slocker | 51baf4bc48db631e887ded88c0beb05b7a2f6f26ad2d122ee7c6cca6678752f5

Sharing

General

Target

51baf4bc48db631e887ded88c0beb05b7a2f6f26ad2d122ee7c6cca6678752f5.zip
Size

32.5MB
Sample

240805-brn1fasfqj
MD5

a58b72237a14d709c6eea04b73049210
SHA1

786a2d070ea75d7fd858ebd93869063fedd6d705
SHA256

51baf4bc48db631e887ded88c0beb05b7a2f6f26ad2d122ee7c6cca6678752f5
SHA512

978b868d4ce591570f722d167e14f2b6533d3b341bdaac1048fb3d1196ad26b2009269514d29b5aeb12aa75697ae556ebd3c88af1ed4ea00f8c83289fff7a9b9
SSDEEP

786432:xDWCPFc6LHxrdAxglUJMtJg9GzAl8g5lf/F9M6GvHzn9:sUzjxrdAxxJM+l8g5lDM6Gj9

Score

10^/10

Malware Config

Extracted

Family

tispy

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_22Jun24&rtype=T

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_21Jun24&rtype=T

Targets

- Target
  
  1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0.apk
- Size
  
  3.2MB
- MD5
  
  14623d7dc9a647db6984cc6dfdfa2f63
- SHA1
  
  4784359d681992c1db6e4221a5e51f01c306c24d
- SHA256
  
  1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0
- SHA512
  
  955dcf412c8f8dc62562465f0cf0a359fd11c31739e8dbb0d53b75fe5fc24376914f85517dc9ee88763072a5d855e2b9200e801ea906b58119f9736b6e41689f
- SSDEEP
  
  49152:kkQ7hynArFFP/RI5cHF2+XwTn8JBvvrMNvrsdKcWVftaWcSFhidvbKCH9B8zTAI:kkQ7Qn+nPD2+AIfMtrs09A7dvb5dBA
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- TiSpy payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1
- Target
  
  5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk
- Size
  
  2.7MB
- MD5
  
  2ddbc785cd696041c5b0c3bd1a8af552
- SHA1
  
  1269636a5197ee7a1402e406c91177bf6a149652
- SHA256
  
  5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e
- SHA512
  
  30e3187fa0c65981ae80f0bfae4ac753020ceb591d9c001a809040fac08795ab2cb04d9a95645a025d15008c4057f14a84826bec86b75453f389ac52d9b8a1e5
- SSDEEP
  
  49152:VPctdtUtD6iJjM2M7xZkQPctdtUtD6yJjM2M7xZkpPctdtUtD62JjM2M7xZknJjj:VP04D6ojkxlP04D64jkx4P04D6sjkxin
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  
  7c44519e51cc203cdd23f27cefe7cf99de34abddf947ba55951721725f15aa57.apk
- Size
  
  3.2MB
- MD5
  
  2f73a6fe62a8ac27d658f15b1dc9a287
- SHA1
  
  a40118f9d9a54938e6e261ee242716ac3a761e89
- SHA256
  
  7c44519e51cc203cdd23f27cefe7cf99de34abddf947ba55951721725f15aa57
- SHA512
  
  480a6c820664ce78b6284678019671edacc4cf98865e335f9816ce84507c2fe42b765db5103e27dab52605f95c5302f58c6691a869e24876df1f396c4d966d89
- SSDEEP
  
  49152:pVPh+nACbPhX9CR3WHZn0/dwbDnog36hR4F41RemM3zfhVzsv5w:pVPcnzbPhoZW5nhnnHVyRtM3znzQw
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- TiSpy payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral5
- Target
  
  FE_Invisible_Troll_Script.apk
- Size
  
  3.2MB
- MD5
  
  3ff43582aa468b8a8d0e063dcfea73bf
- SHA1
  
  5d1d34fcec8f715ce045a5bda04741d40f29001b
- SHA256
  
  a6f56581bb7ae7b242fcaab3d97d04ec2c5ac8aa5870e4e64ffbcf0d78899993
- SHA512
  
  6af7639bc336015161f3087519e1a365ece0d1e0f5f7f20fe1af3243d1e6c3a0f65e38b50dc70f15cd13a232989b22884ca36bf0151630223d37bdba4f250149
- SSDEEP
  
  49152:hrOpp2RqaP3KdsFeHcEKYC4KiJK5ncPjPuE/UpXSkdkIDk5sSEj6QiVterxzrK:hYgv6dsFt0FQnGD/UsrLEjS81PK
Score

7^/10

evasion collection credential_access discovery impact persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral6 behavioral7 behavioral8
- Target
  
