General
- Target WiFiService.apk
- Size 3.1MB
- Sample261106-m2eejayxdt
- SHA256 5af15a0e1145cb99f3856b6470c2a18b544bd4385cf04703c46f41b26c42a366
- MD5 b061e656a6d4f38a4c96463347e55bb2
- SHA1 2d0726873d11a4ea84664023fe60ab747d13d369
- SHA512 d4f2fa0fca5e62c659b05085d28d616548915c4055a9db22c23d4e8e6f125de2f515907c7826b3d248e142f0f7bc9da7fee628090c443ba26f40537a255b291f
- SSDEEP 49152:0HENhUnA4WPk66xt/gMAJekfLeA7cJU40JnF4yoxUjR4Gitae2ewpDjAjVY:0HENSnNWPkdleNeA7cJur4DWKueRoP+Y
- TLSH T19BE51203E962946BE4FAC3762A6126BD21761C140783A329381C37FF667F9EE4F855C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
WiFiService.apk
Resource
android-35-x64-arm64-20260325-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
tispy
C2
-
https://ua.tispy.me/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=35&deviceid=e7115395bdad42cabb75473119853e2a&version=3.2.183_16Apr24&rtype=T
-
https://ua.tispy.me/TiSPY/printIPN.jsp?screen=Signin&model=Pixel+2&osversion=35&deviceid=e7115395bdad42cabb75473119853e2a&version=3.2.183_16Apr24&rtype=T
-
https://ua.tispy.me/TiSPY/printIPN.jsp?screen=AuthFail&model=Pixel+2&osversion=35&deviceid=e7115395bdad42cabb75473119853e2a&version=3.2.183_16Apr24&rtype=T
Targets
-
- Target WiFiService.apk
- Size 3.1MB
- SHA256 5af15a0e1145cb99f3856b6470c2a18b544bd4385cf04703c46f41b26c42a366
- MD5 b061e656a6d4f38a4c96463347e55bb2
- SHA1 2d0726873d11a4ea84664023fe60ab747d13d369
- SHA512 d4f2fa0fca5e62c659b05085d28d616548915c4055a9db22c23d4e8e6f125de2f515907c7826b3d248e142f0f7bc9da7fee628090c443ba26f40537a255b291f
- SSDEEP 49152:0HENhUnA4WPk66xt/gMAJekfLeA7cJU40JnF4yoxUjR4Gitae2ewpDjAjVY:0HENSnNWPkdleNeA7cJur4DWKueRoP+Y
- TLSH T19BE51203E962946BE4FAC3762A6126BD21761C140783A329381C37FF667F9EE4F855C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Queries the phone number (MSISDN for GSM devices)
Reads the contacts stored on the device.
Requests cell location
Uses Android APIs to to get current cell location.
Acquires the wake lock
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
Queries information about active data network
Queries the mobile country code (MCC)
Reads information about phone network operator.