Analysis
-
max time kernel
47s -
max time network
150s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
29/08/2024, 02:14
General
-
Target
k.apk
-
Size
3.5MB
-
MD5
fc91f5ec788858dd0bf446840404b54f
-
SHA1
bc137d65ca80518a8142dc13e6aebfcccc52170f
-
SHA256
4bcb6951c5f78c646c19771ff58c2ea749e734ae3fa916f130aeee8e083ca2e4
-
SHA512
3edcf82701d7efd9000403c30f4511a485e979a81d96175a3e63a40886c6d5f6541e70b8de0ee10ca21399c1f1c872562c8bc9b7d335608395ffada3006ffd0c
-
SSDEEP
49152:tmqmsPEvtj1o2POM73aZkSPzBpKjGCZdDV19CLVtr2ps8aA9wq+ID9+G1WV7d6lz:tmqmLlj/PH3PcDOB3Cnaq859RIIR
Malware Config
Signatures
-
TiSpy
TiSpy is an Android stalkerware.
-
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.juzyuwqt.thxxnjvf1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/95adbfe2f455c0ae.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/oat/x86/95adbfe2f455c0ae.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/UTIwzInMxrMbXrXkJ.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/oat/x86/UTIwzInMxrMbXrXkJ.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD53621ce0aa81e37bc5c80e2cf881f1dd0
SHA100365f82dcada94caea07443656848baf60b3bd9
SHA2568620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
SHA51276bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
-
Filesize
512B
MD56d82f3162ed23935df47a4257d4839c9
SHA15d9779fc50a9a9b68fe1f2103b5c86e2cd1e6b7e
SHA25634eb1db65cda18c3273981ff8c696d23f6f18f4867c8f65b583a5573866e4b00
SHA512dabe0a5d01fc29acae1131e27e07f06c1152d239720c86f9e8b9a0808aea75ed7ec22cab899a5b59dad80fb2bac96153a88e544509fa68790ab1b2f12f231bb3
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
28KB
MD5051503083949449e4c2cef02abf68fd9
SHA1186f733cb65a8aa8430beca6475889cad0ee7337
SHA256d8e5757f10ebb1524a04649494e3287d8e8386864527ef3c1ddebd93413c1cd3
SHA512907e15b0708f821b05f45d7b0a9253174ad0e7411f0daa17489fdfb97b94cd5c4b92d2f397a600849db17eeb2125c98f7ea0945acda5878be766e4986946f920
-
Filesize
145KB
MD59f7955db7f30191ce65c0dfc8c0ce4fb
SHA11174c22e03275dc289b6827222aa41e66650a295
SHA25685fbadaa8a7e3fcb05a161cc44f8a99e6b52c1106e11ec898ebd1f5c86afb58c
SHA5125a8ee4fc42933b725082d96fe09dc5f8ae1484eeac27c2e2adb8dde4e6eb3a559cf7edb199617b6455bc44f7c4d18beebce6c3ee3c22a59840655457cf2f4380
-
Filesize
548KB
MD58a56d10123d8fb7f7672261c609c7343
SHA10f9046d02f050ef0949fc4c12346b4b64c04a36c
SHA2565c67a00a92b3aadc52e21b20bc2a337412253850487056b965fff478c0be7869
SHA512876c101e5de4c61b7233b580a151b0845e688a563b7deab28076cb2420c50a93c28b2eeb11ddb13e3396df45aaa926d97692e34fa4ab785bfef252806ed0ca78
-
Filesize
649KB
MD5660e9ccebedb399da7b3d9fedc6ab638
SHA112e4da8b1b09746b52053265c69a8964d291408c
SHA25681f5d456f86af0289e35e217798e370fd94f903cfb6673d6ee49ac3ab7c7512f
SHA512ad59915b41b3419274b841dcdf58352271ea077dd73e729528f4ba440fe55b1a2cbd6969ba42472ee7ea1aaa6de3c87beb503c4c95d9b8a5d9602ba79daa5b69
-
Filesize
8KB
MD57c20a2b01bf3f9df1f0abb72ebbe82be
SHA1e601b2e41434623edbeece32867517a3cdec5449
SHA2561a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
SHA5123faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4
-
Filesize
15KB
MD54a825c3d0f1212631599a696efaa802e
SHA111ff092614fc3fe95239a4815212dd3e685c427c
SHA25666a7f15526d3c9040f2a219d754117b034f5ab823d15d8be22d338b6d87c7905
SHA5120ae2fd254ca765ac1f1126d4a844ea0edf73690c5bcf82d1d65a8bb4d8c24b65b0988b6a0a331d9b7ca371995696e669542142b4168da2c452a5fc98b236f4b1
-
Filesize
1.3MB
MD59f7b1005c3f1c9927950fa42a4a14054
SHA1f0db8bf167c1fdefb384a0ddf3f0a154bc1b0a97
SHA25680678a47a756d3c8ce38606dee0332a02d5d864d9f3f36b8e896d8d3645e33eb
SHA5125e09de4dc351ad052ec76cd2e3c9e5a64b63d4251f3f46ac412959059381d98fbd350a0cf61215d46038af7f48911d4cf869ea551da89c258724924ff0135bdf
-
Filesize
1.3MB
MD57ab2793451a957186ac073041c1ea72f
SHA12584cdb12c209f9a7f9c024e702d49a30fe11d62
SHA256964f248542766ddba915f7ebafa9972117d46e4f28f654513ed69d7d7a1b5ff4
SHA5123228bc50db8bb04ae5a05d210548e4020c567c8d394a5f9f8ed38718635f1535111e9ec068b2398ada172ce65e740f6ce0f8c9235c7131d953540dd894dae44e
-
Filesize
1.7MB
MD5184f051be2142e792b2080d1bc93f8cb
SHA1341d8a1c46417f08680e1b2776449f9ad5bd9d53
SHA256beb0fd1a4e672aea76cf73c421a4b07d0b3d16372e4c5bfd8f0f70d55d59cefa
SHA51213a99e88c7ebba53eac9d3a13e4ea5e3ffebb794d55c436bb8886a56f0c174857f0556bc8222be3ac6a835dfa3b08ffba61826a5a9e9980e66847cc97f2852a5
-
Filesize
1.7MB
MD5861388812b3e120b91cb99a8954dfe03
SHA1d41a729936d8dc5cb35be39b2c37a7613ef7054d
SHA256775a809d640cefc0aa7e8fd1d5c3e1ebe969d3da6668739a443a6baac9e6bf0a
SHA512fdea32dda24cb6d540cab89049db697c3f79a57e2b3bc477995f78f1276c9a2de4d767722c4592da93e9a55aa73554f089420d7ba69d7ddf455b40085c05a906
