Overview

overview

10

Static

static

6

1ccbe52642...7c.apk

android-9-x86

10

Analysis

  • max time kernel
    47s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    09-06-2024 09:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c.apk

  • Size

    2.4MB

  • MD5

    110a7c811689311ed3f22b528268b273

  • SHA1

    f65b139be6803642d9f67cfc0594e50ccf5b1770

  • SHA256

    1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c

  • SHA512

    d08c01e192232b64ef56a39beb2bff5542012cf71cfdd3e6391d27b81d0f6dbced4381893f2ceb1381a86ceb67f5371f1739126a7839be3550b852aa959dd175

  • SSDEEP

    49152:tQ0XUBgSrmrUWmAV5QYq2rmHgLGiCmBlHjELQDv:20EDrGUWmLYKYGilALQDv

Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tispy

C2

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.lmfgqgty.rltuadcl
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4272
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/oat/x86/VNDeWFWAXpAdJZejW.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db
    Filesize

    16KB

    MD5

    3621ce0aa81e37bc5c80e2cf881f1dd0

    SHA1

    00365f82dcada94caea07443656848baf60b3bd9

    SHA256

    8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

    SHA512

    76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-journal
    Filesize

    512B

    MD5

    be458faa218fc9223bd7836ff492fa52

    SHA1

    3d14086707dd6c6897bf9c98060fc32ae6c6229d

    SHA256

    d9a23778d41657a1c4b647823467ecf038178453fa56a2c978629643581e0ab9

    SHA512

    49a4e9df78e0b8ec0c2cb2e457079c21ec081929f1c2ccf6407391973a0eca744097b17b8cf62b33d88da2e986e1b4ba16b49179ab2c68f1c6925939e4075f12

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-wal
    Filesize

    28KB

    MD5

    64d8ea32250e6a9146fed671e1a1b481

    SHA1

    57cfa5d17191888774b733b5cc0b453a2833acb2

    SHA256

    5b36b15f52fc2560a6e4e2cb0ce30ed25eb8ecad5799a0e95de850ca55554044

    SHA512

    d59503ae591ded1c4c35cbd5e27641f1d534aa7759d8dfd23e8e6bd5728db05451221410bcc4f0f5963373ecc4343659ff53a2939183b0f6f4ac6d720b12bd02

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/files/477162.so
    Filesize

    145KB

    MD5

    25083313ad3eed03263c3ea25cf724df

    SHA1

    d7dc6152b665211456fafeffc043ababee70b6bc

    SHA256

    49375bef5e691fa9833d1c8d6a264374bde3b0f72c3e5a24d36d977b9db9be94

    SHA512

    a4b5581c97842aeb907d462586b535014b600a15db8e1d1abd1501a8aba17ccf33ae91fe6d9b6eb60fcb8e6c42bd8d59a18406d47c98d1afa3b679fb36344b8e

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
    Filesize

    3KB

    MD5

    4651e1fd4234ee465d6fe6349f2e178d

    SHA1

    1a86fbd1edd11fa983155172d484959760c1fc0e

    SHA256

    725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

    SHA512

    6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
    Filesize

    533KB

    MD5

    29c437be3a477af81e8e2b106a42c046

    SHA1

    aba9b0c6ee636b871c0caf1e266980f167ff0c48

    SHA256

    ab8117a70c9c2933d3a50ff95d0e6c958c281a1a2f9873304d9ea9a9b095a70a

    SHA512

    582b8fe106bc273c5a5898587345f684e9d67d6933b83048b34efdbe4a363274d24d36a7deb33e81011e7047ec9fad266fb5369547d546f1985d58a6162f2a51

    Download Submit
  • /data/data/com.lmfgqgty.rltuadcl/logs/Sistema1717924098368.log
    Filesize

    17KB

    MD5

    9393379a3e11ac8d8e4d866fac0a11fb

    SHA1

    683e6223ec53186471a846e66e88a06ae6255e34

    SHA256

    f75d4b03ef36ec73d2ea6ebf11fadba65217aca3656c5e87d88b50b7c6f3ada1

    SHA512

    d84adc799937ed33179b0eb29528ce10f867d89fd913dde6b496c03168e0204e16ee0f038dab6e6712520696da1dbb82ff56d08c31741917d8324531f485d8d3

    Download Submit
  • /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
    Filesize

    1.3MB

    MD5

    745da5b8d4f1bdc25982c999a1641b56

    SHA1

    699b09628a66ac2a300b14dd7bccd16bd23e466f

    SHA256

    dc76f95418983da1ccd1d0168661b90f9879b96ef03c3ef1292e35fe6282e0b6

    SHA512

    2e3a700b84293e8ddf442a88fd5cfcbabc05f7eb1d1aa8ac2b891e94d82eb8a22341cc65c3dd519929e84822cdd7b242b026f7a04ed746626a5d6907c7e189ea

    Download Submit
  • /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip
    Filesize

    1.3MB

    MD5

    82fb7b860fe3170b54e432c2b3973e76

    SHA1

    27943ca2023d0ec4ad57d11200e1b93ebc26e66c

    SHA256

    5aeb372bb370518ed943aacf48704b8d096194fd27c4a9d8e8b55c616e037c44

    SHA512

    74b132827d230bd2300fb79b4a9a8a618059125d64e10e23d8585731c7b533f967b5c5bd655f3197be380cd3db14822defdd9fbedc8163e594aa2a47d711fa5b

    Download Submit