Malware Analysis Report

2024-09-09 12:36

Sample ID 240611-cjgrtszeqe
Target 8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65
SHA256 8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65
Tags
tispy collection discovery evasion infostealer persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65

Threat Level: Known bad

The file 8dfb6601ead99c13bc66de509762236c1960fa55dcd40a0862a1e789fdf17c65 was found to be: Known bad.

Malicious Activity Summary

tispy collection discovery evasion infostealer persistence spyware trojan

TiSpy

Loads dropped Dex/Jar

Requests cell location

Queries the phone number (MSISDN for GSM devices)

Queries information about the current nearby Wi-Fi networks

Queries information about active data network

Acquires the wake lock

Queries the mobile country code (MCC)

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Requests dangerous framework permissions

Queries information about the current Wi-Fi connection

Reads information about phone network operator.

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 02:06

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 02:06

Reported

2024-06-11 02:09

Platform

android-x86-arm-20240603-en

Max time kernel

27s

Max time network

142s

Command Line

com.iqxpqygg.kczlvqli

Signatures

TiSpy

trojan infostealer spyware tispy

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip N/A N/A
N/A /data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip N/A N/A
N/A /data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip N/A N/A
N/A /data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.iqxpqygg.kczlvqli

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 216.58.212.202:443 tcp

Files

/data/data/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip

MD5 901c1337546498ed45196abc57f5f0e2
SHA1 6dc6e42f57eb022d481e4d61cd47e6aacffe2606
SHA256 9e904cdd57bde708961e1f344995b38703876703599852a141a140db4f7ef355
SHA512 ebd196dd283530d0c2269d79466293a9d9b8687caa21bbbe5547a65b7e4f7689165dfa417561a8cfbbdd8504333f69c79f35e754425792d18d8a632225622f04

/data/user/0/com.iqxpqygg.kczlvqli/files/dex/20a56d66df1cc793.zip

MD5 d767d83c25d97d132415e2bcd4580059
SHA1 44849528aaf6a2b53042987010e802ea0227f0b8
SHA256 9325cae8d286344ae5092984ccbaaa0638d37dd0899a246c28bd0014e7c6ced3
SHA512 f0989a7cf81be3a666f17989c95121c2b641ec2e1b79011c7d4fa08e67a1011678a6f56987a99cbc4113ed17f4d821b2e30c4795175bb23aa2aae31af3110eec

/data/data/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip

MD5 30d0c0544b01c53832c846595f6ca36f
SHA1 ef7e0689e57cd65842b55bc18148061e0fc23576
SHA256 a56a4e427d449054f1b09eedcc6b66727ede3bffb986c2190b6b6076ae8aeffe
SHA512 d627412b88dd075b65f738ee17c4673d361007b52f1712d4a6cdb5cd16194f0a141fc0d3880d916cce342b1936b5ccc27437e87f7d441762cb095f2630e8c56a

/data/user/0/com.iqxpqygg.kczlvqli/files/dex/ZeHWAvIvQGhZpikMk.zip

MD5 14f20fda78ed35c6a23b0d0e0ce4ff44
SHA1 e6f2a3e618414b137a8095fd798d5d7a16751a54
SHA256 737f15f362f81f7bb35e9a7f20efecb270c3c329480609d26bb20a654dc9da3f
SHA512 04891c5b833e54b8138f5ec9c6ced26e2a13d62696b0c6f5f856504ac37fa26de613dc45db846ed19ac226e2cfe9c0001f0f5f554b205436b8d302914d64e891

/data/data/com.iqxpqygg.kczlvqli/files/dex/pro_btn_bg_animation_img_0.jpg.zip

MD5 7c20a2b01bf3f9df1f0abb72ebbe82be
SHA1 e601b2e41434623edbeece32867517a3cdec5449
SHA256 1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
SHA512 3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4

/data/data/com.iqxpqygg.kczlvqli/files/477171.so

MD5 c24d9a40ec1aa0148e77e3199bfc5219
SHA1 081f7bb03e49dc73f70b4529abe726a60c25ad5d
SHA256 8cc1b45075203b089c1360a9a550480f4f7a961d9b64af45aee01c60bc9b3770
SHA512 b62f7eb20035e0b9781e43f0ea48f5f0fb8e6614d1db20f48e958913947cfba3737d321085be145882d4a5c02725b2a923dc59693e9b321533558d03a9383f0f

/data/data/com.iqxpqygg.kczlvqli/logs/Sistema1718071585887.log

MD5 54115e7c8475276a9b5920dd241c7e19
SHA1 cfa87057da6367641bf87f87a1d8b82cbbf7f9ea
SHA256 b8ede7a2ee92cc3a98080a907b7e727d2fd073bffe961e23f72f50be43e07f1a
SHA512 d97333f9c2575d4d520f7dff68d60b07503abe4bdf949dd51ac58dcfe3820382a8a985451439635301dd95795d3ee9838290a24c80aefd2f369ed58608e57754

/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-journal

MD5 f7e4ee1430c837697355b8b6a0896c23
SHA1 51f6f9d3a28fb721605d9037b37adb88de919bc6
SHA256 ca04fc93eefe284122c52ed825adc5b0f036fb92d640722de51b38af3b08a01b
SHA512 b9d3c2e631ee47b547861f616760d30a597f3e4099ca5b2055616e2e924ec80e90da728ca0672b26d095a8a61379f1d66240c1b2a441dcc239f7e20f0bba4771

/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db

MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.iqxpqygg.kczlvqli/databases/privatesms.db-wal

MD5 3b8a0669f1fb9a86191980f59fa11e80
SHA1 d8f351762fe1105981a0e91b8e22964b196b5423
SHA256 7db49f7204a0ba356f17427c31660130127dfc4a161f08ca9fb450921a2dda5a
SHA512 47c0f76f2af59ddf08510f93a4322dcb12ea554b5efac0b00fd28813d83a46b624ef5aa2296ed427f750cb5c41d9eca00412a625f424125f0db75029e6401baf