tispy | 8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65

Analysis

max time kernel
47s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
10-06-2024 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65.apk
Size

3.7MB
MD5

04966506847082191728faaeb103a702
SHA1

1688e33eded1c7a7ab599a8fae43aca916277bf4
SHA256

8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65
SHA512

788ef82550093758583db96dd287b0bc5baecfd677ef0c645b0d9a3a424778e5c88262a62635dbcdbb718910116c9856b1d055a23fb4c891cf57e007a0ce92d3
SSDEEP

98304:NDmrZtDjvPToFQmz+mbQiYb9/SO1CvBUzk252NTPl:NYPDjvb6QmzDQ1111CZMsNTl

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/20a56d66df1cc793.odex --compiler-filter=quicken --class-loader-context=&com.iqxpqygg.kczlvqli/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/ZeHWAvIvQGhZpikMk.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip	4309	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/20a56d66df1cc793.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip	4284	com.iqxpqygg.kczlvqli
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip	4335	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/ZeHWAvIvQGhZpikMk.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip	4284	com.iqxpqygg.kczlvqli
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip	4284	com.iqxpqygg.kczlvqli
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip	4284	com.iqxpqygg.kczlvqli

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.iqxpqygg.kczlvqli
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

T1430

T1627.001

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.iqxpqygg.kczlvqli
Acquires the wake lock 1 IoCs

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.iqxpqygg.kczlvqli
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.iqxpqygg.kczlvqli
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.iqxpqygg.kczlvqli
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.iqxpqygg.kczlvqli
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.iqxpqygg.kczlvqli

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.iqxpqygg.kczlvqli

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.iqxpqygg.kczlvqli

com.iqxpqygg.kczlvqli
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4284

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/20a56d66df1cc793.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4309

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iqxpqygg.kczlvqli/files/dex/oat/x86/ZeHWAvIvQGhZpikMk.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4335

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db
Filesize
16KB

MD5
3621ce0aa81e37bc5c80e2cf881f1dd0

SHA1
00365f82dcada94caea07443656848baf60b3bd9

SHA256
8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

SHA512
76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

Download Submit
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-journal
Filesize
512B

MD5
7d595b003a05f3ebb74727653520a9e4

SHA1
90f9481f91aa94703deeec01f79349d7e98f68bf

SHA256
9e960e0c0267e2e3b8da19c9b3d6fad8a4ac3606303386a536b8147c2984fff4

SHA512
ebd958707399145a332c9c0d46122c2f4384376fa0bb4ba188c97ee6b4c4498f6c9c4b997b59132766742c7340604d1fa7e6f36de9e87cc9e4061ce188cc4132

Download Submit
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-wal
Filesize
28KB

MD5
2dc44ff04b6b106eaccb779997e1178f

SHA1
e9bab9d545ab96572a1dadfdf96940cda7fd3ae2

SHA256
d2b07bbdfd46c746247bbc270ae5b43cc56354041839ed320005b49c68238e90

SHA512
f8e7caa1048f359602ced315101bf35577257c609fb7f0ddcfab793ae8e6cba51e3c5f1e803d3d6dcf30ef93c3b300e0a9586e660b51131c6c2c3118d7830a45

Download Submit
/data/data/com.iqxpqygg.kczlvqli/files/477171.so
Filesize
145KB

MD5
c24d9a40ec1aa0148e77e3199bfc5219

SHA1
081f7bb03e49dc73f70b4529abe726a60c25ad5d

SHA256
8cc1b45075203b089c1360a9a550480f4f7a961d9b64af45aee01c60bc9b3770

SHA512
b62f7eb20035e0b9781e43f0ea48f5f0fb8e6614d1db20f48e958913947cfba3737d321085be145882d4a5c02725b2a923dc59693e9b321533558d03a9383f0f

Download Submit
/data/data/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip
Filesize
548KB

