tispy | c472c3194ff4213d22454040e7edd87ca0c1c576c5629889b5888c6bf475aa06

Analysis

max time kernel
98s
max time network
93s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
12/09/2024, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61198c354e16dcc0bc33def6a78ceeca41a0bedfbe280a77830c267bb53c84eb.apk
Size

3.5MB
MD5

baa3341da8895f38c6725f45eee3ec71
SHA1

83ebb525d466c7cc4f216c4b9a4827b25b5fc73c
SHA256

61198c354e16dcc0bc33def6a78ceeca41a0bedfbe280a77830c267bb53c84eb
SHA512

4b3583df3bd3723c77cec2552f1c92747591174bc03444f3a103e0f7e794e227832538a245fbfb479498795f8e0ecfbfee15043e60edffcc5f353523907b31e0
SSDEEP

98304:mHC70nYPPeWydlVQtIpuC0j2ccodW6xdpP+hJjj8b:2LYPRydgzEG1mhJjju

Score

10^/10

tispy collection discovery evasion impact infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_28Jul24&rtype=T

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=Signin&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_28Jul24&rtype=T

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=AuthFail&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_28Jul24&rtype=T

Signatures

TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

TiSpy payload 2 IoCs

resource	yara_rule
behavioral1/memory/4361-0.dex	family_tispy
behavioral1/memory/4303-1.dex	family_tispy

Loads dropped Dex/Jar 1 TTPs 7 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139598311.dex	4337	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139598311.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.ffzpmxrz.jnosbrac/code_cache/oat/x86/1726139598311.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139598311.dex	4303	com.ffzpmxrz.jnosbrac
/data/user/0/com.ffzpmxrz.jnosbrac/files/dex/wTjwkCEGTpmQIHpNI.zip	4361	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ffzpmxrz.jnosbrac/files/dex/wTjwkCEGTpmQIHpNI.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.ffzpmxrz.jnosbrac/files/dex/oat/x86/wTjwkCEGTpmQIHpNI.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ffzpmxrz.jnosbrac/files/dex/wTjwkCEGTpmQIHpNI.zip	4303	com.ffzpmxrz.jnosbrac
/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139604495.dex	4385	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139604495.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.ffzpmxrz.jnosbrac/code_cache/oat/x86/1726139604495.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139604495.dex	4303	com.ffzpmxrz.jnosbrac
/data/user/0/com.ffzpmxrz.jnosbrac/files/dex/wTjwkCEGTpmQIHpNI.zip	4303	com.ffzpmxrz.jnosbrac

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.ffzpmxrz.jnosbrac

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.ffzpmxrz.jnosbrac

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.ffzpmxrz.jnosbrac

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ffzpmxrz.jnosbrac

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ffzpmxrz.jnosbrac

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.ffzpmxrz.jnosbrac

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ffzpmxrz.jnosbrac

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ffzpmxrz.jnosbrac

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ffzpmxrz.jnosbrac

com.ffzpmxrz.jnosbrac
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Reads the contacts stored on the device.
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4303
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139598311.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.ffzpmxrz.jnosbrac/code_cache/oat/x86/1726139598311.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4337
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ffzpmxrz.jnosbrac/files/dex/wTjwkCEGTpmQIHpNI.zip --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.ffzpmxrz.jnosbrac/files/dex/oat/x86/wTjwkCEGTpmQIHpNI.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4361
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139604495.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/data/com.ffzpmxrz.jnosbrac/code_cache/oat/x86/1726139604495.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4385

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

Contact List

T1636.003

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139598311.dex

Filesize
4KB

MD5
d3364728f634bf71c4b16542c02c60cb

SHA1
f23088362b69935f404f2b81eaa40ed3172efca5

SHA256
401f68f4448fd6288b7619a7a2ae4646493cd7268f16aa6714802833fbc1197e

SHA512
9378bbda71abcb437676a2d4095d7d3ab6a5a1c1682ec95f3f6d050b9226692cd1a29ba8e7a65dac441c29cfb7b1d5e69e34b5cc32989c90c025909567a662af

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139598311.dex

Filesize
8KB

MD5
cf790c0dfb1361b86d4b8bfca1f8814c

SHA1
d452d9d6504f6af0c9408d6fdb1ced0ff3c45dee

SHA256
5dfcef0f59a512a9d88d21de81e5f9a20ff420d328736a1426b0a45f9459d832

SHA512
e2194cf4ab22064206d9df3523afd3b247f4ce72b7fed17056029746d1f79c1a25d340f8f9c7ec77b9590d05dc7549a735d631a368f82c472cd54bb8a1396c47

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/code_cache/1726139598311.dex

Filesize
8KB

MD5
a137b5568de65b8fef35329930d8617f

SHA1
49a2d6e95d447ba1d448c81691f6a609fb2859ed

SHA256
bc5290425eaa32b00a84a94c58976321e7643bc5d668817524ad68a1c7d2082b

SHA512
9dd6c25dea7b3424e8ca0150a9f1f6f85ed5fccef69e7fadfa05324014b74cc350365b788cee2a8ce25afccee084908e679eafa7f449e7791c6288485d2c5338

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/databases/privatesms.db

Filesize
16KB

MD5
3621ce0aa81e37bc5c80e2cf881f1dd0

SHA1
00365f82dcada94caea07443656848baf60b3bd9

SHA256
8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5

SHA512
76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/databases/privatesms.db-journal

Filesize
512B

MD5
a6de9781180f85024672417658e3636a

SHA1
c5f64dfd2ed41f41daef2f98366cde4e1ac1ecf7

SHA256
bb67f62f1f05564648905d8fac020032c99dab20ca271508250eda2707314b07

SHA512
d5a72eda753c65f7a4b87e375d86bff3e739484afdc32c9502eef9f6243039f3a167ee340df5853ebd95c1e120def4c50fabde16377fcae332312c19d48c309f

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/databases/privatesms.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/databases/privatesms.db-wal

Filesize
28KB

MD5
b606018c9a62dd11400ffe50e82ec86b

SHA1
b537bc47f1d23c827326bc8e06ac13d212eb54e1

SHA256
98e2dda10d05098e28001904676ce8913fa52ec5316c2dc6f8b80b293970999b

SHA512
99fd1a4720e1e2d0cb440e6a669ba0ec8006b5d279dde4e7d1e2edd39deedd0595e8e251731cb00408de693855ba5bb69b1d8423c56fc3338ae936fdb04fbd6a

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/478368

Filesize
145KB

MD5
0439fd9ae29a97484007854e349023b1

SHA1
85d6f9f0cff4b0d89ceb9e9c46a0cb7ae0a8d646

SHA256
243943ad273ad4a2b63bda4be9b18bf6b03f0f395dd467c94c74b2b84b937d2e

SHA512
faf4916868bce822fb9bb548e01dffb90ddb460df468e51000ecd52081af99154c255b24617f362a272b869849596df65d44f78efd5f119f57c0326d0b75d157

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/478368.so

Filesize
145KB

MD5
5ebd0f42ed81326a542e3a9c3ea879be

SHA1
fe172aab7e0dc81a864a451fcccea97caa849aa4

SHA256
ca7461fa1f40af4dd4d932305bd581d0df57176e2d62da2c5654f874a2da917d

SHA512
6d8a9b70630b05100a478ba6c270096b13c265ab03b81209adfe0c13d1213b03c0c675b61a2bec9f7996e883b6ba1c86f795ac9688eedb10f8bdff3814ebdaac

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/478369

Filesize
270KB

MD5
b0484de060376351c432dd5c2246857b

SHA1
92c157a24ae234eabce6e8f7595221040343fb15

SHA256
3cb0c76c97d75389ee92939e63e3a4d776c86da0ebe78b6cbeaeabbb32ce88f5

SHA512
d6da6f69b7ceccd680d25e94eb19c3c50f3955b3abb6e88a4045725be161020b1574edf9fab1e1039e8f645a2f58d836fd2c23de765d65bf3450a972aed0c88f

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/accessibility.gif

Filesize
636KB

MD5
8aa1890c8921030b680c2557f9c8386a

SHA1
8d39dd27c4612354b968b16171f376553e594fab

SHA256
5822cb7097bf82fe0a69a343b226bbc61efa2e091f096f5d9f491e2f82d4b51b

SHA512
742c6aa33ada9f5a7f68741db731dedb9c1522fdcd2253caed7d709efdbb3b7d4be1ecb6ed2fbba13008ff7c9a2e1c7e98daec8a6c6aafcac3788426898fb4e2

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/allow_in_background.gif

Filesize
2.2MB

MD5
c6121724a4eabcd69809d4d607e67580

SHA1
9431787d3e3cdc50d3d55530ad5ec14fc5ac7138

SHA256
677919c33e287b71dca8b851dafddaf0a892a4debed24e043da6e378933221cb

SHA512
4ae7a681174b52cf1eac476b7ed6ce9ba6f7d441d37ceb4315bf57721e1d1ef373a141f85d3c0c7917c550c954209b7d0c9ddba98645ee9d2e0800e94f556957

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/allow_in_background_xiomi.gif

Filesize
1.6MB

MD5
2cc8f9b7e95be09168621b46e804eda1

SHA1
6a2f34c31df9ae9b4c996bc5a3d65ded5eb2f13f

SHA256
280c95d71831fee6198324069a631f591af99d0b801f87736f11c3fb8aa2e4f0

SHA512
8235515fdb8ae92701b7e2c09ff572006662eb8b9f82fed0294cbc87315969a5038cfd2633bcb720995247f2c3410d30aca29e390929f7e8a8a933d6b7835585

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/allow_restricted_settings.gif

Filesize
2.3MB

MD5
45f29981620e258ef51f68f6c8dd85a2

SHA1
72eecb18f5e700d41fc870199fd4f2e769fad3c3

SHA256
c2f84da138b51cda5ca4e0af40cd90e2f69664d2e27f082cfb4ddc3bbd6f1155

SHA512
053c919d8dde4910e1a3f49e7a13288678eae364afe7ce47890c5690639bc618ec206d07bf558501686a94ed141e91ecc045129dcfa34cbcab95cd7da2d5a918

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/allow_restricted_settings_xiaomi.gif

Filesize
83KB

MD5
8fbcb3fc68adeb2d70ec59e3c8c13cf6

SHA1
d659c6f31f6b80662ac1b6b57f1678a25def8767

SHA256
d3c7a0b0ad264efa0e7456c9e3ee0cb11ab3339d9a117b7841bee46854bf99f0

SHA512
87ec51d7f15b7760ce7dd0dfb3ff1227ceedb1696b9d36419dbf80669a4fe151b3429726b7e2bc327998691c33660e3ab5f7a67f3d0babc57c7dae3c66dd773f

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/app_usage.gif

Filesize
458KB

MD5
d530a125f3f6ad057316b66ad8f7689c

SHA1
ded91ae72a5124f80cbb806e34e902e4f7690585

SHA256
2d76c753f285616f2b4f7c3f9cc11689643ade33e8d47b9bba3d190fd44fd7ec

SHA512
46ddfc038ff9d3abeedc83b3d53315482b259fdc242372452169aabce76c12f899fc6b3ed3904f08055328df5d31f1f2679fdf8e04b62716b013ccab9963f431

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/auto_start.gif

Filesize
432KB

MD5
d319fff17b4b3d37f658a4df7d2e9391

SHA1
4fc3488f35ff2f84f9547cf1493058d412366369

SHA256
8649cb08a83ad7beb3f8fe7431c590525cef21550449a8bf94128c4b3133904b

SHA512
a12c8a6d2df6e3ebd295a977239408ae6ce1146e2586739de4c460f7ca732f872ef25bf6f50f214b852b7f823e88ba1e464dd648c70d4a49e34128381f9c10bb

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/auto_start_oppo.gif

Filesize
2.7MB

MD5
1fcba77be0b33d08001bb6a76c858c4a

SHA1
2e621445cd6cff7d989a90419f153062f4cbc8ba

SHA256
ab4b61b860c6ea3dfade56ac55528aef471d9f17fad4187e2f39df4b173d815d

SHA512
33493666c95274357114400b3fe1469e3445c90a68a409adbaed7016d391fa1c38ce7607d2bf064da1d0895066f4caa469aa8bbfd69f2ac6e0d72b5a52af7b42

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/battery_optimization.jpg

Filesize
34KB

MD5
ba0011889daf8111d9887987afee1bf8

SHA1
c282b6820f8df86bbd46c22b83e226d2da0ace62

SHA256
8c236c95598c1ed6ce3a8bc79d9a4f82b78d28dbecd0a2f66955817bc93873fa

SHA512
ac02592dc9d9af4f8bb91df129fd32bc6e700ca2961dcd8887574da63d490ba733ac67e39b7446509772d49d9a5292364643239d44e2f40b5693cd89d1ea8058

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/device_admin.gif

Filesize
1.7MB

MD5
401209b06747f49e22c5eedfe92145c6

SHA1
52eff15cf75ab39326b16db7d867bea6e25a6f32

SHA256
9527cb317cc1f954831eb53e94e29779b9bc4ea10734ae6a751b0039e7eb6852

SHA512
e3046d78b8d3305ebccaadd24a6752e50ae03e5643a862b4f25efd004022cf96e731e3d0a1d7b78e10ee4a373a32c913ecbdfbcbd15ff2edf1969a2f0c9a7b86

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/dex/wTjwkCEGTpmQIHpNI.zip

Filesize
1.5MB

MD5
eab13ffd8de7380e14a27c938e289819

SHA1
b41d379c41a448c1a250800f635c171476b62df2

SHA256
0081b29f277e67d6f6303e100e482085be98c0769bcb00224b2574797a5dc07e

SHA512
96f6548faa8cb55b3be16ddb5c98d1a295e24ae109f6750855715ca944d57f62ca9a97238a8cdeb3cb1f151b34bf6ea987d70f7e53fed16102148221093a7649

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/display_popup.gif

Filesize
1.5MB

MD5
0c015f108130cbcec3c89371904be70e

SHA1
9b0348a2a1351db4cce88dc086297ac9c0435977

SHA256
09dbee56a6ba5dea1a9677b468e29cbdf4cb7317a5e8ebeded039f67ff3e834c

SHA512
d2736c7cd3c83afcf5ed30a7cdfbfaa17091eb9a8bea464f281ab524a57b0abc2ff6289d54c0ab8ee83cc4fcd33f5e9d5148930c44b81df013d453ffa8bd1511

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/enable_restricted_settings.gif

Filesize
354KB

MD5
cdb95b6410572927d41c94f7e961e9bd

SHA1
a170070450975129cb7867fb573fdbb49a96ef98

SHA256
649397f9d650011c7c0be34dc5e0929829d8f2480828718a31c965dcca57a34d

SHA512
db466e690657f5ff0f27023c0c9f2f837650673373185f5af42a4a0fccebd5e5a28f112441b113afe23d9774ae612a6b82dfec72c5130b8f41b4fd45b42704c0

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/google_verifier.gif

Filesize
779KB

MD5
d3339871102243250cf1b8af2142df59

SHA1
c753a288f72de45a020617a7ebd6c98d94892f32

SHA256
5403976a0b7d11734d359959ab63b2ae3d86cb5dfdab42bd12a2d2bb43549b25

SHA512
c1c0b65e99260bee1fd63cb3206c4ffd9cd38fd33cbd50170f0a1cac0add00c1622d02062f89db2acb2984bc3ae6a36f244732407ff33fcdfb0b4501aef0f529

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/img_0.png

Filesize
4KB

MD5
6d180dd5d0b85d07e8de0ef580d3c3f0

SHA1
80738813df2f692c676c73ef3d0322fe68a67458

SHA256
454b4542d7ac8399ea37ca5fb968101b6c7648921e29193c54878d706951025b

SHA512
6780147783bf91a7dbc2f1327d5e7a5fa4f180d46edb1651d7cac9b9b13a0e36926490779ff69526855fc2c1418bb80492eed1a9c6372bfc117fe0898223159e

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/notification_channel.gif

Filesize
137KB

MD5
1222cade02a614cc0ab42e768ab62cc1

SHA1
562e83e3d019ed7c884438b411c484df586b8abb

SHA256
ec8a6069ba7ed1d3df4bde375e4f62bc8d64be4c0228554c9d5cf99d2ffa956c

SHA512
87a19557980f20aae04fad69ae6f771e0b5e7d9257fd0f455b8f6033b6b93d145cf922819d3a58b030ae250b8b3f9c6130c248acad8ce99955a8441fd13fe490

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/notifications_access.gif

Filesize
675KB

MD5
5c8eb541cab451b1be7a5e92070aeb5d

SHA1
d6ce337ca2e9f41e0cf2e64113d237905a8f5783

SHA256
dd1540c3444205e614f7df44c5cf3f2f3332d953f55e7af3a26c37f987316fb1

SHA512
c879c2824e30b7088899f0ea427c75dbecde44e8c59245bfc318521a29f5797f1ed0b647b5a0b6b52983bee4195bb9dbb0f2947149eaeedc503cbc13c06e40fa

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/overlays.gif

Filesize
1.0MB

MD5
537226ba9d70113cf97290362ac3c32d

SHA1
02d833af459bb73bd96f104cb9ef3e44a95a1649

SHA256
87c494b724a872bea7e1543647e097afaf1ccbc54a7310a3da5c9e5115670456

SHA512
487b99c26cee936865a5b4d10ee1d85dff1faf1994daf9cd7b2e0fa0c7ff39a227bca62e0360113ec43299a9ba77ce2bb9aa7127f3e93aaa43d2075327d12bc3

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/paper_5.jpg

Filesize
13KB

MD5
bebbcf56ccbf574d7d9eb27dafc11835

SHA1
cf86ee9a24de0be5bf07507a8c7bc9f0909395e0

SHA256
36e147263ca768f7e1b364ac6a648bb3cb30f37549b443b46e7379b67aa542da

SHA512
642365aabc16c1cc21233d6e9049740ab38cc68ed2194ac120ad02e34752ec14b736fbaf671b5882e2ccd967229f0f341fb86be178858cb96cfcb3a72d26d885

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/screen_capture.jpg

Filesize
70KB

MD5
8371a31761529ca01d7106387c123a64

SHA1
77adac47a0abbe465b05a155f2b15db1c57b0a97

SHA256
b9366ddaae24722be60e387dbeae87205ca67a569b769959a95c2823f7225a8d

SHA512
d07c779c8bc497b5b4e066a2f319a598c9f7e09585e6fcc406f2beba5dcc7f2faf4f4849607b35f7ca57dada0e7f15175c4102e2a908def04f24407524d0c76a

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/sm_allow_in_background.gif

Filesize
1.5MB

MD5
10dcfb18c93e96967240150509d8c5c2

SHA1
44e9a216f5ffdb0362a23cb4ffe4610c56f351a8

SHA256
1e842ae11e774f3b9605607896ca2aa7f48d4f9db4c8830763793db1ac170a6b

SHA512
b132cbec3e6b73acaa6e907cb5b2b4d5988c73bbe0d75ae3894e5deed3d5aa9e9a49c3d5cff094c6a21264e1934c81d2a0375b9d3713d0a292ba4d6e40e7059f

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/files/wTjwkCEGTpmQIHpNI

Filesize
1.5MB

MD5
2713275d16aadb89fe3a1a63fb414ee6

SHA1
7e1d2587f6032165048d365c4f6d820d8e5e912a

SHA256
141d056fe237d5dc915b31cf01c4e37a297019481c92b62d2e609dd46c517181

SHA512
9bd92076338488b1d036e670e20e49a3d53392e7c780b1086ccb9c5f1785fa7f3527be22e64943a5e51eca76ba8da1ed9768d88fc65b92744438906ffc401fe2

Download Submit
/data/data/com.ffzpmxrz.jnosbrac/logs/Sistema1726139607773.log

Filesize
30KB

MD5
d99979c9361b44f554faea954d707fba

SHA1
c8687de67ed99803d71ff0798a1cc6358860679c

SHA256
96009346d0315c1a619dde450b97489620256c65074cd016e979b931ad2c488c

SHA512
f222c766136094d16bb488cdd2a9b37ccc1a0997214e606a1333d99163b392e97f1404b5ccbe9439261ccae5ef46837430292d49fca5d0346915800bafc87b08

Download Submit
/data/user/0/com.ffzpmxrz.jnosbrac/files/dex/wTjwkCEGTpmQIHpNI.zip

Filesize
3.7MB

MD5
76839b6167a9b557bbf50bd711951278

SHA1
dd6dd5035cb8fc518e1498c904a263bbcaa34633

SHA256
c9046d51bac93a0bf799edb5d140180dd62e2ec2f15e210ad2a1193778bbc68d

SHA512
3a0d0678840bc3d2baf50d58e77810972310ad32682f7a77de8ff9a6cda062be152a382aee3a0bb1539a39bb8b62df43f40a9cbc3f3fc17ab0f548bab0bed9e6

Download Submit
/data/user/0/com.ffzpmxrz.jnosbrac/files/dex/wTjwkCEGTpmQIHpNI.zip

Filesize
3.7MB

MD5
f599fe4417f7a57f9284df2d16397cc5

SHA1
cec2bee748d193df6b9179bc5e198ad0c81e07f4

SHA256
c59c5bc618e03996ad0a72ea5955ae73ee5ac9089cbe6f9e70be9fc54c7f1789

SHA512
c11303441a5b4ab89148435c48f7e67401b8708b28928f0cd243a457653306ec9db363f97e9153000a5db906f5328051a0d3fa0742e85c1627488b61c809ddfd

Download Submit
/storage/emulated/0/Android/.ANDROID.PROFILE.PuvX027hvo7mHfUgIo+k

Filesize
90B

MD5
7cb5509df96698e9a82326ca492bc08e

SHA1
da7d123478678132fd8dd820f89ed40cf97ba6c5

SHA256
b50a635259e94fe0c8752c626ff876fa25822ae411badef98760d9a27d45b82c

SHA512
e4de82b2380a2ddbf2334ef617c68f655c68873e57cfc79161c13547ba1eeab6a8edd36166783d551ad7c8b6e11aa773b2a33e2c61a4ed0a9365ba4efde65da1

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads