Malware Analysis Report

2024-09-09 12:29

Sample ID 240628-ct72rswdre
Target 193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526
SHA256 193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526
Tags
tispy collection discovery evasion infostealer persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526

Threat Level: Known bad

The file 193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526 was found to be: Known bad.

Malicious Activity Summary

tispy collection discovery evasion infostealer persistence spyware trojan

TiSpy

Queries the phone number (MSISDN for GSM devices)

Loads dropped Dex/Jar

Queries information about the current nearby Wi-Fi networks

Requests cell location

Queries information about the current Wi-Fi connection

Queries information about active data network

Acquires the wake lock

Declares broadcast receivers with permission to handle system events

Requests dangerous framework permissions

Queries the mobile country code (MCC)

Declares services with permission to bind to the system

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-28 02:23

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 02:23

Reported

2024-06-28 02:26

Platform

android-x86-arm-20240624-en

Max time kernel

47s

Max time network

135s

Command Line

com.mountctc.hqyuxuaj

Signatures

TiSpy

trojan infostealer spyware tispy

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.mountctc.hqyuxuaj

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/4c926e42c320a5d9.odex --compiler-filter=quicken --class-loader-context=&

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/PaLySUNnINiwALlOM.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 216.58.213.10:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip

MD5 1272d2d831409e96c2f7ef37d3ead3c3
SHA1 b8c95b8537acfdb7f8b14847573f37541800444d
SHA256 5da85c89cb5aaee1d7c7a46db6b4d0b6501d25d524c513444ba006eac71e05d8
SHA512 e23128813af1fea052311ce7078f753a961db8336e43b069640ddb746aec7179ef27f4c1dafe9fed45a6205a4b9c0d29bc1edf2b31c738f016043a071af10aae

/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip

MD5 74d89cc41a56ae7f561ddf8765d098dd
SHA1 81f8ad5f8232fb5051e132cf2545217dbee0b718
SHA256 5cc69705d6c42b669dd56465403447489af13f61252e2303d451d9ad133b4b65
SHA512 f896494e875a236579233e2458674469c5b7ada22d825e23d3127c5bc5db528bd5c4b55dca8873b376556626461314cdd22d8081880570a117450c9f7fcb1caf

/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip

MD5 1d280335192c42eec7588a2e0b008fe4
SHA1 d8cf266c5bdb7eadb218534cd27a24d94191db10
SHA256 7683f067e4d7a14b199cf06b037207c5b94e9c607ef769f23d9c19b0072f6e57
SHA512 d24edec4d8c42b45efd8d5d847400356f8f14bd51ab2a273bb5fb2e159dfdece2ba54effa12745988dfc3233a3126646794226fd0573dddb140b7aa25b4bdd03

/data/data/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip

MD5 a4b8586b66d9b67f160a5ab2322533e1
SHA1 1948e4b71f6fdea041fbd8aaaef946cb89eba911
SHA256 f589d91fbac45abf01bce4bde3c18aba6d059136a41bd94801f2b4db57290c9d
SHA512 87f49a9e0db3ac5110aacaa8f5fa38bb5d9dfef2b6f5649df6dcf6ca3120ea4fd079b34047353e82aa72311a43552f67e90d68a64bed77e1cbbf5b1d0b6cc0e1

/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip

MD5 019654be2ebecfe34e3f3c8765c5f202
SHA1 78b588fb8493164dbc6b4db18f2202ba4dc36568
SHA256 3f1a29dc30780d8806d53b1a33b70cd0b1adb1e61cb90620aa7b0b5a2a17b6da
SHA512 6eb3f327573d76d39c48787a93feb25c9d5feea87c080019cb0b15ad965d311aba96651d8d8ddd7fc07f04f7009287358c8da7abbaecb25ce5df3bfd2485ade7

/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip

MD5 04570c6c7ccb8722f447cc313d1e29fe
SHA1 58a40b74909a8dd883fd12e3a5f4c314a7fec44b
SHA256 ff36a71430a66dda33919c161f1ce06a80fc89f811863dcbba6d38ea9edac73a
SHA512 c426102f3f352c91db709404e426182e75c7ebb345a78fb941c3984fb83d24c564a996a0fe6d53996a9444a06abe7808a93340893f41f86f250d14dc63f1462d

/data/data/com.mountctc.hqyuxuaj/files/dex/pro_btn_bg_animation_img_0.jpg.zip

MD5 7c20a2b01bf3f9df1f0abb72ebbe82be
SHA1 e601b2e41434623edbeece32867517a3cdec5449
SHA256 1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
SHA512 3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4

/data/data/com.mountctc.hqyuxuaj/files/477578.so

MD5 d70841fbc7c2c2a857743b4942c39494
SHA1 eabc0082577dbc66182f557978e7ae619169a905
SHA256 d0be433ac5bc7cf811ecdb6ee10b7039abf76262d4cc6074504937d36ea96993
SHA512 eac62d61737b9cebabdc7adba5bd74be503fe6d6711809bad8c6646e2322bb39dfc0bd799f83bc1815565ee0e0de774d47eeae2ed04c10cc30ea16f839bc6c83

/data/data/com.mountctc.hqyuxuaj/logs/Sistema1719541408349.log

MD5 dcb677680e09bf6fdaff3a11f28d636a
SHA1 1ff632e5d14aacf9f7955a3fe744ff0700038591
SHA256 354ad5485124759b5f8d712eb183cd31dc7be8039551f55aa9c61be1ea7b1f68
SHA512 d523f75bacafdf44dc9850472eecf7f25306851815fde4959cfcd3cfdf48f53c739669ff813c4c9c1a17bc0b056c41b0facc580fb371a13dc4d91922e8f686ca

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-journal

MD5 77ce464f1212e597d2d29da0bc7a6254
SHA1 b2344d456c7e048d9335a2525d65702220f9fd81
SHA256 d99be4e9a7b0d08ba46ce5da4cd72f837ec77c2b380ea992fb71b1353f06d963
SHA512 911a9a575fbe6a1faf87c0676e508833ce75a02e81a251682588be2f905980ce60b7c5b82515395603c7b35c4238ae697b1567f2b2db4c0907040dd225c2ffa0

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db

MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-wal

MD5 1088917c30c248eee95b3797b062cdf4
SHA1 b77ed0602119420988735bd23d447208761620f1
SHA256 74b25a82dba01641c37eacd18e9d150904b338f75200803fffc5787fb4d619aa
SHA512 2ad63ecefbe8c6fbc23f564dcc9b0492e0735d2bfc0ee27524a6d7e2fc89d6a4eb988cfab4ed2d51d04225e150dc5ef7523fb09d32f7c05f154d702d9c05e5b2