tispy | 96f57fb420f05fc2fc3e33f4b1355ec9646614852fd958a230afcb48bb29f673

Analysis

max time kernel
47s
max time network
127s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
07/07/2024, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96f57fb420f05fc2fc3e33f4b1355ec9646614852fd958a230afcb48bb29f673.apk
Size 3.4MB
Sample240707-cleegstanc
SHA256 96f57fb420f05fc2fc3e33f4b1355ec9646614852fd958a230afcb48bb29f673
MD5 677b845d55a3522fca907b600d081591
SHA1 b04b581ca5190e0b3304b806ee536f3150a9ad9f
SHA512 b5bccec91bcca954e4df14bf6300c56c9129ba53e332f268ad29a61e8ad71a6f7e78e460bd764d2ec4a0351557311517aabd0074d4ee062dd46284284a3f3c06
SSDEEP 98304:7F5Vunh3U7gPegpovh5jbeFCFJjCSAll9Pt1g:R6h3d2nh5fmCGS+PI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_07Jul24&rtype=T

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

TiSpy payload 2 IoCs

resource	yara_rule
behavioral1/memory/4294-0.dex	family_tispy
behavioral1/memory/4244-1.dex	family_tispy

Loads dropped Dex/Jar 1 TTPs 7 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.muhhdyip.oowbqnur/code_cache/1720318182086.dex	4270	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.muhhdyip.oowbqnur/code_cache/1720318182086.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.muhhdyip.oowbqnur/code_cache/oat/x86/1720318182086.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.muhhdyip.oowbqnur/code_cache/1720318182086.dex	4244	com.muhhdyip.oowbqnur
/data/user/0/com.muhhdyip.oowbqnur/files/dex/XeTggVOlJLEYqGiao.zip	4294	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.muhhdyip.oowbqnur/files/dex/XeTggVOlJLEYqGiao.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.muhhdyip.oowbqnur/files/dex/oat/x86/XeTggVOlJLEYqGiao.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.muhhdyip.oowbqnur/files/dex/XeTggVOlJLEYqGiao.zip	4244	com.muhhdyip.oowbqnur
/data/data/com.muhhdyip.oowbqnur/code_cache/1720318187606.dex	4318	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.muhhdyip.oowbqnur/code_cache/1720318187606.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.muhhdyip.oowbqnur/code_cache/oat/x86/1720318187606.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.muhhdyip.oowbqnur/code_cache/1720318187606.dex	4244	com.muhhdyip.oowbqnur
/data/user/0/com.muhhdyip.oowbqnur/files/dex/XeTggVOlJLEYqGiao.zip	4244	com.muhhdyip.oowbqnur

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.muhhdyip.oowbqnur

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.muhhdyip.oowbqnur

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.muhhdyip.oowbqnur

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.muhhdyip.oowbqnur

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.muhhdyip.oowbqnur

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.muhhdyip.oowbqnur

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.muhhdyip.oowbqnur

com.muhhdyip.oowbqnur
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4244
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.muhhdyip.oowbqnur/code_cache/1720318182086.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.muhhdyip.oowbqnur/code_cache/oat/x86/1720318182086.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4270
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.muhhdyip.oowbqnur/files/dex/XeTggVOlJLEYqGiao.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.muhhdyip.oowbqnur/files/dex/oat/x86/XeTggVOlJLEYqGiao.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4294
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.muhhdyip.oowbqnur/code_cache/1720318187606.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.muhhdyip.oowbqnur/code_cache/oat/x86/1720318187606.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4318

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1720318182086.dex

Path /data/data/com.muhhdyip.oowbqnur/code_cache/1720318182086.dex
Size 4KB
SHA256 401f68f4448fd6288b7619a7a2ae4646493cd7268f16aa6714802833fbc1197e
MD5 d3364728f634bf71c4b16542c02c60cb
SHA1 f23088362b69935f404f2b81eaa40ed3172efca5
SHA512 9378bbda71abcb437676a2d4095d7d3ab6a5a1c1682ec95f3f6d050b9226692cd1a29ba8e7a65dac441c29cfb7b1d5e69e34b5cc32989c90c025909567a662af
SSDEEP 96:dxd9D2sa0aBMcuwuidukEIg8aJA+BxKZyOIDyBlI2C4kZz:dZD9KdDd4Ig9JcRIDyBlu1
MD5 SHA1 SHA512 SSDEEP