MD5
901c1337546498ed45196abc57f5f0e2

SHA1
6dc6e42f57eb022d481e4d61cd47e6aacffe2606

SHA256
9e904cdd57bde708961e1f344995b38703876703599852a141a140db4f7ef355

SHA512
ebd196dd283530d0c2269d79466293a9d9b8687caa21bbbe5547a65b7e4f7689165dfa417561a8cfbbdd8504333f69c79f35e754425792d18d8a632225622f04

Download Submit
/data/data/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip
Filesize
649KB

MD5
30d0c0544b01c53832c846595f6ca36f

SHA1
ef7e0689e57cd65842b55bc18148061e0fc23576

SHA256
a56a4e427d449054f1b09eedcc6b66727ede3bffb986c2190b6b6076ae8aeffe

SHA512
d627412b88dd075b65f738ee17c4673d361007b52f1712d4a6cdb5cd16194f0a141fc0d3880d916cce342b1936b5ccc27437e87f7d441762cb095f2630e8c56a

Download Submit
/data/data/com.iqxpqygg.kczlvqli/files/dex/pro_btn_bg_animation_img_0.jpg.zip
Filesize
8KB

MD5
7c20a2b01bf3f9df1f0abb72ebbe82be

SHA1
e601b2e41434623edbeece32867517a3cdec5449

SHA256
1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e

SHA512
3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4

Download Submit
/data/data/com.iqxpqygg.kczlvqli/logs/Sistema1717989492501.log
Filesize
15KB

MD5
14fa484049c6d9e9e3f329a395fca574

SHA1
88a6c4a83720c0a96547cbb0a8a023818596a6aa

SHA256
0acf3675fb9e01e70935f8680319043c240ebf1bf0eafe61561d69cdf28af09a

SHA512
4e7fca07aaf7acd2a565abe174b7bf204ad09b5f90c88a833fcbffa8c403c52dfa60cf7d24c81bc3b02c824a1b4c8e9d9acd9a1fbd082b640b4fa6deb85aa940

Download Submit
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip
Filesize
1.3MB

MD5
c9b7b3c1515ee639262e585752ca685c

SHA1
cbd5fd393554dc80e190b53d4a12f30858ac94b2

SHA256
89ebe9ce815eb01c34c1cd2c00d3b136f8d25d4a627cabae45bdaa165eee2c32

SHA512
583ae0f0ba69ab816217a2d6034a67af8595e79f52b6a6c32d9563b6d55275ddef42e1ae79af6405a2ee98761964b6e2671e0365dad075c77c8cb96fd0f7c08e

Download Submit
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip
Filesize
1.3MB

MD5
d767d83c25d97d132415e2bcd4580059

SHA1
44849528aaf6a2b53042987010e802ea0227f0b8

SHA256
9325cae8d286344ae5092984ccbaaa0638d37dd0899a246c28bd0014e7c6ced3

SHA512
f0989a7cf81be3a666f17989c95121c2b641ec2e1b79011c7d4fa08e67a1011678a6f56987a99cbc4113ed17f4d821b2e30c4795175bb23aa2aae31af3110eec

Download Submit
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip
Filesize
1.7MB

MD5
922dfc78d375e0d820ad57be7e3831b9

SHA1
7e7da656c9c487eaedbb12f09bfdc2b50f7c742f

SHA256
13190477ad18c7a32130aaad6925b427cd8f8d1cf1ad23e35634a754df809a85

SHA512
df88fc10f8b343e8c244c7ff3095eadc93eac280c64667626e33d6caabc6f617a05a927df5b5af332ec0c9050bcb3e4d6cdf5007889eabe14bbb0d58511254cf

Download Submit
/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip
Filesize
1.7MB

MD5
14f20fda78ed35c6a23b0d0e0ce4ff44

SHA1
e6f2a3e618414b137a8095fd798d5d7a16751a54

SHA256
737f15f362f81f7bb35e9a7f20efecb270c3c329480609d26bb20a654dc9da3f

SHA512
04891c5b833e54b8138f5ec9c6ced26e2a13d62696b0c6f5f856504ac37fa26de613dc45db846ed19ac226e2cfe9c0001f0f5f554b205436b8d302914d64e891

Download Submit