tispy | 4bcb6951c5f78c646c19771ff58c2ea749e734ae3fa916f130aeee8e083ca2e4

Analysis

max time kernel
47s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
30/08/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4bcb6951c5f78c646c19771ff58c2ea749e734ae3fa916f130aeee8e083ca2e4.apk
Size 3.5MB
Sample240830-br9bdasbjp
SHA256 4bcb6951c5f78c646c19771ff58c2ea749e734ae3fa916f130aeee8e083ca2e4
MD5 fc91f5ec788858dd0bf446840404b54f
SHA1 bc137d65ca80518a8142dc13e6aebfcccc52170f
SHA512 3edcf82701d7efd9000403c30f4511a485e979a81d96175a3e63a40886c6d5f6541e70b8de0ee10ca21399c1f1c872562c8bc9b7d335608395ffada3006ffd0c
SSDEEP 49152:tmqmsPEvtj1o2POM73aZkSPzBpKjGCZdDV19CLVtr2ps8aA9wq+ID9+G1WV7d6lz:tmqmLlj/PH3PcDOB3Cnaq859RIIR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan

Malware Config

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/95adbfe2f455c0ae.zip	4280	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/95adbfe2f455c0ae.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/oat/x86/95adbfe2f455c0ae.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/95adbfe2f455c0ae.zip	4214	com.juzyuwqt.thxxnjvf
/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/UTIwzInMxrMbXrXkJ.zip	4304	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/UTIwzInMxrMbXrXkJ.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/oat/x86/UTIwzInMxrMbXrXkJ.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/UTIwzInMxrMbXrXkJ.zip	4214	com.juzyuwqt.thxxnjvf
/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/95adbfe2f455c0ae.zip	4214	com.juzyuwqt.thxxnjvf
/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/UTIwzInMxrMbXrXkJ.zip	4214	com.juzyuwqt.thxxnjvf

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.juzyuwqt.thxxnjvf

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.juzyuwqt.thxxnjvf

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.juzyuwqt.thxxnjvf

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.juzyuwqt.thxxnjvf

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.juzyuwqt.thxxnjvf

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.juzyuwqt.thxxnjvf

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.juzyuwqt.thxxnjvf

com.juzyuwqt.thxxnjvf
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4214
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/95adbfe2f455c0ae.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/oat/x86/95adbfe2f455c0ae.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4280
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/UTIwzInMxrMbXrXkJ.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.juzyuwqt.thxxnjvf/files/dex/oat/x86/UTIwzInMxrMbXrXkJ.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4304

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

privatesms.db

Path /data/data/com.juzyuwqt.thxxnjvf/databases/privatesms.db
Size 16KB
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
SSDEEP 6:l9FClq1pO64yXsfzhd6mQLuCeC9F8KCPzRtSzxERX4PBX4ogLugMBX4suuK0Dqif:TgqfO6PstjVC7nCjRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-journal

Path /data/data/com.juzyuwqt.thxxnjvf/databases/privatesms.db-journal
Size 512B
SHA256 61b2198d8983f1abc20e2c513c5168c42acb6dd3ec05278b6f31b904e3a9da50
MD5 4a8b352c31451a8c26a60d04d7381bbc
SHA1 7835aced891f626418c89c8005df63a06685c234
SHA512 a478abc14d886b6f21f6c537befb40f9553648ee85f17c33efa0c5b8ab087140aef3fc5bf4cb9989d4ed60f2540e5169d1e050d264c7476934a965e15b2ed142
MD5 SHA1 SHA512

Submit Download

privatesms.db-shm

Path /data/data/com.juzyuwqt.thxxnjvf/databases/privatesms.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-wal

Path /data/data/com.juzyuwqt.thxxnjvf/databases/privatesms.db-wal
Size 28KB
SHA256 5a079b5dd727f43f36432f97b04d653773f00b75851d002cb61bab0a489b90d1
MD5 ce75509225bc1c911423c293b4c31b9f
SHA1 ca3ebe0249c1d87987c8e80b87af43c9d8ee83b1
SHA512 f8ac484720378e043c4d4df7d537b7de0955048761f3fd81e94d0276f28994773aee059ab09a0a5ed53dee0b3203446c64b7ec93502287b4ccd66546dc7e38c1
SSDEEP 12:KigqYgTOTzdTRmBEyPbP/Eggg8igQqWOwClDgkhgqfO6PstjVC7nCjRmBEyPbP/:KDwQzyGSP/JlWL0ZE16YJGSP/J4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

