Extracted

• • Target
    jaffacakes118_base.apk
  • Size 2.9MB
  • SHA256 7303761333f194d788b03943404c409e4a6c167e5c633055ba9bdefb6c3f730b
  • MD5 58d8fdd7e2e102b2c7b5429b2075de61
  • SHA1 87f34c4477c290f9742e14f02e75a034afd07c5c
  • SHA512 1870f00da32d2b7f4db69af6d5b2e682ae9bbcd0fc6cb4d0c29a57a3ae40910842ab1da422b2b6407131f65cdc51c595bac0f25ceb4b54ceef7d571389dce0aa
  • SSDEEP 49152:fRtk4PA1LWb5aCcMtmxVXqLjlEMVx47gqEqmC2ViKWoqiA6K6SJrj4L:fRt3PA1L4a3MtWV6Ljase79FmCgiKhqO
  • TLSH
    T1F6E51233FA66994AC5B5CF7116346636100E8C34834F635B785DBBBE27BF9E80E84684
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryevasiontispyinfostealerpersistencespywaretrojan

  • Family: TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Queries information about the current nearby Wi-Fi networks

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Requests cell location

    Uses Android APIs to to get current cell location.

    collectiondiscoverydefense_evasion

  • Acquires the wake lock

  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

  • Queries information about active data network

    discovery

  • Queries information about the current Wi-Fi connection

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery

  • Queries the mobile country code (MCC)

    discovery
  behavioral1