  HellBoy.apk
- Size
  
  343KB
- MD5
  
  b2bf555242160805a704c3daaf8dab9e
- SHA1
  
  fac7514df4ac0feefc5ebf6870e07d49e28ef824
- SHA256
  
  e1f8a78fe6c1bc7f8390f2d83dccb82c05e4eafd9b0d8b877131a5574d33975a
- SHA512
  
  ac65cda4fec4fabb837e563830a1dba5d27493db85a360ecdc0f07b1c0241b773c7f0123fbcffe944ab1f4ccbbaf9e9dc428ef57213104bc996849f3d23a5016
- SSDEEP
  
  6144:Nv41LzIlR3wC2/ZoDwbCwR+i+Na4iIwsZC9b98frZo1tRZaNRP:NvMIlCC2Vzp47FZ8b9yWRZ4l
Score

6^/10

evasion
- Requests uninstalling the application.
  evasion
behavioral10 behavioral11 behavioral9
- Target
  
  Roblox Keyless Bloxfruits Script HoHo Hub V3.apk
- Size
  
  3.2MB
- MD5
  
  35b6944128c7cb11594bfc93e4ad0d7c
- SHA1
  
  1dd7c14f0d05c7560764a5bd2e9693cddc049a21
- SHA256
  
  1879320e3bc42bcec7ee18e7e36e8cd579b8711f313d561ab502bcf1d1a559ae
- SHA512
  
  5a53b65492cc7756c5a014c812cc620458462b7fcde15251068f964adebd98d61756fd340fc51a68392f8ef58d2debbb8b53fb34ccea3b68cf65cfd34dff42ba
- SSDEEP
  
  98304:fU5DjBYQQ/2Kp7d5QDJCqVuc6TjEj/K8h+5:iDjel/jp7d5+kqN6TY+L5
Score

7^/10

evasion collection credential_access discovery impact persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral12 behavioral13 behavioral14
- Target
  
  Stick War_ Legacy.apk
- Size
  
  3.2MB
- MD5
  
  ae5770ecb741649cd470d645dd611843
- SHA1
  
  d6d29b4466c5139b9ea5b63d2b85150d6604abc5
- SHA256
  
  ba39a4b76ab656532003e560476b9a295df488f50195c6b9d7ac523b6d07aab4
- SHA512
  
  dda845e67dedf51508205f6aa7ffd8d19fcad0f0077178c71b8f65a96cb4096d3f326f52c081ea003f78703fdbbbff79f77b3618fd06717be67987627d0f524f
- SSDEEP
  
  98304:mO76p/xfKx1ppTyRwkrB0z+X0iXN9ALEjTRVShd:mi6FxfKxjdy66B0z+EiZnKT
Score

7^/10

collection credential_access discovery evasion impact persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral15 behavioral16 behavioral17
- Target
  
  Undead_Defense_Tycoon_Script.apk
- Size
  
  3.2MB
- MD5
  
  fc35546a7395a68b6440de033afa789d
- SHA1
  
  4afc8724e58084164148b7ce518ede8b203dce3c
- SHA256
  
  c1b81966fa17c4e7d5137f13b2f4d04704c97d66a54d57dcfc1f42ad1f4029e7
- SHA512
  
  ae32d9e7d7403a6ab0429da69fe4f803001a077327a0f103ccc9bcb90b17973ef10be8dc2cbf1909549a04f1eff5e85c81c2dfc2d99ba7fa93369efa47beca6c
- SSDEEP
  
  98304:BaqBN1el9eL+FB8Y2nzDNWbVAneM/EjF+894S:oqX1nk52n05AehERS
Score

7^/10

evasion collection credential_access discovery impact persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral18 behavioral19 behavioral20
- Target
  
  antivirus.apk
- Size
  
  533KB
- MD5
  
  9f01767647e2e72f446d374bbcb20c53
- SHA1
  
  f6b1adcd7723b525418a05bcede5c671366d7ab3
- SHA256
  
  fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1
- SHA512
  
  4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed
- SSDEEP
  
  12288:kjRH6+O//n3tKpSsM+1HA+x283ecVS3EVqPlR6i0Ci3jM34D9Z:kN6+ONjstg38OOS3EW6i0C+M3SZ
Score

7^/10

collection impact privilege_escalation
- Reads the contacts stored on the device.
  collection
- Tries to add a device administrator.
  privilege_escalation impact
behavioral21 behavioral22 behavioral23
- Target
  
  b3f23bdd3dea208f05de7a5b9ea928758187b3f2b0f4f5733c8bdb3298818ec0.apk
- Size
  
  3.7MB
- MD5
  
  f17c846775fe7d69c25b1f9834ec31d9
- SHA1
  
  642e9c6595ed94cf6040c9a66e4431b04a62a2a3
- SHA256
  
  b3f23bdd3dea208f05de7a5b9ea928758187b3f2b0f4f5733c8bdb3298818ec0
- SHA512
  
  2f9883be40f1b9fda7ef9bd432c7d32e5adf6222e5bc9dbeed974f7e101a8c8af39f3bdd059fb0b83cb7e0d034f1ac85bc860bba30eb46b2da7f6d02657c70c9
- SSDEEP
  
