tispy | 6a386248e8856ebd0841cb70e0433189b251c4dbe9bc2dce2096d6996266abbe

Analysis

max time kernel
47s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
20/06/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a386248e8856ebd0841cb70e0433189b251c4dbe9bc2dce2096d6996266abbe.apk
Size 3.7MB
Sample240620-ckd3bsshjb
SHA256 6a386248e8856ebd0841cb70e0433189b251c4dbe9bc2dce2096d6996266abbe
MD5 085e45a58084320319df1ef0fffbdac4
SHA1 9cb8d7e4d84c8abe52a99e373fbc91834c6aa854
SHA512 c91b0627d0681346fc6ed00c5da21ad0537a1964061e70b5ea703e2e9c7ce682758b03fa212976b78561e9cc20036b6955f1175def6bdd5053ddc963c02791b3
SSDEEP 98304:9mL/mQjQ6PB/QxfassCyjslc1FTo7lNCQhXY:KOQjRJ/QVzojs+G7XVXY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.suyriwhm.ouseqkgn/files/dex/1ff530525b482ffd.zip	4301	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.suyriwhm.ouseqkgn/files/dex/1ff530525b482ffd.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.suyriwhm.ouseqkgn/files/dex/oat/x86/1ff530525b482ffd.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.suyriwhm.ouseqkgn/files/dex/1ff530525b482ffd.zip	4275	com.suyriwhm.ouseqkgn
/data/user/0/com.suyriwhm.ouseqkgn/files/dex/gSovILZiesBTWshqC.zip	4325	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.suyriwhm.ouseqkgn/files/dex/gSovILZiesBTWshqC.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.suyriwhm.ouseqkgn/files/dex/oat/x86/gSovILZiesBTWshqC.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.suyriwhm.ouseqkgn/files/dex/gSovILZiesBTWshqC.zip	4275	com.suyriwhm.ouseqkgn
/data/user/0/com.suyriwhm.ouseqkgn/files/dex/1ff530525b482ffd.zip	4275	com.suyriwhm.ouseqkgn
/data/user/0/com.suyriwhm.ouseqkgn/files/dex/gSovILZiesBTWshqC.zip	4275	com.suyriwhm.ouseqkgn

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.suyriwhm.ouseqkgn

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.suyriwhm.ouseqkgn

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.suyriwhm.ouseqkgn

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.suyriwhm.ouseqkgn

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.suyriwhm.ouseqkgn

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.suyriwhm.ouseqkgn

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.suyriwhm.ouseqkgn

com.suyriwhm.ouseqkgn
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4275
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.suyriwhm.ouseqkgn/files/dex/1ff530525b482ffd.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.suyriwhm.ouseqkgn/files/dex/oat/x86/1ff530525b482ffd.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4301
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.suyriwhm.ouseqkgn/files/dex/gSovILZiesBTWshqC.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.suyriwhm.ouseqkgn/files/dex/oat/x86/gSovILZiesBTWshqC.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4325

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

privatesms.db

Path /data/data/com.suyriwhm.ouseqkgn/databases/privatesms.db
Size 16KB
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
SSDEEP 6:l9FClq1pO64yXsfzhd6mQLuCeC9F8KCPzRtSzxERX4PBX4ogLugMBX4suuK0Dqif:TgqfO6PstjVC7nCjRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-journal

Path /data/data/com.suyriwhm.ouseqkgn/databases/privatesms.db-journal
Size 512B
SHA256 cfcadcd301930e7d3ce0aae2096fd5d783e441b712bea48977fd26984a5bd21d
MD5 88ca417c127a5b3946ef25801e78263a
SHA1 16f93c2243f4b9bb62611d9bcacd2192e2269598
SHA512 140b4feb8246f1e9096ca68bf7b1430823848ab41e899733b7cc1441a4e43649617f686ecb93622fce0d0fb9c602bfde8e112655ba111aedfd9af0292d42c9c9
MD5 SHA1 SHA512

Submit Download

privatesms.db-shm

Path /data/data/com.suyriwhm.ouseqkgn/databases/privatesms.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-wal

Path /data/data/com.suyriwhm.ouseqkgn/databases/privatesms.db-wal
Size 28KB
SHA256 2fc2064bc27b3532b52e9d5640b6bbb06da7a667ff453f1bf55627ebe149d3c0
MD5 b457e813c4da8cf29f27b627705031bd
SHA1 6183faa2401e232f7528df2cc6884365e8a35afb
SHA512 5fa917ab82ec0a0b448d9506134297c723c632ac001170ee3fb8b89b8d50c32da0d1a02c1a86f8e3604359388ebb0046fcc1b27c8077510e522e1010a69eefac
SSDEEP 12:KIb2SzdTRmBEyPbP/Um6cEiOwClxAgqfO6PstjVC7nCjRmBEyPbP/URKSt:KIb2SzyGSP/Um6cEwEA16YJGSP/UgS
MD5 SHA1 SHA512 SSDEEP

Submit Download

477290.so

Path /data/data/com.suyriwhm.ouseqkgn/files/477290.so
Size 145KB
SHA256 0ef7ca92ae4850cd98d6fe6aaec41901cdbaf64f12a77e110ff632bb2eda6713
MD5 5331f946769d9a26661c461c59d031d9
SHA1 008d623b0e0564a9a8a8cff8bd5bc327112697ed
SHA512 e041db2ece750293fb25da09570d89408325e26aa12e87bd8689bab63843edc8229b920aa8d5d6cc91bf0392ffebccb8491dde69a4495d326821b35146f93c30
SSDEEP 3072:5LBuzFYnl6Tqs9Wn9OLgT4toCDEhL0Ci/7NOK0D8u2Gn6zu5cQ3lMVCe5gt5SBsa:5LAzFYnl6Tqs9Wn9OLgT4toCDEhL0Civ
MD5 SHA1 SHA512 SSDEEP

Submit Download

1ff530525b482ffd.zip

Path /data/data/com.suyriwhm.ouseqkgn/files/dex/1ff530525b482ffd.zip
Size 549KB
SHA256 16a649e6236b950157c3e97efe06ba152822d2631f64bc12e815825164c4d956
MD5 7b292558c6220d30f7ef769a79e05fe9
SHA1 9efe8e9ad9f51e446e34f8776ce0a6435111497c
SHA512 3e6033bb0069d451dc9c18f81cbb56bdb7074d6adae4df7c13e01e8847f13abc3284c4a0f6b0fb5f3c05f2233afd0b0bd8c20ee1f8d16783d75c3e9d6da6f26c
SSDEEP 12288:NmzSjoIaaGIpsadZTpW6gtliZrZHJOtMRdyfeIqM:NmuUqGPadZ1W6IQJPxMeIt
MD5 SHA1 SHA512 SSDEEP

Submit Download

gSovILZiesBTWshqC.zip

Path /data/data/com.suyriwhm.ouseqkgn/files/dex/gSovILZiesBTWshqC.zip
Size 649KB
SHA256 aaa1e60465c5197b87a9ac67b901a71678e23e61143627ff10ab2290d377bdc2
MD5 2dfb3d2eee0ea31e4b8b25c9bd6b1315
SHA1 f6cdd15c669ecb614fd51b5070bc96a63a4a5234
SHA512 cf2ca635a8ef7c88860014b36e65124d84e986d3a85ea88a2db5534d5fbde6c8056ff8488fff32ab141e199d546416686f459aee468e9c648e88c93c0f07e2eb
SSDEEP 12288:DyIER72jg7wzxrqr3koRtzNVFfmZTVKallHOdlcPrcBLb+mav59Y1tnaf3:DyIEk07wdqr/R9XFOZpLlBsl13aR4kf
MD5 SHA1 SHA512 SSDEEP

Submit Download

pro_btn_bg_animation_img_0.jpg.zip

Path /data/data/com.suyriwhm.ouseqkgn/files/dex/pro_btn_bg_animation_img_0.jpg.zip
Size 8KB
SHA256 1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
MD5 7c20a2b01bf3f9df1f0abb72ebbe82be
SHA1 e601b2e41434623edbeece32867517a3cdec5449
SHA512 3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4
SSDEEP 192:cWweY+9BMmN65SAb/ykGoNcHLX3GdY955BFpsQixzZsANHM9ndkr:F3Yo3JO/edaqbtaHx1sAtM7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sistema1718849283757.log

Path /data/data/com.suyriwhm.ouseqkgn/logs/Sistema1718849283757.log
Size 14KB
SHA256 1a80b8f09c5df54562cd778c988795094a15939d5f66184e337decc3f4ef7958
MD5 df72d6f7bb6758365f261391ef8514af
SHA1 a6114fad751e457282bb6395a4c4cdcc2c3d2758
SHA512 86068681292819aa899b2208c9345c32b28326553bec97a62da2b70f888be76cdf9d1b310049c8dd187d437cb44eea6a2dbf6d1a88a66c57d04e9acaa4daec35
SSDEEP 384:JKU81yv25WhkWWbRgIlmDR4Hu3lMCCFupjNFlMCCFuCjNklMCCFuXVlMCCFu9eqa:7kWWbRYGu3lMCCI1NFlMCCI0NklMCCIg
MD5 SHA1 SHA512 SSDEEP

Submit Download

1ff530525b482ffd.zip

Path /data/user/0/com.suyriwhm.ouseqkgn/files/dex/1ff530525b482ffd.zip
Size 1.3MB
SHA256 dcba48863964f874f10917608edf99628682b3f4aac60ffe67c38da674c7311f
MD5 ecbf331b2f228fa46a091b23b5a1fdc8
SHA1 7ecdc443c515c0f315ed8b7ff48e09a2869b82f7
SHA512 8d032776f2e91978d3ccf1259cbcf0d8a0acc2e0d4701a0f40e2d038a13cd8c40d6e99f84ea7aa4c6882729de52bd82feb9b19c05949a6e2429a75a9d3f04e9f
SSDEEP 24576:73m6n37mxG9paSPBmpaoOD1XsFGfW9yC+jAdCzMmg9ymr:73mx5h
MD5 SHA1 SHA512 SSDEEP

Download

1ff530525b482ffd.zip

Path /data/user/0/com.suyriwhm.ouseqkgn/files/dex/1ff530525b482ffd.zip
Size 1.3MB
SHA256 2786c5c58a43043a7450d3dcd63a92ef95e8ed1edb850b8030379a179f86fe75
MD5 2591b06aa7a25be3da827dbf2364b67e
SHA1 4ac197bd24868b7596a1de1486fd694574bd14ba
SHA512 f78936fa3b5f67b935d9c45f67637c4026b8c814fc805747cfdc6e4e0bff743ec7beeda11c2a48b0efb11a5e5e4f7b3370111f0239fb443a3a180cb65c8866ef
SSDEEP 12288:73mALVbD3nxZmxOOX+7vjinuFTquB72X5/h+vbGm9qTGwCE5ZwCqYlOugCkoGYMh:73m6n37mxGBbwhsHQHAdCzMmg9ymr
MD5 SHA1 SHA512 SSDEEP

Download

gSovILZiesBTWshqC.zip

Path /data/user/0/com.suyriwhm.ouseqkgn/files/dex/gSovILZiesBTWshqC.zip
Size 1.7MB
SHA256 c37a1a0955e2cebee5515438b785a89fab33e42d3752c39c52867d4a7787239b
MD5 969c5bb4705f4cef8da8829c583ea901
SHA1 ec8ebfa963243092b19f09ff5a9afa7ea1091352
SHA512 3a05a1d461cad47a75727ad4f68e11438859c0e0c45beb0482dd7273b93aafbd1e91eb18c4244912e4ee54c9a47c46338c3293f4acb3fdc739197f492741eab9
SSDEEP 24576:tGeR2pGEKBa3hXAXQXUXyPUFHh+DorW7DN+ACvjV:T4KBIdK62y8P+srSNtCZ
MD5 SHA1 SHA512 SSDEEP

Download

gSovILZiesBTWshqC.zip

Path /data/user/0/com.suyriwhm.ouseqkgn/files/dex/gSovILZiesBTWshqC.zip
Size 1.7MB
SHA256 3724dba2cd6b5acba72b422085bcd9a9c0cdb440168e514f4f8e5d8e7a30a06d
MD5 de52e6b4f3b809e01eddd925fb53aa3a
SHA1 717c0abe1ce5c3aef541129a957bff94678aa98e
SHA512 3e89ddecb5941b8749561458634f151b3c7cc4cb8aafccc9e675e4017af0378a108f096ede750fded3b6326238a0abadf6706373d1b795ac5dae4bfadad2f652
SSDEEP 24576:tGeR2pGEKBa3hXAXQXUXyPUFrrgxaKSCuwdarSmxC9I0tiAEACvjV:T4KBIdK62y8+h9ArETCZ
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads