Overview

overview

10

Static

static

10

1777a2ba85...b0.apk

android-13-x64

10

Resubmissions

27/02/2025, 17:35

250227-v6hlravmy710

14/01/2025, 09:09

250114-k4szlatnbz

14/01/2025, 05:44

250114-gfjt8szrbn10

14/01/2025, 05:43

250114-ge4g9aykgt10

14/01/2025, 05:39

250114-gctj9szqep10

14/01/2025, 05:35

250114-f993vazqak10

14/01/2025, 05:34

250114-f9l11szpgq10

14/01/2025, 05:31

250114-f76yeayjcw10

14/01/2025, 05:30

250114-f68evayjas10

14/01/2025, 05:29

250114-f6m4xazpcq10

Sharing

Copy URL Twitter E-mail

General

  • Target
    virusX.zip
  • Size 32.5MB
  • Sample250114-ftstmaxpby
  • SHA256 51baf4bc48db631e887ded88c0beb05b7a2f6f26ad2d122ee7c6cca6678752f5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
slockertispywipelockandroidcollectiondiscoveryevasioninfostealerspywaretrojan

Malware Config

Extracted

Family

  • tispy

C2

  • https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=33&deviceid=43d7b21d2c03444daac9236d60bb1356&version=3.2.183_22Jun24&rtype=T

  • https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=Signin&model=Pixel+2&osversion=33&deviceid=43d7b21d2c03444daac9236d60bb1356&version=3.2.183_22Jun24&rtype=T

Targets

    • Target
      1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0.apk
    • Size 3.2MB
    • SHA256 1777a2ba85f831e41c6a60418f84205c9de9c66402f9b7e5be13d29c543a42b0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    tispycollectiondiscoveryevasioninfostealerspywaretrojan

    • TiSpy

      TiSpy is an Android stalkerware.

      trojaninfostealerspywaretispy

    • TiSpy payload

    • Tispy family

      tispy

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Queries the phone number (MSISDN for GSM devices)

      discovery

    • Reads the contacts stored on the device.

      collection

    • Requests cell location

      Uses Android APIs to to get current cell location.

      collectiondiscoveryevasion

    • Acquires the wake lock

    • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Reads information about phone network operator.

      discovery
    behavioral1

MITRE ATT&CK Mobile v15

Tasks