479114.so

Path /data/data/com.juzyuwqt.thxxnjvf/files/479114.so
Size 145KB
SHA256 85fbadaa8a7e3fcb05a161cc44f8a99e6b52c1106e11ec898ebd1f5c86afb58c
MD5 9f7955db7f30191ce65c0dfc8c0ce4fb
SHA1 1174c22e03275dc289b6827222aa41e66650a295
SHA512 5a8ee4fc42933b725082d96fe09dc5f8ae1484eeac27c2e2adb8dde4e6eb3a559cf7edb199617b6455bc44f7c4d18beebce6c3ee3c22a59840655457cf2f4380
SSDEEP 3072:2LBuzFYnl6Tqs9Wn9OLgT4toCDEhL0Ci/7NOK0D8u2Gn6ou5cQ3lMVCe5gt5SBs6:2LAzFYnl6Tqs9Wn9OLgT4toCDEhL0CiQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

95adbfe2f455c0ae.zip

Path /data/data/com.juzyuwqt.thxxnjvf/files/dex/95adbfe2f455c0ae.zip
Size 548KB
SHA256 5c67a00a92b3aadc52e21b20bc2a337412253850487056b965fff478c0be7869
MD5 8a56d10123d8fb7f7672261c609c7343
SHA1 0f9046d02f050ef0949fc4c12346b4b64c04a36c
SHA512 876c101e5de4c61b7233b580a151b0845e688a563b7deab28076cb2420c50a93c28b2eeb11ddb13e3396df45aaa926d97692e34fa4ab785bfef252806ed0ca78
SSDEEP 12288:8i0nqujGRG5/uY6ynYFMSH5R8VVGhCY0qpXznXDHN2:8Nnean6ynh05R2Q50qpjnJ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

UTIwzInMxrMbXrXkJ.zip

Path /data/data/com.juzyuwqt.thxxnjvf/files/dex/UTIwzInMxrMbXrXkJ.zip
Size 649KB
SHA256 81f5d456f86af0289e35e217798e370fd94f903cfb6673d6ee49ac3ab7c7512f
MD5 660e9ccebedb399da7b3d9fedc6ab638
SHA1 12e4da8b1b09746b52053265c69a8964d291408c
SHA512 ad59915b41b3419274b841dcdf58352271ea077dd73e729528f4ba440fe55b1a2cbd6969ba42472ee7ea1aaa6de3c87beb503c4c95d9b8a5d9602ba79daa5b69
SSDEEP 12288:UeEXYRrVzHOwCTRj/2XiU4eK9Pa3+Oz7HENZ1VILof8AMByXR:DEIfOw4eKRYBzoNnVILoEAuiR
MD5 SHA1 SHA512 SSDEEP

Submit Download

pro_btn_bg_animation_img_0.jpg.zip

Path /data/data/com.juzyuwqt.thxxnjvf/files/dex/pro_btn_bg_animation_img_0.jpg.zip
Size 8KB
SHA256 1a10cc3cd2dc21a9be2d2eb758fd19288082619d331245b927d0a9299462ea2e
MD5 7c20a2b01bf3f9df1f0abb72ebbe82be
SHA1 e601b2e41434623edbeece32867517a3cdec5449
SHA512 3faa6efbd3ebf6e1aff7ebe9958c5f94bbfe9c5ff9e11e9092b1b7301bbe6504c01b922d709303147e213b3cadce8e96462220a1d1bf4d6cdaec95b3f84bb1b4
SSDEEP 192:cWweY+9BMmN65SAb/ykGoNcHLX3GdY955BFpsQixzZsANHM9ndkr:F3Yo3JO/edaqbtaHx1sAtM7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sistema1724981044698.log

Path /data/data/com.juzyuwqt.thxxnjvf/logs/Sistema1724981044698.log
Size 15KB
SHA256 65565dbeebe2e97202790f845c21fc659b765de08a7dcf48ca44be9b0a909a3a
MD5 d9fa45b078d54ab1e28234cbd7a81472
SHA1 2798deb90b31f8c0239c9b48add58635b4c1b517
SHA512 668f2cac57e59f2b7e3b5ad1ac3ec0c76935d7b343d8184afcf59cd8112257d830b8b925ebc54e6718396bf3fb8f0bee608f16719c7c8776695c0efa2414bf61
SSDEEP 384:0U/81yv25WhkWWbRgIlmDRaRugoyu3vZu3iu9exuB6+:jkWWbRY3gE3s3V9es0+
MD5 SHA1 SHA512 SSDEEP

Submit Download

95adbfe2f455c0ae.zip

Path /data/user/0/com.juzyuwqt.thxxnjvf/files/dex/95adbfe2f455c0ae.zip
Size 1.3MB
SHA256 80678a47a756d3c8ce38606dee0332a02d5d864d9f3f36b8e896d8d3645e33eb
MD5 9f7b1005c3f1c9927950fa42a4a14054
SHA1 f0db8bf167c1fdefb384a0ddf3f0a154bc1b0a97
SHA512 5e09de4dc351ad052ec76cd2e3c9e5a64b63d4251f3f46ac412959059381d98fbd350a0cf61215d46038af7f48911d4cf869ea551da89c258724924ff0135bdf
SSDEEP 24576:sNGWGHyU+lcPZU8RckFfGDrqBr73Xro6IAXsbLx:8LorRBsp
MD5 SHA1 SHA512 SSDEEP

Download

95adbfe2f455c0ae.zip

Path /data/user/0/com.juzyuwqt.thxxnjvf/files/dex/95adbfe2f455c0ae.zip
Size 1.3MB
SHA256 964f248542766ddba915f7ebafa9972117d46e4f28f654513ed69d7d7a1b5ff4
MD5 7ab2793451a957186ac073041c1ea72f
SHA1 2584cdb12c209f9a7f9c024e702d49a30fe11d62
SHA512 3228bc50db8bb04ae5a05d210548e4020c567c8d394a5f9f8ed38718635f1535111e9ec068b2398ada172ce65e740f6ce0f8c9235c7131d953540dd894dae44e
SSDEEP 12288:8DNGWGHhQUI1NBPH8mlhOO9phUY0L7kMZx4+gZktiqHQLVPCb0lrZ83zAjAXnk1N:sNGWGHyU0/1qFD/QLIKr/AXsbLx
MD5 SHA1 SHA512 SSDEEP

Download

UTIwzInMxrMbXrXkJ.zip

Path /data/user/0/com.juzyuwqt.thxxnjvf/files/dex/UTIwzInMxrMbXrXkJ.zip
Size 1.7MB
SHA256 beb0fd1a4e672aea76cf73c421a4b07d0b3d16372e4c5bfd8f0f70d55d59cefa
MD5 184f051be2142e792b2080d1bc93f8cb
SHA1 341d8a1c46417f08680e1b2776449f9ad5bd9d53
SHA512 13a99e88c7ebba53eac9d3a13e4ea5e3ffebb794d55c436bb8886a56f0c174857f0556bc8222be3ac6a835dfa3b08ffba61826a5a9e9980e66847cc97f2852a5
SSDEEP 24576:MGeR2p6EKBQauXAXQXUXyPUbHh+DorW7DN+ACvjV:gcKBbMK62y8V+srSNtCZ
MD5 SHA1 SHA512 SSDEEP

Download

UTIwzInMxrMbXrXkJ.zip

Path /data/user/0/com.juzyuwqt.thxxnjvf/files/dex/UTIwzInMxrMbXrXkJ.zip
Size 1.7MB
SHA256 775a809d640cefc0aa7e8fd1d5c3e1ebe969d3da6668739a443a6baac9e6bf0a
MD5 861388812b3e120b91cb99a8954dfe03
SHA1 d41a729936d8dc5cb35be39b2c37a7613ef7054d
SHA512 fdea32dda24cb6d540cab89049db697c3f79a57e2b3bc477995f78f1276c9a2de4d767722c4592da93e9a55aa73554f089420d7ba69d7ddf455b40085c05a906
SSDEEP 24576:MGeR2p6EKBQauXAXQXUXyPUbrrgxaKSCuwdarSmxC9I0tiAEACvjV:gcKBbMK62y8kh9ArETCZ
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads