Overview

overview

10

Static

static

6

ae78eacdae...32.apk

android-9-x86

10

Analysis

  • max time kernel
    26s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    05/09/2024, 16:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ae78eacdae080fe62fdf851f5b1f05b31b8acfe20f8807c42eb31209afeca532.apk
  • Size 3.5MB
  • Sample240905-ts9mmsvbkp
  • SHA256 ae78eacdae080fe62fdf851f5b1f05b31b8acfe20f8807c42eb31209afeca532
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
tispycollectiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

  • tispy

C2

  • https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_11Aug24&rtype=T

Signatures

  • TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • TiSpy payload 2 IoCs
  • Loads dropped Dex/Jar 1 TTPs 7 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence

Processes

  • com.hchhriim.jlsxswtu
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about the current nearby Wi-Fi networks
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4305
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.hchhriim.jlsxswtu/code_cache/1725965348669.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.hchhriim.jlsxswtu/code_cache/oat/x86/1725965348669.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4333
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hchhriim.jlsxswtu/files/dex/KcGWwxUkVVyvyLkxX.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.hchhriim.jlsxswtu/files/dex/oat/x86/KcGWwxUkVVyvyLkxX.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4355
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.hchhriim.jlsxswtu/code_cache/1725965351279.dex --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/data/com.hchhriim.jlsxswtu/code_cache/oat/x86/1725965351279.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4377

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1725965348669.dex
        • Path /data/data/com.hchhriim.jlsxswtu/code_cache/1725965348669.dex
        • Size 4KB
        • SHA256 401f68f4448fd6288b7619a7a2ae4646493cd7268f16aa6714802833fbc1197e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1725965348669.dex
        • Path /data/data/com.hchhriim.jlsxswtu/code_cache/1725965348669.dex
        • Size 8KB
        • SHA256 5dfcef0f59a512a9d88d21de81e5f9a20ff420d328736a1426b0a45f9459d832
        • MD5 SHA1 SHA512 SSDEEP
        Download

        1725965348669.dex
        • Path /data/data/com.hchhriim.jlsxswtu/code_cache/1725965348669.dex
        • Size 8KB
        • SHA256 bc5290425eaa32b00a84a94c58976321e7643bc5d668817524ad68a1c7d2082b
        • MD5 SHA1 SHA512 SSDEEP
        Download

        privatesms.db
        • Path /data/data/com.hchhriim.jlsxswtu/databases/privatesms.db
        • Size 16KB
        • SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        privatesms.db-journal
        • Path /data/data/com.hchhriim.jlsxswtu/databases/privatesms.db-journal
        • Size 512B
        • SHA256 1f9eb1fab2460a45d3c70ec62114eb08902a79bd9136c60d69d808a0e2623b9e
        • MD5 SHA1 SHA512
        Submit Download

        privatesms.db-shm
        • Path /data/data/com.hchhriim.jlsxswtu/databases/privatesms.db-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        privatesms.db-wal
        • Path /data/data/com.hchhriim.jlsxswtu/databases/privatesms.db-wal
        • Size 28KB
        • SHA256 afac07803200a6280166b9f2f74547d855b2e987fd4f900779c2c23461e07661
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        478704.so
        • Path /data/data/com.hchhriim.jlsxswtu/files/478704.so
        • Size 145KB
        • SHA256 7f9cd0347aba9667b4d7d9099cd2e48be2879f9db44f0e2bcd35bf82f0fcb80a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KcGWwxUkVVyvyLkxX.zip
        • Path /data/data/com.hchhriim.jlsxswtu/files/dex/KcGWwxUkVVyvyLkxX.zip
        • Size 1.5MB
        • SHA256 8b3ca6d85b292f06710e7775e66a09fe7c6463c02869c9fb808cac5e8ca56f27
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Sistema1725965352557.log
        • Path /data/data/com.hchhriim.jlsxswtu/logs/Sistema1725965352557.log
        • Size 9KB
        • SHA256 f0fc8d524244a2c29ae9556c69f9b07c21edc7abde1bcf2403ba4f8bea79f078
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KcGWwxUkVVyvyLkxX.zip
        • Path /data/user/0/com.hchhriim.jlsxswtu/files/dex/KcGWwxUkVVyvyLkxX.zip
        • Size 3.7MB
        • SHA256 6e3fa820728752be7037251bd1457222c154fec1cbba545458e864ff36e715dd
        • MD5 SHA1 SHA512 SSDEEP
        Download

        KcGWwxUkVVyvyLkxX.zip
        • Path /data/user/0/com.hchhriim.jlsxswtu/files/dex/KcGWwxUkVVyvyLkxX.zip
        • Size 3.7MB
        • SHA256 92a949776d5f228ec719645d4aa32a7943b303845725697e3bb24a33c6a77cb7
        • MD5 SHA1 SHA512 SSDEEP
        Download