Overview

overview

10

Static

static

6

5b0433322c...33.apk

android-9-x86

10

Analysis

  • max time kernel
    46s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    12/06/2024, 01:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b0433322ca9eaad7b70fdc00869afdf0b410f3ca347e81f11aa7cd452a22833.apk

  • Size

    2.4MB

  • MD5

    44721c08bd87a8798b3b788b485a64f0

  • SHA1

    c0f291493bdcfdfe35b4e49fac1fbe410e79b463

  • SHA256

    5b0433322ca9eaad7b70fdc00869afdf0b410f3ca347e81f11aa7cd452a22833

  • SHA512

    d55d607a2ae2ad9a6e6a3359003e07c193bd578d9757c2366f26ab065a88ec5a3074af526c9b721a492bd196b7d4492c0421eb9bf071592397983a989e3954ca

  • SSDEEP

    49152:XcCwLASD4d6R0LrLd0mM1/0DfrkpNtS/Fb6o+95WJ:Xc9hEd80JLk/arkpNcN6D3WJ

Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tispy

C2

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.yesfnnsd.augrmbyw
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4236
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.yesfnnsd.augrmbyw/files/dex/heiHJcYNJyXgeJWsB.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.yesfnnsd.augrmbyw/files/dex/oat/x86/heiHJcYNJyXgeJWsB.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4300

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yesfnnsd.augrmbyw/databases/privatesms.db
    Filesize

    16KB

    MD5

    3621ce0aa81e37bc5c80e2cf881f1dd0

    SHA1

    00365f82dcada94caea07443656848baf60b3bd9

    SHA256

    8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

    SHA512

    76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

    Download Submit

  • /data/data/com.yesfnnsd.augrmbyw/databases/privatesms.db-journal
    Filesize

    512B

    MD5

    d08882be5b5e4bdc843f9dfad7b17397

    SHA1

    463f6b18868be3b21bd0a422c3581b74e7e281d9

    SHA256

    6e54e214a3761dac8d060909adc079bb8870d0c785855a23b5d467c3c9f964fa

    SHA512

    0ba6c350a90b258668f1f5b0a42129f4658bc7a8056a0a977f23a0cf33c3d0e706cf5fb464c4beea606bd347ec8e361dda94758fb6193ac7587f3d186422f30a

    Download Submit

  • /data/data/com.yesfnnsd.augrmbyw/databases/privatesms.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit

  • /data/data/com.yesfnnsd.augrmbyw/databases/privatesms.db-wal
    Filesize

    28KB

    MD5

    db89a3a0a1bad0628db33bddb81db03e

    SHA1

    9f019cc293bc2cc92f8aadbf18b52e16ab64f347

    SHA256

    e1530fd5fa4d7e1b38322dea1ee86c84feef0e078bd42deca89cfc22c1380a80

    SHA512

    7e7bb21337c736c0713511130acb2d58c0e712722e7eb8a1b5e1d1657c1202ae8ba76df0863e2175c28c5653911cdc0ed6d31047813439e2f3027db968c0af88

    Download Submit

  • /data/data/com.yesfnnsd.augrmbyw/files/477239.so
    Filesize

    145KB

    MD5

    092c7c60a14e4e8d33b2726ee0be6f33

    SHA1

    a7ea41c575a5dba95994de58eec34b3f3ce5fb93

    SHA256

    dbfb0d952a503c626c29acacdc6b9f683630270bbe8a4ec45d491656bc1cf7fb

    SHA512

    1126ba57eedcf5d4e87a3424a328d76579961e670778fa515ca84b917e6437aca9606784bcd45088a45cc93a2f27a071e21113a0a899a9c44af7fe6425198373

    Download Submit

  • /data/data/com.yesfnnsd.augrmbyw/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
    Filesize

    3KB

    MD5

    4651e1fd4234ee465d6fe6349f2e178d

    SHA1

    1a86fbd1edd11fa983155172d484959760c1fc0e

    SHA256

    725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

    SHA512

    6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

    Download Submit

  • /data/data/com.yesfnnsd.augrmbyw/files/dex/heiHJcYNJyXgeJWsB.zip
    Filesize

    535KB

    MD5

    4900551be6719d3da0e009793b92b415

    SHA1

    afa2ce8b462496bc73f7adf9a98e1f57dc0efc7e

    SHA256

    9f6fac7574f39079c006a061927b9c7d8d26f550d1fd989fa8c0f951b4fc22d0

    SHA512

    4257157371bcc7fb969d749fff2886237aa38ce4ba2a67e36922f6d49a81d85a2f402c90fa7abd9ad20f87333110e06ee5b4ced8b87c6ea4124059994064785d

    Download Submit

  • /data/data/com.yesfnnsd.augrmbyw/logs/Sistema1718155780281.log
    Filesize

    17KB

    MD5

    2b2c6455a54a7cd97037399af1f02e34

    SHA1

    436e5e9eb9465a72c78b304a8023ce8e90f38faa

    SHA256

    28761db1f0e3c8043010906681e4a4e92cf7e8bbad6083d7a59da7d0cf1639e5

    SHA512

    c6a991e72750a5d089fa9f031cfc7c84029e30c057c7d3b48b17e8ca206764deaf2e7cf14b21bc940ee13d4f079c77bae6376964b188e397dad88fb7a2fe09ec

    Download Submit

  • /data/user/0/com.yesfnnsd.augrmbyw/files/dex/heiHJcYNJyXgeJWsB.zip
    Filesize

    1.3MB

    MD5

    2fca717553f3a57a310dd62f3e054a78

    SHA1

    268b65170833521d4cc6420aaa0bf3146090ece2

    SHA256

    a12c0dfa982c59533bb81773c081de112b20a163c8fcd5ac88bc0dec7a535cc1

    SHA512

    f56e62e21118a08ca62fa233697ce1af47c0d41337359dece480401d5eb32904e88fbd1e720b2e6882f55cdc135e2fc6ca4809b1c007c8151f4daa6e7c04dbab

    Download Submit

  • /data/user/0/com.yesfnnsd.augrmbyw/files/dex/heiHJcYNJyXgeJWsB.zip
    Filesize

    1.3MB

    MD5

    68ff4fc6abb64c63563332ea00c704b3

    SHA1

    9560944fc59c9ff7a5ccde300f6aba16c106a33a

    SHA256

    96e7821984ade95af17d83c735895ed1d1b4a70dd9be9285f5a34b564a221157

    SHA512

    9b8d3ad8b64a77b73af1cfb4b42f9c745614034d684d8a37454ff5687a4e7fc92a5547b1ec448ba0f452e3e6e7ce6937ccc907bb03a606ec0d9789fcf4c557d5

    Download Submit