Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    WiFiService.apk

  • Size

    3.5MB

  • Sample

    240724-cwat2sshnn

  • MD5

    0520ea3fa88dad54ba0ea68ac36db627

  • SHA1

    4b23fb3b04c13dd8e95d286f40492285cda69333

  • SHA256

    b36a55239f18d568148f2de1051ef6379e8a64a3a03bcfb455375245928bbbaa

  • SHA512

    c363764b0bb7b80e56da4a84a104452c523c52a4e5568ef085cd80b19e50f82c06aecc435c74b7047789a07155bb13be99ee0269a4fd0f3b737ef29d190ebfda

  • SSDEEP

    49152:ycJhFnAaaPgU7+pa9eyYDUjUHyjw71ltiUXTiXY2ODpBX7n/mrv1SXh:ycJ7nXaPJ6HejWyjwpiUX24DpOSXh

Malware Config

Extracted

Family

tispy

C2

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_24Jul24&rtype=T

Targets

    • Target

      WiFiService.apk

    • Size

      3.5MB

    • MD5

      0520ea3fa88dad54ba0ea68ac36db627

    • SHA1

      4b23fb3b04c13dd8e95d286f40492285cda69333

    • SHA256

      b36a55239f18d568148f2de1051ef6379e8a64a3a03bcfb455375245928bbbaa

    • SHA512

      c363764b0bb7b80e56da4a84a104452c523c52a4e5568ef085cd80b19e50f82c06aecc435c74b7047789a07155bb13be99ee0269a4fd0f3b737ef29d190ebfda

    • SSDEEP

      49152:ycJhFnAaaPgU7+pa9eyYDUjUHyjw71ltiUXTiXY2ODpBX7n/mrv1SXh:ycJ7nXaPJ6HejWyjwpiUX24DpOSXh

    • TiSpy

      TiSpy is an Android stalkerware.

    • TiSpy payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Queries the phone number (MSISDN for GSM devices)

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Acquires the wake lock

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks