tispy | a68d68e210a3ee6e9d8ef30c63de4658ef1023fbf27ca7c8d7b79bc6351f5677

Analysis

max time kernel
47s
max time network
140s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
15/06/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a68d68e210a3ee6e9d8ef30c63de4658ef1023fbf27ca7c8d7b79bc6351f5677.apk
Size 3.2MB
Sample240615-cdsbdavgnb
SHA256 a68d68e210a3ee6e9d8ef30c63de4658ef1023fbf27ca7c8d7b79bc6351f5677
MD5 b8316305bcb65ba0fcb97f5cd9e61bee
SHA1 9f25c81331ddd574d6882beb67e3c20194bb8056
SHA512 68d23f15b55815cde891bf81be6bf5df1256bbaaa55a1da04d3b4a69217ee98e133cf0e6600fa5ad6d667f0689229ff143e5e5fe9e9aade09836572d5cda5315
SSDEEP 49152:MjyFhDnA6ofoY/PH09ZxB+GrvqrCcfljByac1tvb7yUw2Gfk7QDiMrRb:qyFhn/2/PHYLFrymOlgaIRyt2SDiM1b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_14Jun24&rtype=T

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.tktaymsv.ywrlynun/code_cache/1718416688186.dex	4170	com.tktaymsv.ywrlynun
/data/user/0/com.tktaymsv.ywrlynun/files/dex/bsGGScoRTfDKSzfDu.zip	4170	com.tktaymsv.ywrlynun
/data/data/com.tktaymsv.ywrlynun/code_cache/1718416691690.dex	4170	com.tktaymsv.ywrlynun
/data/user/0/com.tktaymsv.ywrlynun/files/dex/bsGGScoRTfDKSzfDu.zip	4170	com.tktaymsv.ywrlynun

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.tktaymsv.ywrlynun

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.tktaymsv.ywrlynun

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.tktaymsv.ywrlynun

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tktaymsv.ywrlynun

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.tktaymsv.ywrlynun

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.tktaymsv.ywrlynun

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tktaymsv.ywrlynun

com.tktaymsv.ywrlynun
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4170

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1718416688186.dex

Path /data/data/com.tktaymsv.ywrlynun/code_cache/1718416688186.dex
Size 4KB
SHA256 401f68f4448fd6288b7619a7a2ae4646493cd7268f16aa6714802833fbc1197e
MD5 d3364728f634bf71c4b16542c02c60cb
SHA1 f23088362b69935f404f2b81eaa40ed3172efca5
SHA512 9378bbda71abcb437676a2d4095d7d3ab6a5a1c1682ec95f3f6d050b9226692cd1a29ba8e7a65dac441c29cfb7b1d5e69e34b5cc32989c90c025909567a662af
SSDEEP 96:dxd9D2sa0aBMcuwuidukEIg8aJA+BxKZyOIDyBlI2C4kZz:dZD9KdDd4Ig9JcRIDyBlu1
MD5 SHA1 SHA512 SSDEEP

Submit Download

1718416688186.dex

Path /data/data/com.tktaymsv.ywrlynun/code_cache/1718416688186.dex
Size 8KB
SHA256 bc5290425eaa32b00a84a94c58976321e7643bc5d668817524ad68a1c7d2082b
MD5 a137b5568de65b8fef35329930d8617f
SHA1 49a2d6e95d447ba1d448c81691f6a609fb2859ed
SHA512 9dd6c25dea7b3424e8ca0150a9f1f6f85ed5fccef69e7fadfa05324014b74cc350365b788cee2a8ce25afccee084908e679eafa7f449e7791c6288485d2c5338
SSDEEP 192:FzyueiOnTTdFx95sVEw7wyB0bOL3s48rdQ:EueiOn/xQV/7wsWgs48rdQ
MD5 SHA1 SHA512 SSDEEP

Download

privatesms.db

Path /data/data/com.tktaymsv.ywrlynun/databases/privatesms.db
Size 16KB
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
SSDEEP 6:l9FClq1pO64yXsfzhd6mQLuCeC9F8KCPzRtSzxERX4PBX4ogLugMBX4suuK0Dqif:TgqfO6PstjVC7nCjRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-journal

Path /data/data/com.tktaymsv.ywrlynun/databases/privatesms.db-journal
Size 512B
SHA256 b5865e7e0af1ce911f84db35d356e8bc421bf990b64d973f89d4e270dfd753b8
MD5 025264700fd254749fc958c6af65139e
SHA1 6256e87ae7bca2229ca9aee8282a4dcc1c677f4f
SHA512 ce988e376fcb06c955fca551947c0067033fea8bb5695064df07f268d389edef47157d525b903199858af0e20d17275e3231ee98304e1328edbb563946a5a0de
MD5 SHA1 SHA512

Submit Download

privatesms.db-shm

Path /data/data/com.tktaymsv.ywrlynun/databases/privatesms.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-wal

Path /data/data/com.tktaymsv.ywrlynun/databases/privatesms.db-wal
Size 28KB
SHA256 068466014a461ebd7be444924aaa75ca9f5f73f9bf50ff691d4ed5f97036cb8c
MD5 1bd422889ed92f6039237ae79a3853de
SHA1 f61c19cfe7e70bb9e677497187670b658dc05cad
SHA512 4284554c41e8aacabc7ebada0cd5f405095e9af6565fdae24d2c91230c3d92c24225fa44ea2a2f4f8900b3a60039e175a7510455e04d7cbb35cb277fdd10184f
SSDEEP 12:Ka4R1zdTRmBEyPbP/zZ+UjiOwClKwqgqfO6PstjVC7nCjRmBEyPbP/VHCfl:Kj1zyGSP/UUjwKq16YJGSP/Vwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

477312.so

Path /data/data/com.tktaymsv.ywrlynun/files/477312.so
Size 145KB
SHA256 f1f252689b59814f5fd42c5d34e5dd91659d5333915a0c5f5c3504d6eec792c4
MD5 978f89f823414f159c3bab3c24e24fca
SHA1 341e1c584a3e1314cd4d5fc6717ee560fa61c0dc
SHA512 1164ffc1babac2691a770c2b5bee170cf57d6b4fee86fc35c6fca2d61481bae7330721f728d535b88106bb40dab0cd2981f019afe5e01b85f5679b73c7aeec7d
SSDEEP 3072:cLBuzFYnl6Tqs9Wn9OLgT4toCDEhL0Ci/7NOK0D8u2Gn6yu5cQ3lMVCe5gt5SBsf:cLAzFYnl6Tqs9Wn9OLgT4toCDEhL0Cij
MD5 SHA1 SHA512 SSDEEP

Submit Download

bsGGScoRTfDKSzfDu.zip

Path /data/data/com.tktaymsv.ywrlynun/files/dex/bsGGScoRTfDKSzfDu.zip
Size 1.5MB
SHA256 31ede6fa50f9b8811d4ae2b36930ba9cc3b48ab73fc4c886a82a99c2816824bd
MD5 f3d0cd73b1928b51a4b9f79e7337e277
SHA1 c3d5bd8a5478f3f3c016a0be204554b4399257ac
SHA512 86143aca1cc7146dc3c8d11da31d170a4241b626e97693f6bec95f7833c92f5bc7e6f023d517f8df64388f36cadb345dd924fdccd3833cd195834d81c66ab230
SSDEEP 24576:Uhr/nmisuftguQo3fGKFxBfpju994gl0XCV8+4f/4oneoEPNqiTGtMoWy8Nk4JNa:Kh5B3u0Fpju993qf+4n+PNvTGWoWy8NO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sistema1718416694475.log

Path /data/data/com.tktaymsv.ywrlynun/logs/Sistema1718416694475.log
Size 9KB
SHA256 500f2d75ef52c2c5caca91bf9bdb055b531f3a83ba220ebb58dcb695cf43612e
MD5 1683ba4234653a82f0d2239586191d8e
SHA1 d543941c0e8f9c91a1347679c56770323adcb924
SHA512 ad22620be8d7ca4dabda7b6a3de2725828939c8da3243a9eb844ab5c5777ae999d5342d9c6f3bc0da3ad3fe5adaec3e7ec336eaafee81ca6107c71070292bf7f
SSDEEP 192:bbji457AiDjV8/Bm81yveJ5WhkWWbRgIlmDv59R+rXdyMWqUejc++eSG8IMcW73f:bbji457AiDjV8/Bm81yvC5WhkWWbRgIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

bsGGScoRTfDKSzfDu.zip

Path /data/user/0/com.tktaymsv.ywrlynun/files/dex/bsGGScoRTfDKSzfDu.zip
Size 3.7MB
SHA256 af7ba83757391d0b8d2d295416c9af6dd94fc052638ef8f51ba678aeee1ec7e9
MD5 f92eb42a39c7c8b0f520a4295d98e7d4
SHA1 15d7e72423ec616fbe2b895360e53e9acee4539b
SHA512 633c43df3bf80cc8382510bac31167bcdb1a8912616366c1e274f5ced38b3f13b7afa04a299b78639fae0f5776373cc70c0b0ab3b999a8925649d6d4b2e140dc
SSDEEP 49152:Xc9B43oHwSlBKXmiK62MnH4J5K9G9cqEMS+S2CKvpJvjBCH4Knl:M9B43oHLlBiK62MIvpJQ9
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads