Malware Analysis Report

2024-09-09 12:29

Sample ID 240701-crf59swgkm
Target 193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526
SHA256 193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526
Tags
tispy collection discovery evasion infostealer persistence spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526

Threat Level: Known bad

The file 193ea3675bfb5291d4c74b43a6f123e236ff3e407c9f82b1fc699184b68ac526 was found to be: Known bad.

Malicious Activity Summary

tispy collection discovery evasion infostealer persistence spyware trojan

TiSpy

Queries information about the current nearby Wi-Fi networks

Requests cell location

Loads dropped Dex/Jar

Queries the phone number (MSISDN for GSM devices)

Declares services with permission to bind to the system

Queries the mobile country code (MCC)

Queries information about active data network

Queries information about the current Wi-Fi connection

Requests dangerous framework permissions

Acquires the wake lock

Declares broadcast receivers with permission to handle system events

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-07-01 02:18

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS N/A N/A
Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-01 02:18

Reported

2024-07-01 02:21

Platform

android-x86-arm-20240624-en

Max time kernel

47s

Max time network

131s

Command Line

com.mountctc.hqyuxuaj

Signatures

TiSpy

trojan infostealer spyware tispy

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip N/A N/A
N/A /data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip N/A N/A

Queries information about the current nearby Wi-Fi networks

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getScanResults N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Requests cell location

collection discovery evasion
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getCellLocation N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.mountctc.hqyuxuaj

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/4c926e42c320a5d9.odex --compiler-filter=quicken --class-loader-context=&

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip --output-vdex-fd=45 --oat-fd=47 --oat-location=/data/user/0/com.mountctc.hqyuxuaj/files/dex/oat/x86/PaLySUNnINiwALlOM.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp

Files

/data/data/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip

MD5 1272d2d831409e96c2f7ef37d3ead3c3
SHA1 b8c95b8537acfdb7f8b14847573f37541800444d
SHA256 5da85c89cb5aaee1d7c7a46db6b4d0b6501d25d524c513444ba006eac71e05d8
SHA512 e23128813af1fea052311ce7078f753a961db8336e43b069640ddb746aec7179ef27f4c1dafe9fed45a6205a4b9c0d29bc1edf2b31c738f016043a071af10aae

/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip

MD5 74d89cc41a56ae7f561ddf8765d098dd
SHA1 81f8ad5f8232fb5051e132cf2545217dbee0b718
SHA256 5cc69705d6c42b669dd56465403447489af13f61252e2303d451d9ad133b4b65
SHA512 f896494e875a236579233e2458674469c5b7ada22d825e23d3127c5bc5db528bd5c4b55dca8873b376556626461314cdd22d8081880570a117450c9f7fcb1caf

/data/user/0/com.mountctc.hqyuxuaj/files/dex/4c926e42c320a5d9.zip

MD5 1d280335192c42eec7588a2e0b008fe4
SHA1 d8cf266c5bdb7eadb218534cd27a24d94191db10
SHA256 7683f067e4d7a14b199cf06b037207c5b94e9c607ef769f23d9c19b0072f6e57
SHA512 d24edec4d8c42b45efd8d5d847400356f8f14bd51ab2a273bb5fb2e159dfdece2ba54effa12745988dfc3233a3126646794226fd0573dddb140b7aa25b4bdd03

/data/data/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip

MD5 a4b8586b66d9b67f160a5ab2322533e1
SHA1 1948e4b71f6fdea041fbd8aaaef946cb89eba911
SHA256 f589d91fbac45abf01bce4bde3c18aba6d059136a41bd94801f2b4db57290c9d
SHA512 87f49a9e0db3ac5110aacaa8f5fa38bb5d9dfef2b6f5649df6dcf6ca3120ea4fd079b34047353e82aa72311a43552f67e90d68a64bed77e1cbbf5b1d0b6cc0e1

/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip

MD5 019654be2ebecfe34e3f3c8765c5f202
SHA1 78b588fb8493164dbc6b4db18f2202ba4dc36568
SHA256 3f1a29dc30780d8806d53b1a33b70cd0b1adb1e61cb90620aa7b0b5a2a17b6da
SHA512 6eb3f327573d76d39c48787a93feb25c9d5feea87c080019cb0b15ad965d311aba96651d8d8ddd7fc07f04f7009287358c8da7abbaecb25ce5df3bfd2485ade7

/data/user/0/com.mountctc.hqyuxuaj/files/dex/PaLySUNnINiwALlOM.zip

MD5 04570c6c7ccb8722f447cc313d1e29fe
SHA1 58a40b74909a8dd883fd12e3a5f4c314a7fec44b
SHA256 ff36a71430a66dda33919c161f1ce06a80fc89f811863dcbba6d38ea9edac73a
SHA512 c426102f3f352c91db709404e426182e75c7ebb345a78fb941c3984fb83d24c564a996a0fe6d53996a9444a06abe7808a93340893f41f86f250d14dc63f1462d

/data/data/com.mountctc.hqyuxuaj/files/dex/pro_btn_bg_animation_img_0.jpg.zip

MD5 7c20a2b01bf3f9df1f0abb72ebbe82be
SHA1 e601b2e41434623edbeece32867517a3cdec5449
SHA256 1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
SHA512 3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4

/data/data/com.mountctc.hqyuxuaj/files/477578.so

MD5 d70841fbc7c2c2a857743b4942c39494
SHA1 eabc0082577dbc66182f557978e7ae619169a905
SHA256 d0be433ac5bc7cf811ecdb6ee10b7039abf76262d4cc6074504937d36ea96993
SHA512 eac62d61737b9cebabdc7adba5bd74be503fe6d6711809bad8c6646e2322bb39dfc0bd799f83bc1815565ee0e0de774d47eeae2ed04c10cc30ea16f839bc6c83

/data/data/com.mountctc.hqyuxuaj/logs/Sistema1719800336364.log

MD5 7f90e83464118c09771ede7ac8b03498
SHA1 8b39b51183dffceeca5fadbde40f1b9ff87ae037
SHA256 484ab3c59fdb19c19f496486cf183169e9e01f61ae2845c875a971d6beb2b5d8
SHA512 e84dd20aeadffb9a87710585555625358bec1091961f8e215a2b45fd7b0cf933c670629b295a2f25c502f1271013389fdc69d953647fc224306f63d0b4e4bb42

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-journal

MD5 8be82eaab129aebbd858f7444c8ecd24
SHA1 674100b6354f8d1383cdf50a9bc426b066d1025b
SHA256 7e8f7a0e52dee6f50cb03a3f2025e1a11882f2e4aaae6fbfc0496bf3a1c59c77
SHA512 9b7262fd5cf815d8941eb60f13ce967b55ec0b8caf42e2384cd17d948cbc6c35291a06f0918162990347543c82e3695f0a4db53f85db666de1530b95e924b3e6

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db

MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.mountctc.hqyuxuaj/databases/privatesms.db-wal

MD5 350947725e4a574c682324c5786a64f9
SHA1 8640f820f27cc1e633ceb9649512d20d855b7bb4
SHA256 e9f7ba9f0ed1b3291fa1fce9fee8d21bf4122bfdf968eb07b2137d1af50a7ccd
SHA512 5cdd33001d6efad61f2ae77daa0e685f88b0bb97f65f327cae5817988b5cb8deefb73e7a85b84096da5152a8bdccf463f55917ac4c13f0586d0dd2c79e457634