tispy | 193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526

Analysis

max time kernel
47s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
27/06/2024, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.apk
Size 3.7MB
Sample240627-cjebpszekj
SHA256 193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526
MD5 9f242ac3c129ba81329d49822c85bbc8
SHA1 1b84538b8eff542156d367f346dbcc9dca994dee
SHA512 da5a938cbec9e83973816d4aeeaf13f2c8626a2fa8a478f1d4f5b692f4db8c61926552d96117c5e871adcbc26669bf1655f4d6472a51751c95eb42022b24e0e1
SSDEEP 98304:Xm4pCkj/Pub/yE0HernXZUSKqqDhnpYXXg7q:jEkj/mb/yE0HerqBIg7q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip	4288	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/4c926e42c320a5d9.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip	4261	com.mountctc.hqyuxuaj
/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip	4314	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/PaLySUNnINiwALlOM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip	4261	com.mountctc.hqyuxuaj
/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip	4261	com.mountctc.hqyuxuaj
/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip	4261	com.mountctc.hqyuxuaj

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.mountctc.hqyuxuaj

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.mountctc.hqyuxuaj

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mountctc.hqyuxuaj

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mountctc.hqyuxuaj

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.mountctc.hqyuxuaj

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.mountctc.hqyuxuaj

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mountctc.hqyuxuaj

com.mountctc.hqyuxuaj
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4261
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/4c926e42c320a5d9.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4288
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/PaLySUNnINiwALlOM.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4314

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

privatesms.db

Path /data/data/com.mountctc.hqyuxuaj/databases/privatesms.db
Size 16KB
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
SSDEEP 6:l9FClq1pO64yXsfzhd6mQLuCeC9F8KCPzRtSzxERX4PBX4ogLugMBX4suuK0Dqif:TgqfO6PstjVC7nCjRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-journal

Path /data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-journal
Size 512B
SHA256 371bdf1b18fe66922504cecf2be3bdb17c5c477bd9b55d216f78591303eb15af
MD5 bfe154d53b85a14e3aeaf18dad09eba0
SHA1 4d98dccfb9a84cb769981c3aeaaaa0fb645ee7f8
SHA512 a350ba792ef6431214f60f1b286e50033a18793c33d89dedfb01b7381efa60b7e90f2d9620dd5a5fc1ab55b6ad1bed28f9787f94a27e15ce4a736bb4b825d516
MD5 SHA1 SHA512

Submit Download

privatesms.db-shm

Path /data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-wal

Path /data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-wal
Size 28KB
SHA256 409bb885d26f713316383fecd072ae43a3328ceec8f07eda5a123c8319c78921
MD5 02a5f898ecc7e27c7eb06a898c1c630c
SHA1 fbc05bd437abafa02b0da2159de380bfd29cf401
SHA512 4cea3e5e648708e80f0cb9f218f776089b90dfaaf950d1c6b21bed9ef63dacf33ec7a91649a6dc8c9d190721fa3a31a6700337d6f6207af83fd7c02258586d53
SSDEEP 12:KHNScTzdTRmBEyPbP/VkRSWOwClrgqfO6PstjVC7nCjRmBEyPbP/FoK:KHTTzyGSP/K5Y16YJGSP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

477578.so

Path /data/data/com.mountctc.hqyuxuaj/files/477578.so
Size 145KB
SHA256 d0be433ac5bc7cf811ecdb6ee10b7039abf76262d4cc6074504937d36ea96993
MD5 d70841fbc7c2c2a857743b4942c39494
SHA1 eabc0082577dbc66182f557978e7ae619169a905
SHA512 eac62d61737b9cebabdc7adba5bd74be503fe6d6711809bad8c6646e2322bb39dfc0bd799f83bc1815565ee0e0de774d47eeae2ed04c10cc30ea16f839bc6c83
SSDEEP 3072:5LBuzFYnl6Tqs9Wn9OLgT4toCDEhL0Ci/7NOK0D8u2Gn64u5cQ3lMVCe5gt5SBsC:5LAzFYnl6Tqs9Wn9OLgT4toCDEhL0Cik
MD5 SHA1 SHA512 SSDEEP

Submit Download

4c926e42c320a5d9.zip

Path /data/data/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip
Size 549KB
SHA256 5da85c89cb5aaee1d7c7a46db6b4d0b6501d25d524c513444ba006eac71e05d8
MD5 1272d2d831409e96c2f7ef37d3ead3c3
SHA1 b8c95b8537acfdb7f8b14847573f37541800444d
SHA512 e23128813af1fea052311ce7078f753a961db8336e43b069640ddb746aec7179ef27f4c1dafe9fed45a6205a4b9c0d29bc1edf2b31c738f016043a071af10aae
SSDEEP 12288:W0di1y7/6efZCfe65dGrV66shbPqWFgS66+A+NylMkG/3wyyhf4:+1yT6exCW6rGrV6FhbLWA+N4bU3wyc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

PaLySUNnINiwALlOM.zip

Path /data/data/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip
Size 649KB
SHA256 f589d91fbac45abf01bce4bde3c18aba6d059136a41bd94801f2b4db57290c9d
MD5 a4b8586b66d9b67f160a5ab2322533e1
SHA1 1948e4b71f6fdea041fbd8aaaef946cb89eba911
SHA512 87f49a9e0db3ac5110aacaa8f5fa38bb5d9dfef2b6f5649df6dcf6ca3120ea4fd079b34047353e82aa72311a43552f67e90d68a64bed77e1cbbf5b1d0b6cc0e1
SSDEEP 12288:urQAv7FUdj/2X1ZHRrWjAqNUbp07cwncwaQ99Ciof0kZty3:urQATFjrWsqObp07cwnFaQ9908Mu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pro_btn_bg_animation_img_0.jpg.zip

Path /data/data/com.mountctc.hqyuxuaj/files/dex/pro_btn_bg_animation_img_0.jpg.zip
Size 8KB
SHA256 1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
MD5 7c20a2b01bf3f9df1f0abb72ebbe82be
SHA1 e601b2e41434623edbeece32867517a3cdec5449
SHA512 3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4
SSDEEP 192:cWweY+9BMmN65SAb/ykGoNcHLX3GdY955BFpsQixzZsANHM9ndkr:F3Yo3JO/edaqbtaHx1sAtM7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sistema1719453979550.log

Path /data/data/com.mountctc.hqyuxuaj/logs/Sistema1719453979550.log
Size 15KB
SHA256 3d428131e85907c7ad75a75f70d82b4668ae82e6dafc781261a3bb7e56b90c2c
MD5 d4ee9f072019022f580f513667ebefe8
SHA1 880d296eecb51128949cb22a26b819173211648b
SHA512 a12e7bb7df082ec0519d2d192f3ff0941fd34c0450629303d6baac4727f6ece5e04f523c1412cd3f00c33ad2654738742114a19585bb694b45de0a473cd9bd1c
SSDEEP 384:dO4M1yv25WhkWWbRgIlmDRXyuglpu36+u3cu9eyujcXHLP8dMwl:DkWWbRYXga3K3r9elYXHLP8dMwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

4c926e42c320a5d9.zip

Path /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip
Size 1.3MB
SHA256 7683f067e4d7a14b199cf06b037207c5b94e9c607ef769f23d9c19b0072f6e57
MD5 1d280335192c42eec7588a2e0b008fe4
SHA1 d8cf266c5bdb7eadb218534cd27a24d94191db10
SHA512 d24edec4d8c42b45efd8d5d847400356f8f14bd51ab2a273bb5fb2e159dfdece2ba54effa12745988dfc3233a3126646794226fd0573dddb140b7aa25b4bdd03
SSDEEP 24576:O+eSoDiY0oYzq+gbzMo5tambLEniS437kOBJsfDmz9al7krUw:nI6KluE/rvnk7O
MD5 SHA1 SHA512 SSDEEP

Download

4c926e42c320a5d9.zip

Path /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip
Size 1.3MB
SHA256 5cc69705d6c42b669dd56465403447489af13f61252e2303d451d9ad133b4b65
MD5 74d89cc41a56ae7f561ddf8765d098dd
SHA1 81f8ad5f8232fb5051e132cf2545217dbee0b718
SHA512 f896494e875a236579233e2458674469c5b7ada22d825e23d3127c5bc5db528bd5c4b55dca8873b376556626461314cdd22d8081880570a117450c9f7fcb1caf
SSDEEP 12288:98fVyhNr6SoDhLcaJn9MTG4p+AXTE7Z9lUaYu2Uad8nbWoVuNnhU3CIzuv7iw/tc:O+eSoDPSLNiWfDmz9al7krUw
MD5 SHA1 SHA512 SSDEEP

Download

PaLySUNnINiwALlOM.zip

Path /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip
Size 1.7MB
SHA256 ff36a71430a66dda33919c161f1ce06a80fc89f811863dcbba6d38ea9edac73a
MD5 04570c6c7ccb8722f447cc313d1e29fe
SHA1 58a40b74909a8dd883fd12e3a5f4c314a7fec44b
SHA512 c426102f3f352c91db709404e426182e75c7ebb345a78fb941c3984fb83d24c564a996a0fe6d53996a9444a06abe7808a93340893f41f86f250d14dc63f1462d
SSDEEP 24576:kGeR2pWEKB+a8XAXQXUXyPUash+DorW7DN+ACvjV:IQKBNOK62y8B+srSNtCZ
MD5 SHA1 SHA512 SSDEEP

Download

PaLySUNnINiwALlOM.zip

Path /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip
Size 1.7MB
SHA256 3f1a29dc30780d8806d53b1a33b70cd0b1adb1e61cb90620aa7b0b5a2a17b6da
MD5 019654be2ebecfe34e3f3c8765c5f202
SHA1 78b588fb8493164dbc6b4db18f2202ba4dc36568
SHA512 6eb3f327573d76d39c48787a93feb25c9d5feea87c080019cb0b15ad965d311aba96651d8d8ddd7fc07f04f7009287358c8da7abbaecb25ce5df3bfd2485ade7
SSDEEP 24576:kGeR2pWEKB+a8XAXQXUXyPUaWrgxaKSCuwdarSmxC9I0tiAEACvjV:IQKBNOK62y8Qh9ArETCZ
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads