f2a3e618414b137a8095fd798d5d7a16751a54
SHA256737f15f362f81f7bb35e9a7f20efecb270c3c329480609d26bb20a654dc9da3f
SHA51204891c5b833e54b8138f5ec9c6ced26e2a13d62696b0c6f5f856504ac37fa26de613dc45db846ed19ac226e2cfe9c0001f0f5f554b205436b8d302914d64e891
