tispy

General

Target

06b4617a364bde9ed602230171dbd8d989b046adb4eac17fe8183c21eb47c110
Size

3.2MB
Sample

240626-ctsxvasarj
MD5

39486216bb6c913a137e08d637f3894f
SHA1

2837ef2560e1b201a450f570a7acf274a64acf11
SHA256

06b4617a364bde9ed602230171dbd8d989b046adb4eac17fe8183c21eb47c110
SHA512

a6998ee5c70d6ce8e302729f3f0fb96b23a6aecebc07b01d5186135dbe7c251323151d04623468dcddd1de8d9ec0b7780c8e55cd7e4ed64389d88549ccb384b7
SSDEEP

49152:WqsNhJnAWqdrPeEkGOtNQE/V2+Hh6POe2nrWs/mOxHKIZn42Khlv+QJU6vvHo:WqsNbnXGrPlGilqjrljFohlv+wUyHo

Score

10^/10

Malware Config

Extracted

Family

tispy

C2

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_26Jun24&rtype=T

Targets

- Target
  
  06b4617a364bde9ed602230171dbd8d989b046adb4eac17fe8183c21eb47c110
- Size
  
  3.2MB
- MD5
  
  39486216bb6c913a137e08d637f3894f
- SHA1
  
  2837ef2560e1b201a450f570a7acf274a64acf11
- SHA256
  
  06b4617a364bde9ed602230171dbd8d989b046adb4eac17fe8183c21eb47c110
- SHA512
  
  a6998ee5c70d6ce8e302729f3f0fb96b23a6aecebc07b01d5186135dbe7c251323151d04623468dcddd1de8d9ec0b7780c8e55cd7e4ed64389d88549ccb384b7
- SSDEEP
  
  49152:WqsNhJnAWqdrPeEkGOtNQE/V2+Hh6POe2nrWs/mOxHKIZn42Khlv+QJU6vvHo:WqsNbnXGrPlGilqjrljFohlv+wUyHo
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- TiSpy payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1