Submit Download

1720318182086.dex

Path /data/data/com.muhhdyip.oowbqnur/code_cache/1720318182086.dex
Size 8KB
SHA256 5dfcef0f59a512a9d88d21de81e5f9a20ff420d328736a1426b0a45f9459d832
MD5 cf790c0dfb1361b86d4b8bfca1f8814c
SHA1 d452d9d6504f6af0c9408d6fdb1ced0ff3c45dee
SHA512 e2194cf4ab22064206d9df3523afd3b247f4ce72b7fed17056029746d1f79c1a25d340f8f9c7ec77b9590d05dc7549a735d631a368f82c472cd54bb8a1396c47
SSDEEP 192:FzyueiOnTT1neGhSuEWzjB0bOL3s48rdQ:EueiOndecSuEWZWgs48rdQ
MD5 SHA1 SHA512 SSDEEP

Download

1720318182086.dex

Path /data/data/com.muhhdyip.oowbqnur/code_cache/1720318182086.dex
Size 8KB
SHA256 bc5290425eaa32b00a84a94c58976321e7643bc5d668817524ad68a1c7d2082b
MD5 a137b5568de65b8fef35329930d8617f
SHA1 49a2d6e95d447ba1d448c81691f6a609fb2859ed
SHA512 9dd6c25dea7b3424e8ca0150a9f1f6f85ed5fccef69e7fadfa05324014b74cc350365b788cee2a8ce25afccee084908e679eafa7f449e7791c6288485d2c5338
SSDEEP 192:FzyueiOnTTdFx95sVEw7wyB0bOL3s48rdQ:EueiOn/xQV/7wsWgs48rdQ
MD5 SHA1 SHA512 SSDEEP

Download

privatesms.db

Path /data/data/com.muhhdyip.oowbqnur/databases/privatesms.db
Size 16KB
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
SSDEEP 6:l9FClq1pO64yXsfzhd6mQLuCeC9F8KCPzRtSzxERX4PBX4ogLugMBX4suuK0Dqif:TgqfO6PstjVC7nCjRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-journal

Path /data/data/com.muhhdyip.oowbqnur/databases/privatesms.db-journal
Size 512B
SHA256 216aafdab43dd964eeade8c660969aeff7c68f2f8fe3382b6cce15b30e8315ad
MD5 9851120165aa5fd55ec10256db22dac6
SHA1 fdcaf8f4593e3ecab280aef93e5b414893d69f33
SHA512 44e54b30ef381f872bb3c0808319e9ad236414198980e2e4180d81e437074ff1ba9284f5d77037fbb568d9b51c488c6517db7c2ea22643f8ea10bfef0dd84960
MD5 SHA1 SHA512

Submit Download

privatesms.db-shm

Path /data/data/com.muhhdyip.oowbqnur/databases/privatesms.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-wal

Path /data/data/com.muhhdyip.oowbqnur/databases/privatesms.db-wal
Size 28KB
SHA256 5ced74f09ccd620fd288e5e652bc2b483fd8cfba6703e2507883017808483aaa
MD5 031071e17f2aa917bbc0bb7d5ff70eab
SHA1 8c79a898b9496b4bc6bc96420cb073c86a7b9787
SHA512 e1f4f47b9ed5b798a3c0adaed128dc9fcd37c1c8b3a264d6894b0829a3c9f26c768e11b8cb016820a0e83d1279f8b280e89f91d5f76f1893c8ebfa3c282cef0b
SSDEEP 24:KHtitdzyGSP/RtPyJ3BtA16YJGSP/RtIrm+:mwHzNSP/RiRSkXSP/R+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

