General

  • Target
    a68d68e210a3ee6e9d8ef30c63de4658ef1023fbf27ca7c8d7b79bc6351f5677.apk
  • Size 3.2MB
  • Sample240615-cdsbdavgnb
  • SHA256 a68d68e210a3ee6e9d8ef30c63de4658ef1023fbf27ca7c8d7b79bc6351f5677
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • tispy

C2
  • https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_14Jun24&rtype=T

Targets

    • Target
      a68d68e210a3ee6e9d8ef30c63de4658ef1023fbf27ca7c8d7b79bc6351f5677.apk
    • Size 3.2MB
    • SHA256 a68d68e210a3ee6e9d8ef30c63de4658ef1023fbf27ca7c8d7b79bc6351f5677
    • MD5 SHA1 SHA512 SSDEEP
    • TiSpy

      TiSpy is an Android stalkerware.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Queries the phone number (MSISDN for GSM devices)

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Acquires the wake lock

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks