tispy | ab5b46359799fbe4eeb71dd98eef602b5f6d061b75313269af094468620cb231

Analysis

max time kernel
47s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
16-06-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab5b46359799fbe4eeb71dd98eef602b5f6d061b75313269af094468620cb231.apk
Size

2.4MB
MD5

c72e0e86b3e50b121a61c859c6f41c95
SHA1

db6be970421d00ed78fc044b560381924db30cd7
SHA256

ab5b46359799fbe4eeb71dd98eef602b5f6d061b75313269af094468620cb231
SHA512

d843acaf2c42788e482a5408208bbe5b3c6c01decf4bfa66348eb8181e4c42b7560d0b00355235aa5ad0d7ca0c770ac2a5468e6c82637d75e5b1d439570b5e5a
SSDEEP

49152:nTR8toSVX3dwzMB9nlpqj1b4aF3Bz5UA8D8Pq12xNE/Bh:nTeDVXNkMHXqj1bjfzVsAq12xNGb

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://brunoespiao.com.br/esp/appprofile.jsp

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.qzebzpxm.dblcvwjv

ioc	pid	process
/data/user/0/com.qzebzpxm.dblcvwjv/files/dex/xghesDnsiIxRNokie.zip	4193	com.qzebzpxm.dblcvwjv
/data/user/0/com.qzebzpxm.dblcvwjv/files/dex/xghesDnsiIxRNokie.zip	4193	com.qzebzpxm.dblcvwjv

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

com.qzebzpxm.dblcvwjv

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.qzebzpxm.dblcvwjv
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

T1430

T1627.001

Processes:

com.qzebzpxm.dblcvwjv

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.qzebzpxm.dblcvwjv
Acquires the wake lock 1 IoCs

Processes:

com.qzebzpxm.dblcvwjv

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.qzebzpxm.dblcvwjv
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.qzebzpxm.dblcvwjv

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.qzebzpxm.dblcvwjv
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.qzebzpxm.dblcvwjv

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.qzebzpxm.dblcvwjv
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.qzebzpxm.dblcvwjv

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.qzebzpxm.dblcvwjv
Reads information about phone network operator. 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.qzebzpxm.dblcvwjv

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.qzebzpxm.dblcvwjv
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.qzebzpxm.dblcvwjv

description ioc process

File opened for read /proc/cpuinfo com.qzebzpxm.dblcvwjv
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.qzebzpxm.dblcvwjv

description ioc process

File opened for read /proc/meminfo com.qzebzpxm.dblcvwjv

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.qzebzpxm.dblcvwjv

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.qzebzpxm.dblcvwjv

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.qzebzpxm.dblcvwjv

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qzebzpxm.dblcvwjv

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qzebzpxm.dblcvwjv

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.qzebzpxm.dblcvwjv

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.qzebzpxm.dblcvwjv

description	ioc	process
File opened for read	/proc/cpuinfo	com.qzebzpxm.dblcvwjv

description	ioc	process
File opened for read	/proc/meminfo	com.qzebzpxm.dblcvwjv

com.qzebzpxm.dblcvwjv
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4193

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qzebzpxm.dblcvwjv/databases/privatesms.db
Filesize
16KB

MD5
3621ce0aa81e37bc5c80e2cf881f1dd0

SHA1
00365f82dcada94caea07443656848baf60b3bd9

SHA256
8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

SHA512
76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

Download Submit
/data/data/com.qzebzpxm.dblcvwjv/databases/privatesms.db-journal
Filesize
512B

MD5
362c630a8e2cfebc26e9c67d50578dcd

SHA1
6c63548a23c900772727539d469d3d0fed9b3e53

SHA256
dc66ac1eb5ea996812ebab512a2e53f15c7607ea6fb29811818f9f2a72aefa53

SHA512
daf3e43a816a5a07862156301662aa43da34a63f8e36732d9eb65a611697db37ab7fa908f7548b6fa6a4fbc5203faa2dc62119bd5c6573f67a95f838f5616f07

Download Submit
/data/data/com.qzebzpxm.dblcvwjv/databases/privatesms.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.qzebzpxm.dblcvwjv/databases/privatesms.db-wal
Filesize
28KB

MD5
ce77a100d9cd54e9fa776f4c7a9f11de

SHA1
fca1543c550cfa820171040b6b1fc401940352a0

SHA256
d1f5864642c85398f5c61b3a2e4e9b2487171dd9c2ec20446297b1490d67ccee

SHA512
e4f14fbc1b35963249b98b6af2c9fa5847ed39f0fd306fc2d13606dadd660f6254c1283ae25d1920b71cada8bf2a9dc6b2be24222f5ac524344f66c53cb8639f

Download Submit
/data/data/com.qzebzpxm.dblcvwjv/files/477359.so
Filesize
145KB

MD5
e22fcd32a84d91d3f89461c181c4d986

SHA1
ce3c7943e29f219cbfb5092880f01d9d1ec9a9f3

SHA256
418bc1e21263518fd298428ceb3a632ae2ca8d98a2bd350acfc61973bb4b70cd

SHA512
e466150c7c76a5cf683f2a76c1aadd1a7748fa2a19e204331566cc5d023e59665e611db35cb563b029675056c03971c459e3d37bb7d902517ba86ab98e3a79e9

Download Submit
/data/data/com.qzebzpxm.dblcvwjv/files/Background/black-wallpapers-for-smartphone-102-700x990.jpg
Filesize
3KB

MD5
4651e1fd4234ee465d6fe6349f2e178d

SHA1
1a86fbd1edd11fa983155172d484959760c1fc0e

SHA256
725ccd777793d5b05707aa28438b58a021c15b0f9cf47ace83aada6ea93a921b

SHA512
6962571dbc91930f4624e3c80e1ab7a5ac23f8f13ccb4587d1619c5d5f8e9731974ae954e8b9ba2e86084f8e797c6a9d49267667a98e47bd7af9e0af29686b0c

Download Submit
/data/data/com.qzebzpxm.dblcvwjv/files/dex/xghesDnsiIxRNokie.zip
Filesize
531KB

MD5
00a1fad4a211f24c85e37a5ed212c1d0

SHA1
ee3561de9a5078285483d190152f5a2059d2c732

SHA256
250bf79fe5b3cf15bd73ad584cb8771225cd30fb8e39f780fca1db1c8d0c94ba

SHA512
170a69ee17d54fdad81dd2efb517217c09db5fc66b942eeca9f530e1b2d62507daaab3f9b96232f9bc7f2acbefc125662b04da6b3b36fdfc9fcbf96cb90a4193

Download Submit
/data/data/com.qzebzpxm.dblcvwjv/logs/Sistema1718503985584.log
Filesize
17KB

MD5
20e53d3117251d6380b1f2046bef5ab9

SHA1
eb8db93f00370c088753d8f1ca9fb53d8ab06edf

SHA256
df22198f66667aa608a22fc76bb818b30fe1bffd53536b3f5b9cf828cb2994a2

SHA512
23404c3009b465dbfd3f915639a5e1ab15ec83032c7e031dcdbf08d9170e56b117e6e0f268ce114c1c32f27708a9acfedf276af9ec69a181e2d2b32142bd9258

Download Submit
/data/user/0/com.qzebzpxm.dblcvwjv/files/dex/xghesDnsiIxRNokie.zip
Filesize
1.3MB

MD5
e5f00429dc763715074271ec3fef4068

SHA1
39daedd344dc3c4fdcbc26537eea799a7f517072

SHA256
d06e1f9f8ae40165e9e20896e162bf6172392ae4815286c568e9d619b4e840b9

SHA512
52b1a7d02133667d435922c0de12d8679e9c73b2fed7f97ce4195eacb70a396e5449f711ed2eddb902acee3636333793c83018c9445ad2533c932ddeb60f9f7c

Download Submit