477864.so

Path /data/data/com.muhhdyip.oowbqnur/files/477864.so
Size 145KB
SHA256 cfd9eb7aac415347ae4d7cd1e484b534bc110c063deba5f06f2084f939da2ed9
MD5 7ca403dfd4312a1be8741832fa085933
SHA1 5900dddbce0b4bda27dbd7386e16bc5d950dfcb8
SHA512 365f0ffdf8b63b3d517e90ce84d07cc89a729a7a413fd7700b1d8fcbb3be5e6601e27b1c7da33e66b5459a2dba6f51ea653d3da4a9874cd1f5de994ea4afd478
SSDEEP 3072:uLBuzFYnl6Tqs9Wn9OLgT4toCDEhL0Ci/7NOK0D8u2Gn6Zu5cQ3lMVCe5gt5SBsT:uLAzFYnl6Tqs9Wn9OLgT4toCDEhL0CiQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

XeTggVOlJLEYqGiao.zip

Path /data/data/com.muhhdyip.oowbqnur/files/dex/XeTggVOlJLEYqGiao.zip
Size 1.5MB
SHA256 80866e788fc9dd7ddf6ebf2398b6bb7b2130433a541e5dfed5b5850860291d92
MD5 f44347bc39f0e279946fcb2ffa13c2d9
SHA1 64b939d73438b2ce93a46ee1d9bc66ef6c3a0740
SHA512 77ed01605f91a6b6a14e0bbe04741d7815eeb6fc11e9e5b2383eb25125abb1c22a58bbdc3e599570893cb8fa8a54d49d8413341e5a7d84af16d5c32023f0c623
SSDEEP 24576:BK78/mk29m+C/h/x3N/vw+bS3iy350NK3d6vthnQOjx9ESAvpHTsV7E2W7IHaS:Bi85q0H3N23606FhnQOjkFkI2WsHH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sistema1720318190809.log

Path /data/data/com.muhhdyip.oowbqnur/logs/Sistema1720318190809.log
Size 9KB
SHA256 cc79c78721b2d68d1d587bb6cf7d69b212cde0300dd424764a4a9fd5077ae3a0
MD5 da4c34d8cc712b84307200bdde9dfb2c
SHA1 4bee1b3c6264c6664f07cfb223d48ba639552e04
SHA512 7131a3e777f698cc6c14f37e47dc246a7f6e1886867cdd66e2d506854cc3149a67ad43a540dd0651f5782ed6855849c372f3dd59bf1a8fa4d8056ad01ad35b82
SSDEEP 192:K4SMg1yveJ5WhkWWbRgIlmDvGrXdyMWqULc++eSG8ScW73iDZF5nvG2cuP4f/PT1:K4SMg1yvC5WhkWWbRgIlmDvGrdyxh+TQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

XeTggVOlJLEYqGiao.zip

Path /data/user/0/com.muhhdyip.oowbqnur/files/dex/XeTggVOlJLEYqGiao.zip
Size 3.7MB
SHA256 39168f73ad0a9420a63c88d0acb187a61762912116dbfec940e84e8dc715d618
MD5 9046e8c755cb5f5ba6e992d0fd67c4a2
SHA1 b5df0e3b09cc0bac19fbbe4c84628c37d2661376
SHA512 e22b5b64de2fe941f76ed173c1f38d00798bc5830c7de1c2235cb9e51948e110ba72aa546638b0b5774d64a70b3557331e960fb61174d5e1f55e9c9655cde07b
SSDEEP 49152:9enfWYSTK62enS4RwG9cqHsTR10I8/Tjx6FD:9g+tTK62ec01/T16V
MD5 SHA1 SHA512 SSDEEP

Download

XeTggVOlJLEYqGiao.zip

Path /data/user/0/com.muhhdyip.oowbqnur/files/dex/XeTggVOlJLEYqGiao.zip
Size 3.7MB
SHA256 04ef4626f523fdd0753f1b5dec92225c67c37fbdf0f71e85aa2e03a4f7cb1cf9
MD5 aad33d98b16f53a39b1da048ff5de945
SHA1 1bc7b46265e59cbf2eb3ed631241ba1825627849
SHA512 b47f05fbec11b34be48d4c3d3f2690022d0b41d6baa05b3451571e04d473512e6fbfa7fcb12d1fe8933e3b729378a14d2b1c7903bcb447bbc5d5f13811d75d72
SSDEEP 49152:9enfWYSTK62enS4RwG9cqHsdsRR//oP5SpfNnFD:9g+tTK62ef/oPu9V
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads