Analysis
-
max time kernel
48s -
max time network
128s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
05-08-2024 01:22
General
-
Target
b3f23bdd3dea208f05de7a5b9ea928758187b3f2b0f4f5733c8bdb3298818ec0.apk
-
Size
3.7MB
-
MD5
f17c846775fe7d69c25b1f9834ec31d9
-
SHA1
642e9c6595ed94cf6040c9a66e4431b04a62a2a3
-
SHA256
b3f23bdd3dea208f05de7a5b9ea928758187b3f2b0f4f5733c8bdb3298818ec0
-
SHA512
2f9883be40f1b9fda7ef9bd432c7d32e5adf6222e5bc9dbeed974f7e101a8c8af39f3bdd059fb0b83cb7e0d034f1ac85bc860bba30eb46b2da7f6d02657c70c9
-
SSDEEP
98304:qmVDDWjqPP2X1180Q046fgVPwLBqylSWFk5uYUbLCJrn:p3WjqX2l2046qPwLB/lS+kpUnu
Malware Config
Signatures
-
TiSpy
TiSpy is an Android stalkerware.
-
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.ygvezckt.rwqaztkw1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ygvezckt.rwqaztkw/files/dex/316f40170801e947.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.ygvezckt.rwqaztkw/files/dex/oat/x86/316f40170801e947.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ygvezckt.rwqaztkw/files/dex/lLtoeVfIDbcROVZBX.zip --output-vdex-fd=45 --oat-fd=44 --oat-location=/data/user/0/com.ygvezckt.rwqaztkw/files/dex/oat/x86/lLtoeVfIDbcROVZBX.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.ygvezckt.rwqaztkw/databases/privatesms.dbFilesize
16KB
MD53621ce0aa81e37bc5c80e2cf881f1dd0
SHA100365f82dcada94caea07443656848baf60b3bd9
SHA2568620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA51276bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
-
/data/data/com.ygvezckt.rwqaztkw/databases/privatesms.db-journalFilesize
512B
MD5b61ca75f7c09d267f8c008a6caf0c4b8
SHA1e1ba2fe5d5eea6c29c7f3cb12a83e31e4c2c3144
SHA256a5910635554b2ae348790b255e1ca41fceaf9bf28d921529322fd45eda50578d
SHA5128c5b4f27a152b3ccdb890832a7b6897ce618cf57a0cc4f423d3dff7aa1f8b86a77b64c78ea80e85e885a4e3d58d7d69fb264f6e5e1a5f069adcb89782d8628d4
-
/data/data/com.ygvezckt.rwqaztkw/databases/privatesms.db-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.ygvezckt.rwqaztkw/databases/privatesms.db-walFilesize
28KB
MD51b813f308efeab47760ecc2d8ea1fad4
SHA101799628c2445f111cedda26c1c938aa3b8118b5
SHA256dddcb53374f0b66cf5f223cb310a874f6a2083ea2ba1d04ccaff8d24a1089a09
SHA512fa17d55d0594b7c1caa486b2ad631bc2636a49951ad43bc341b3b1e37c2a152afe80239f9b45700bda5c3bf234dec215b10f1685b6a7b6c62b5fd6dd2022dd07
-
/data/data/com.ygvezckt.rwqaztkw/files/477458.soFilesize
145KB
MD58767a74133b3328c2a87a24893142ec2
SHA1c1c48bcab9d7bf804cad029656d8b79bf8655d29
SHA25680afd0eea39b125cd5a2f300a3b50302f002ff332943f71bd46d7ce5914e0f82
SHA51296a2d70a2adfef8b8da4fc8c6b2be0b7eed0c33f76770093799fd3bbccf1b766290151cbd65981634c821baabdd8d445a6f66cf955045f0f402286b61aab2d7c
-
/data/data/com.ygvezckt.rwqaztkw/files/dex/316f40170801e947.zipFilesize
548KB
MD51b463ebe439550e65863364d145f3633
SHA106a1d114d31cc0c0735f6e865290de0df66534fc
SHA256402745874a8f4229a51c30bb0a3fc4a383d5d2bdecf43f73920c7ec59f402631
SHA51245be5088110b35464faac2c708084e5337ddf5f89d582001582c47db28e04ab577dc036ee481b02f3743b3bfc1a0bc85cdf9185f23aa8e683a2890833b77be5a
-
/data/data/com.ygvezckt.rwqaztkw/files/dex/lLtoeVfIDbcROVZBX.zipFilesize
649KB
MD55631aac4cdaafaf80e13e30ca0f35df4
SHA1a5c11f94c00875c38fcc29debd5ab1f01b6a6d20
SHA256c65d54edc4dfb9bb13a51764be2b1a66e6ef781a6f1a18368d22aeea79f1af6c
SHA51215c45aabc02a08dd369de2b9f3ba736ccdea4cd325e865b079810887d3cfbdf52a7286dbb0516630cc0f83d3fba0a99efcb2a1f37ce3ee0a50bae98eb731eb47
-
/data/data/com.ygvezckt.rwqaztkw/files/dex/pro_btn_bg_animation_img_0.jpg.zipFilesize
8KB
MD57c20a2b01bf3f9df1f0abb72ebbe82be
SHA1e601b2e41434623edbeece32867517a3cdec5449
SHA2561a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
SHA5123faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4
-
/data/data/com.ygvezckt.rwqaztkw/logs/Sistema1722821223161.logFilesize
15KB
MD559a270bf9697ac290d25416cc5d07de0
SHA1c5e2e061c54d9f320ea3fc82310738c173e25d1b
SHA256d5746aaa9f577df76ed1e5334519e23008b3e4918f3e1a83b96c2bd63e02dbd4
SHA512b98af881e6ba7f80d8d1dd9252c880d5ce5b57b9c5054f518d7f32a88c6fb86e4f9049fe4384d71893490a3a9615b11f45a908ff9b47fc45d30141b91d0cab7c
-
/data/user/0/com.ygvezckt.rwqaztkw/files/dex/316f40170801e947.zipFilesize
1.3MB
MD50141ce546517d0ff09558391ffe2c3d1
SHA1c8da2607f42222cf6726f30015fce0e501df3c30
SHA2564f647e2c0402fab82866f27337c18543123212e46abb52914e8c22bcff7382cf
SHA512886f3fd3d8b891a8a1ced7552bb73e82b8eb390bf028570d1e5f1089863399dfe26184c4b6974968cc0a801ac1dadc768af157c386cda3fb0b810279680f48ce
-
/data/user/0/com.ygvezckt.rwqaztkw/files/dex/316f40170801e947.zipFilesize
1.3MB
MD5c276d68c66d80dfed813846189721519
SHA13006ae75be916f82d520f683322ce5b8af4be68b
SHA256ba4227db1d3fb1d9befcdc67847e414b5070dd7e9d28e397c4cec1488309053e
SHA512b5c1844af6bc735c26cb736691d864c3cb4ac567d49c8c0f5a3f73c7d8aa7de890900563a99a7e0a1e114cf561955225bea7522df876c338f380d03e502bb497
-
/data/user/0/com.ygvezckt.rwqaztkw/files/dex/lLtoeVfIDbcROVZBX.zipFilesize
1.7MB
MD50df030186d9f5c370a15db6223ca2eb7
SHA133a9951863ceaf037787cd169c4cf61fcb7bba1b
SHA256ecf40b3088a5186d0c043c2248aaa1a509c4336ae7cad299741fb7fc7ba0b11c
SHA5120777b4c68b58b428410554b9e420852cd3fb2f2bcfe7a48487b1564918c386ca5d80327a7dc9b9b2d8d55da5330296aabd1f866db3e068bbfb3a3d7f393547ae
-
/data/user/0/com.ygvezckt.rwqaztkw/files/dex/lLtoeVfIDbcROVZBX.zipFilesize
1.7MB
MD5eba2e1ec82083be20ece86501cf4a651
SHA1c7296d77e0ff6982396d13e1f6cc54b2be4b5f12
SHA2567cd112ace3c9789beb88d7d75e3c664706505fc8c5ede01fc92fabb9da2700ec
SHA512668f0e05318a9a1d8f28aa9f8796450422b0f5d722704bcb37e003d42951e7033053b2c38ba4bc1144b14bac9114d875e860f5ee8add0986234228e2dc9dfbaf
