Resubmissions

06/11/2026, 10:57

261106-m2eejayxdt10

06/11/2026, 10:56

261106-m132haaz6110

06/11/2026, 10:56

261106-m1zn3scs5q10

16/04/2024, 02:07

240416-cjzmmseg8510

General

  • Target
    WiFiService.apk
  • Size 3.1MB
  • Sample261106-m2eejayxdt
  • SHA256 5af15a0e1145cb99f3856b6470c2a18b544bd4385cf04703c46f41b26c42a366
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • tispy

C2
  • https://ua.tispy.me/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=35&deviceid=e7115395bdad42cabb75473119853e2a&version=3.2.183_16Apr24&rtype=T

  • https://ua.tispy.me/TiSPY/printIPN.jsp?screen=Signin&model=Pixel+2&osversion=35&deviceid=e7115395bdad42cabb75473119853e2a&version=3.2.183_16Apr24&rtype=T

  • https://ua.tispy.me/TiSPY/printIPN.jsp?screen=AuthFail&model=Pixel+2&osversion=35&deviceid=e7115395bdad42cabb75473119853e2a&version=3.2.183_16Apr24&rtype=T

Targets

    • Target
      WiFiService.apk
    • Size 3.1MB
    • SHA256 5af15a0e1145cb99f3856b6470c2a18b544bd4385cf04703c46f41b26c42a366
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: TiSpy

      TiSpy is an Android stalkerware.

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the contacts stored on the device.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Acquires the wake lock

    • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

    • Queries information about active data network

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v16

Tasks