Malware Analysis Report

2024-09-09 12:30

Sample ID 240627-cjebpszekj
Target k.apk
SHA256 193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526
Tags
tispy collection discovery evasion infostealer persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526

Threat Level: Known bad

The file k.apk was found to be: Known bad.

Malicious Activity Summary

tispy collection discovery evasion infostealer persistence spyware trojan

TiSpy

Queries the phone number (MSISDN for GSM devices)

Loads dropped Dex/Jar

Requests cell location

Queries information about the current nearby Wi-Fi networks

Acquires the wake lock

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Queries information about active data network

Requests dangerous framework permissions

Reads information about phone network operator.

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-27 02:06

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-27 02:06

Reported

2024-06-27 02:09

Platform

android-x86-arm-20240624-en

Max time kernel

47s

Max time network

131s

Command Line

com.mountctc.hqyuxuaj

Signatures

TiSpy

trojan infostealer spyware tispy

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.mountctc.hqyuxuaj

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/4c926e42c320a5d9.odex --compiler-filter=quicken --class-loader-context=&

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/PaLySUNnINiwALlOM.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp

Files

/data/data/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip

MD5 1272d2d831409e96c2f7ef37d3ead3c3
SHA1 b8c95b8537acfdb7f8b14847573f37541800444d
SHA256 5da85c89cb5aaee1d7c7a46db6b4d0b6501d25d524c513444ba006eac71e05d8
SHA512 e23128813af1fea052311ce7078f753a961db8336e43b069640ddb746aec7179ef27f4c1dafe9fed45a6205a4b9c0d29bc1edf2b31c738f016043a071af10aae

/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip

MD5 74d89cc41a56ae7f561ddf8765d098dd
SHA1 81f8ad5f8232fb5051e132cf2545217dbee0b718
SHA256 5cc69705d6c42b669dd56465403447489af13f61252e2303d451d9ad133b4b65
SHA512 f896494e875a236579233e2458674469c5b7ada22d825e23d3127c5bc5db528bd5c4b55dca8873b376556626461314cdd22d8081880570a117450c9f7fcb1caf

/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip

MD5 1d280335192c42eec7588a2e0b008fe4
SHA1 d8cf266c5bdb7eadb218534cd27a24d94191db10
SHA256 7683f067e4d7a14b199cf06b037207c5b94e9c607ef769f23d9c19b0072f6e57
SHA512 d24edec4d8c42b45efd8d5d847400356f8f14bd51ab2a273bb5fb2e159dfdece2ba54effa12745988dfc3233a3126646794226fd0573dddb140b7aa25b4bdd03

/data/data/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip

MD5 a4b8586b66d9b67f160a5ab2322533e1
SHA1 1948e4b71f6fdea041fbd8aaaef946cb89eba911
SHA256 f589d91fbac45abf01bce4bde3c18aba6d059136a41bd94801f2b4db57290c9d
SHA512 87f49a9e0db3ac5110aacaa8f5fa38bb5d9dfef2b6f5649df6dcf6ca3120ea4fd079b34047353e82aa72311a43552f67e90d68a64bed77e1cbbf5b1d0b6cc0e1

/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip

MD5 019654be2ebecfe34e3f3c8765c5f202
SHA1 78b588fb8493164dbc6b4db18f2202ba4dc36568
SHA256 3f1a29dc30780d8806d53b1a33b70cd0b1adb1e61cb90620aa7b0b5a2a17b6da
SHA512 6eb3f327573d76d39c48787a93feb25c9d5feea87c080019cb0b15ad965d311aba96651d8d8ddd7fc07f04f7009287358c8da7abbaecb25ce5df3bfd2485ade7

/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip

MD5 04570c6c7ccb8722f447cc313d1e29fe
SHA1 58a40b74909a8dd883fd12e3a5f4c314a7fec44b
SHA256 ff36a71430a66dda33919c161f1ce06a80fc89f811863dcbba6d38ea9edac73a
SHA512 c426102f3f352c91db709404e426182e75c7ebb345a78fb941c3984fb83d24c564a996a0fe6d53996a9444a06abe7808a93340893f41f86f250d14dc63f1462d

/data/data/com.mountctc.hqyuxuaj/files/dex/pro_btn_bg_animation_img_0.jpg.zip

MD5 7c20a2b01bf3f9df1f0abb72ebbe82be
SHA1 e601b2e41434623edbeece32867517a3cdec5449
SHA256 1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
SHA512 3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4

/data/data/com.mountctc.hqyuxuaj/files/477578.so

MD5 d70841fbc7c2c2a857743b4942c39494
SHA1 eabc0082577dbc66182f557978e7ae619169a905
SHA256 d0be433ac5bc7cf811ecdb6ee10b7039abf76262d4cc6074504937d36ea96993
SHA512 eac62d61737b9cebabdc7adba5bd74be503fe6d6711809bad8c6646e2322bb39dfc0bd799f83bc1815565ee0e0de774d47eeae2ed04c10cc30ea16f839bc6c83

/data/data/com.mountctc.hqyuxuaj/logs/Sistema1719453979550.log

MD5 d4ee9f072019022f580f513667ebefe8
SHA1 880d296eecb51128949cb22a26b819173211648b
SHA256 3d428131e85907c7ad75a75f70d82b4668ae82e6dafc781261a3bb7e56b90c2c
SHA512 a12e7bb7df082ec0519d2d192f3ff0941fd34c0450629303d6baac4727f6ece5e04f523c1412cd3f00c33ad2654738742114a19585bb694b45de0a473cd9bd1c

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-journal

MD5 bfe154d53b85a14e3aeaf18dad09eba0
SHA1 4d98dccfb9a84cb769981c3aeaaaa0fb645ee7f8
SHA256 371bdf1b18fe66922504cecf2be3bdb17c5c477bd9b55d216f78591303eb15af
SHA512 a350ba792ef6431214f60f1b286e50033a18793c33d89dedfb01b7381efa60b7e90f2d9620dd5a5fc1ab55b6ad1bed28f9787f94a27e15ce4a736bb4b825d516

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db

MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-wal

MD5 02a5f898ecc7e27c7eb06a898c1c630c
SHA1 fbc05bd437abafa02b0da2159de380bfd29cf401
SHA256 409bb885d26f713316383fecd072ae43a3328ceec8f07eda5a123c8319c78921
SHA512 4cea3e5e648708e80f0cb9f218f776089b90dfaaf950d1c6b21bed9ef63dacf33ec7a91649a6dc8c9d190721fa3a31a6700337d6f6207af83fd7c02258586d53