Overview

overview

10

Static

static

6

d17bfc41c6...30.apk

android-9-x86

10

Analysis

  • max time kernel
    47s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    06/07/2024, 01:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d17bfc41c6e53c7ccfda5321d545652b4f368d615301a3645420fd564c163b30.apk
  • Size 3.4MB
  • Sample240706-cbcg5ssdkq
  • SHA256 d17bfc41c6e53c7ccfda5321d545652b4f368d615301a3645420fd564c163b30
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

  • tispy

C2

  • https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_05Jul24&rtype=T

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • TiSpy payload 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 7 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence

Processes

  • com.rjldfyjr.xdapuvxn
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4220
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.rjldfyjr.xdapuvxn/code_cache/1720230832456.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.rjldfyjr.xdapuvxn/code_cache/oat/x86/1720230832456.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4281
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rjldfyjr.xdapuvxn/files/dex/IDBjJNVYdqiRgUUzP.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.rjldfyjr.xdapuvxn/files/dex/oat/x86/IDBjJNVYdqiRgUUzP.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4306
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.rjldfyjr.xdapuvxn/code_cache/1720230837893.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.rjldfyjr.xdapuvxn/code_cache/oat/x86/1720230837893.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4331

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1720230832456.dex
        • Path /data/data/com.rjldfyjr.xdapuvxn/code_cache/1720230832456.dex
        • Size 4KB
        • SHA256 401f68f4448fd6288b7619a7a2ae4646493cd7268f16aa6714802833fbc1197e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1720230832456.dex
        • Path /data/data/com.rjldfyjr.xdapuvxn/code_cache/1720230832456.dex
        • Size 8KB
        • SHA256 5dfcef0f59a512a9d88d21de81e5f9a20ff420d328736a1426b0a45f9459d832
        • MD5 SHA1 SHA512 SSDEEP
        Download

        1720230832456.dex
        • Path /data/data/com.rjldfyjr.xdapuvxn/code_cache/1720230832456.dex
        • Size 8KB
        • SHA256 bc5290425eaa32b00a84a94c58976321e7643bc5d668817524ad68a1c7d2082b
        • MD5 SHA1 SHA512 SSDEEP
        Download

        privatesms.db
        • Path /data/data/com.rjldfyjr.xdapuvxn/databases/privatesms.db
        • Size 16KB
        • SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        privatesms.db-journal
        • Path /data/data/com.rjldfyjr.xdapuvxn/databases/privatesms.db-journal
        • Size 512B
        • SHA256 37832b5631e53d51a817ce4c12758e796af9a67dddde535693bc1a6021933cd9
        • MD5 SHA1 SHA512
        Submit Download

        privatesms.db-shm
        • Path /data/data/com.rjldfyjr.xdapuvxn/databases/privatesms.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        privatesms.db-wal
        • Path /data/data/com.rjldfyjr.xdapuvxn/databases/privatesms.db-wal
        • Size 28KB
        • SHA256 9d49836e956d418216a21e4df5da343106b59bf26d9d2a42439956ad4bee733e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        477816.so
        • Path /data/data/com.rjldfyjr.xdapuvxn/files/477816.so
        • Size 145KB
        • SHA256 f37910cc62e7feab2e60b907954dedb0839d7d99d65e7b0cf304d9c780ad1304
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IDBjJNVYdqiRgUUzP.zip
        • Path /data/data/com.rjldfyjr.xdapuvxn/files/dex/IDBjJNVYdqiRgUUzP.zip
        • Size 1.5MB
        • SHA256 a5fd32d37b823a5f6148cbac973343f0cc0d88c2599dd3b0ad573e923c10b742
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Sistema1720230840805.log
        • Path /data/data/com.rjldfyjr.xdapuvxn/logs/Sistema1720230840805.log
        • Size 9KB
        • SHA256 3c15ca2748f8c3c55bc8614408b0aec3bb719f9b59ea1b9d6bbff89d60befbc3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IDBjJNVYdqiRgUUzP.zip
        • Path /data/user/0/com.rjldfyjr.xdapuvxn/files/dex/IDBjJNVYdqiRgUUzP.zip
        • Size 3.7MB
        • SHA256 95927ab218714530b46e28a17b790935230a686fa6a718c75f8922c109af441e
        • MD5 SHA1 SHA512 SSDEEP
        Download

        IDBjJNVYdqiRgUUzP.zip
        • Path /data/user/0/com.rjldfyjr.xdapuvxn/files/dex/IDBjJNVYdqiRgUUzP.zip
        • Size 3.7MB
        • SHA256 ef17c8acbb88b71672f42a1fc6edb6169bd23eed451ebab88d614924fc6f5941
        • MD5 SHA1 SHA512 SSDEEP
        Download