tispy

General

Target

1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0
Size

3.2MB
Sample

240622-ck5kaasfjg
MD5

14623d7dc9a647db6984cc6dfdfa2f63
SHA1

4784359d681992c1db6e4221a5e51f01c306c24d
SHA256

1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0
SHA512

955dcf412c8f8dc62562465f0cf0a359fd11c31739e8dbb0d53b75fe5fc24376914f85517dc9ee88763072a5d855e2b9200e801ea906b58119f9736b6e41689f
SSDEEP

49152:kkQ7hynArFFP/RI5cHF2+XwTn8JBvvrMNvrsdKcWVftaWcSFhidvbKCH9B8zTAI:kkQ7Qn+nPD2+AIfMtrs09A7dvb5dBA

Score

10^/10

Malware Config

Extracted

Family

tispy

C2

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_22Jun24&rtype=T

Targets

- Target
  
  1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0
- Size
  
  3.2MB
- MD5
  
  14623d7dc9a647db6984cc6dfdfa2f63
- SHA1
  
  4784359d681992c1db6e4221a5e51f01c306c24d
- SHA256
  
  1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0
- SHA512
  
  955dcf412c8f8dc62562465f0cf0a359fd11c31739e8dbb0d53b75fe5fc24376914f85517dc9ee88763072a5d855e2b9200e801ea906b58119f9736b6e41689f
- SSDEEP
  
  49152:kkQ7hynArFFP/RI5cHF2+XwTn8JBvvrMNvrsdKcWVftaWcSFhidvbKCH9B8zTAI:kkQ7Qn+nPD2+AIfMtrs09A7dvb5dBA
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- TiSpy payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1