Malware Analysis Report

2024-09-09 12:32

Sample ID 240609-k2qfpahb96
Target 1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c.apk
SHA256 1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c
Tags
tispy collection discovery evasion infostealer persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c

Threat Level: Known bad

The file 1ccbe52642f80b711434602006b11e0ca5d0e93c5114935397e853782231927c.apk was found to be: Known bad.

Malicious Activity Summary

tispy collection discovery evasion infostealer persistence spyware trojan

TiSpy

Queries information about the current nearby Wi-Fi networks

Loads dropped Dex/Jar

Queries the phone number (MSISDN for GSM devices)

Requests cell location

Queries information about the current Wi-Fi connection

Declares services with permission to bind to the system

Declares broadcast receivers with permission to handle system events

Acquires the wake lock

Queries the mobile country code (MCC)

Requests dangerous framework permissions

Queries information about active data network

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks CPU information

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-09 09:08

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 09:06

Reported

2024-06-09 09:11

Platform

android-x86-arm-20240603-en

Max time kernel

47s

Max time network

130s

Command Line

com.lmfgqgty.rltuadcl

Signatures

TiSpy

trojan infostealer spyware tispy

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip N/A N/A
N/A /data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Checks CPU information

Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.lmfgqgty.rltuadcl

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lmfgqgty.rltuadcl/files/dex/oat/x86/VNDeWFWAXpAdJZejW.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 brunoespiao.com.br udp
US 104.21.49.104:443 brunoespiao.com.br tcp
US 1.1.1.1:53 thypix.com udp
US 104.21.19.250:443 thypix.com tcp
US 1.1.1.1:53 pc.brunoespiao.com.br udp
US 34.200.160.51:443 pc.brunoespiao.com.br tcp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp

Files

/data/data/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip

MD5 29c437be3a477af81e8e2b106a42c046
SHA1 aba9b0c6ee636b871c0caf1e266980f167ff0c48
SHA256 ab8117a70c9c2933d3a50ff95d0e6c958c281a1a2f9873304d9ea9a9b095a70a
SHA512 582b8fe106bc273c5a5898587345f684e9d67d6933b83048b34efdbe4a363274d24d36a7deb33e81011e7047ec9fad266fb5369547d546f1985d58a6162f2a51

/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip

MD5 82fb7b860fe3170b54e432c2b3973e76
SHA1 27943ca2023d0ec4ad57d11200e1b93ebc26e66c
SHA256 5aeb372bb370518ed943aacf48704b8d096194fd27c4a9d8e8b55c616e037c44
SHA512 74b132827d230bd2300fb79b4a9a8a618059125d64e10e23d8585731c7b533f967b5c5bd655f3197be380cd3db14822defdd9fbedc8163e594aa2a47d711fa5b

/data/user/0/com.lmfgqgty.rltuadcl/files/dex/VNDeWFWAXpAdJZejW.zip

MD5 745da5b8d4f1bdc25982c999a1641b56
SHA1 699b09628a66ac2a300b14dd7bccd16bd23e466f
SHA256 dc76f95418983da1ccd1d0168661b90f9879b96ef03c3ef1292e35fe6282e0b6
SHA512 2e3a700b84293e8ddf442a88fd5cfcbabc05f7eb1d1aa8ac2b891e94d82eb8a22341cc65c3dd519929e84822cdd7b242b026f7a04ed746626a5d6907c7e189ea

/data/data/com.lmfgqgty.rltuadcl/files/477162.so

MD5 25083313ad3eed03263c3ea25cf724df
SHA1 d7dc6152b665211456fafeffc043ababee70b6bc
SHA256 49375bef5e691fa9833d1c8d6a264374bde3b0f72c3e5a24d36d977b9db9be94
SHA512 a4b5581c97842aeb907d462586b535014b600a15db8e1d1abd1501a8aba17ccf33ae91fe6d9b6eb60fcb8e6c42bd8d59a18406d47c98d1afa3b679fb36344b8e

/data/data/com.lmfgqgty.rltuadcl/logs/Sistema1717924098368.log

MD5 9393379a3e11ac8d8e4d866fac0a11fb
SHA1 683e6223ec53186471a846e66e88a06ae6255e34
SHA256 f75d4b03ef36ec73d2ea6ebf11fadba65217aca3656c5e87d88b50b7c6f3ada1
SHA512 d84adc799937ed33179b0eb29528ce10f867d89fd913dde6b496c03168e0204e16ee0f038dab6e6712520696da1dbb82ff56d08c31741917d8324531f485d8d3

/data/data/com.lmfgqgty.rltuadcl/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg

MD5 4651e1fd4234ee465d6fe6349f2e178d
SHA1 1a86fbd1edd11fa983155172d484959760c1fc0e
SHA256 725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b
SHA512 6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-journal

MD5 be458faa218fc9223bd7836ff492fa52
SHA1 3d14086707dd6c6897bf9c98060fc32ae6c6229d
SHA256 d9a23778d41657a1c4b647823467ecf038178453fa56a2c978629643581e0ab9
SHA512 49a4e9df78e0b8ec0c2cb2e457079c21ec081929f1c2ccf6407391973a0eca744097b17b8cf62b33d88da2e986e1b4ba16b49179ab2c68f1c6925939e4075f12

/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db

MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.lmfgqgty.rltuadcl/databases/privatesms.db-wal

MD5 64d8ea32250e6a9146fed671e1a1b481
SHA1 57cfa5d17191888774b733b5cc0b453a2833acb2
SHA256 5b36b15f52fc2560a6e4e2cb0ce30ed25eb8ecad5799a0e95de850ca55554044
SHA512 d59503ae591ded1c4c35cbd5e27641f1d534aa7759d8dfd23e8e6bd5728db05451221410bcc4f0f5963373ecc4343659ff53a2939183b0f6f4ac6d720b12bd02