  98304:qmVDDWjqPP2X1180Q046fgVPwLBqylSWFk5uYUbLCJrn:p3WjqX2l2046qPwLB/lS+kpUnu
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral24
- Target
  
  e8947bc9fb2bd597daba3064d5fab275d8df2beac92f301063f22fe276dcbc10.apk
- Size
  
  3.5MB
- MD5
  
  990bf5a2e9a7c90c75c9c07bf4a5e634
- SHA1
  
  ade24475ee8a9a2a0eec43772bbc02aeacb5926c
- SHA256
  
  e8947bc9fb2bd597daba3064d5fab275d8df2beac92f301063f22fe276dcbc10
- SHA512
  
  40419371a8dd596e8930e298e0d5470efd168a6d1a8425b8aa6eeb4e495cbc49580f234ac4278117600e2ff516ebdd867e6d395d67c80ce56660d1c8ca9ec92f
- SSDEEP
  
  98304:8mRW7NIyWHAt/2qcPf7K+KjXZKBEjzZST:8R7Wgt/GPjKPFK2XC
Score

7^/10

discovery evasion persistence
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral25
- Target
  
  insta_followers.apk
- Size
  
  4.6MB
- MD5
  
  51064cc8676f45813dec4c5a1c1ce150
- SHA1
  
  e9d2c7b278c98f85481176c6089b2a74120c6b56
- SHA256
  
  e232bbfa86980003e46cd2019243e2579b15c844957cd21e70f8d4300ce25f78
- SHA512
  
  e380e740f4a91013e07e05848ebc4e64ac8278425697cd1da110ec940f6884402d4974302eff493ac685f6969d732e63e95304aaad9742e06f9d8fcd7da3d722
- SSDEEP
  
  98304:SjbFZKFifcyWk4D+zfro+Pr0hOR6G21GB/EjJ9:IhsFTkP4h8F8b
Score

7^/10

evasion impact
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
behavioral26 behavioral27 behavioral28
- Target
  
  xxx.apk
- Size
  
  1.3MB
- MD5
  
  a36c03f774b76ed4ef5b006a87df6044
- SHA1
  
  7fe65ebb68b4230ecab0cdb0bd8118bb4977c9aa
- SHA256
  
  a56cc7c5357f5a7a0e3eb1ac6c0c7a57e8c2fcc3921b6075e200ebfec2154020
- SHA512
  
  0405ba700fd5149ca38ed8fa1ecc905141512985a081d9ebc612d251ab693d6d861c501351f83c213a4c4036a8f64eec0b1bdd3b1ddb3dd400fdc75e83e291bd
- SSDEEP
  
  24576:s9VZHdEZhZDzNj/cUh0gY1nR7xBGBv/K3938C4SQHKAeXY+s2xnmRkAYRJzJCO24:s9VZHdEfph7cUSgY1JxovsQqPXz5xnKU
Score

1^/10
behavioral29

Sharing

General

Malware Config

Extracted

Targets

TiSpy

TiSpy payload

Loads dropped Dex/Jar

Queries information about the current nearby Wi-Fi networks

Queries the phone number (MSISDN for GSM devices)

Requests cell location

Acquires the wake lock

Queries information about active data network

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Reads information about phone network operator.

TiSpy

TiSpy payload

Loads dropped Dex/Jar

Queries information about the current nearby Wi-Fi networks

Queries the phone number (MSISDN for GSM devices)

Requests cell location

Acquires the wake lock

Queries information about active data network

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Reads information about phone network operator.

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Queries the mobile country code (MCC)

Reads information about phone network operator.

Requests uninstalling the application.

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Queries the mobile country code (MCC)

Reads information about phone network operator.

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Queries the mobile country code (MCC)

Reads information about phone network operator.

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Queries the mobile country code (MCC)

Reads information about phone network operator.

Reads the contacts stored on the device.

Tries to add a device administrator.

TiSpy

Loads dropped Dex/Jar

Queries information about the current nearby Wi-Fi networks

Queries the phone number (MSISDN for GSM devices)

Requests cell location

Acquires the wake lock

Queries information about active data network

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Reads information about phone network operator.

Loads dropped Dex/Jar

Acquires the wake lock

Makes use of the framework's foreground persistence service

Queries information about active data network

Queries the mobile country code (MCC)

Reads information about phone network operator.

Loads dropped Dex/Jar

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2