Overview

overview

10

Static

static

10

WiFiService.apk

android-15-x64

10

Resubmissions

06/11/2026, 10:57

261106-m2eejayxdt10

06/11/2026, 10:56

261106-m132haaz6110

06/11/2026, 10:56

261106-m1zn3scs5q10

16/04/2024, 02:07

240416-cjzmmseg8510

Analysis

  • user interaction
    yes
  • max time kernel
    122s
  • max time network
    152s
  • platform
    android-15_x64
  • resource
    android-35-x64-arm64-20260325-en
  • resource tags

    arch:arm64arch:x64image:android-35-x64-arm64-20260325-enlocale:en-usos:android-15-x64system
  • submitted
    06/11/2026, 10:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WiFiService.apk
  • Size 3.1MB
  • Sample261106-m2eejayxdt
  • SHA256 5af15a0e1145cb99f3856b6470c2a18b544bd4385cf04703c46f41b26c42a366
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectiondefense_evasiondiscoverytispyimpactinfostealerspywaretrojan

Malware Config

Extracted

Family

  • tispy

C2

  • https://ua.tispy.me/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=35&deviceid=e7115395bdad42cabb75473119853e2a&version=3.2.183_16Apr24&rtype=T

  • https://ua.tispy.me/TiSPY/printIPN.jsp?screen=Signin&model=Pixel+2&osversion=35&deviceid=e7115395bdad42cabb75473119853e2a&version=3.2.183_16Apr24&rtype=T

  • https://ua.tispy.me/TiSPY/printIPN.jsp?screen=AuthFail&model=Pixel+2&osversion=35&deviceid=e7115395bdad42cabb75473119853e2a&version=3.2.183_16Apr24&rtype=T

Signatures

  • Family: TiSpy

    TiSpy is an Android stalkerware.

    trojaninfostealerspywaretispy
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoverydefense_evasion
  • Acquires the wake lock 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 50 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.yupghxfr.eyhporaa
    1⤵
    • Reads the contacts stored on the device.
    • Requests cell location
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:3303

Network

        MITRE ATT&CK Mobile v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        primary.prof.3hbRaw.tmp
        • Path /data/misc/profiles/cur/0/com.yupghxfr.eyhporaa/primary.prof.3hbRaw.tmp
        • Size 196B
        • SHA256 d530551aa4d1bafa6e62c97b0f1bbed5f386460b92d4e86dd3905276c810b8cc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        base.3303.tmp
        • Path /data/user/0/com.yupghxfr.eyhporaa/cache/oat_primary/x86_64/base.3303.tmp
        • Size 16KB
        • SHA256 11ae20a62b171c78ec64d390e64b507de124217f71c40df860fd091b018f3a48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1793962664316.dex
        • Path /data/user/0/com.yupghxfr.eyhporaa/code_cache/1793962664316.dex
        • Size 4KB
        • SHA256 401f68f4448fd6288b7619a7a2ae4646493cd7268f16aa6714802833fbc1197e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        privatesms.db
        • Path /data/user/0/com.yupghxfr.eyhporaa/databases/privatesms.db
        • Size 16KB
        • SHA256 55712cec561047b49b4232cf1d6518b2b5e4189094b4083e244db07f7c807466
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        privatesms.db-journal
        • Path /data/user/0/com.yupghxfr.eyhporaa/databases/privatesms.db-journal
        • Size 512B
        • SHA256 a08cf3c658fbb1310eeeb058fb225ba949849b868fb125fe397ad4dba8504acd
        • MD5 SHA1 SHA512
        Submit Download

        privatesms.db-journal
        • Path /data/user/0/com.yupghxfr.eyhporaa/databases/privatesms.db-journal
        • Size 8KB
        • SHA256 6cc0d599597e9da2ff5ac8e383c3849b54a0230827a7f38fa36301a2e91b386a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        privatesms.db-journal
        • Path /data/user/0/com.yupghxfr.eyhporaa/databases/privatesms.db-journal
        • Size 8KB
        • SHA256 570bd3356568190e601d303e6d1c893c5b516aa494fa0a5530c4e18088bf424e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        475896
        • Path /data/user/0/com.yupghxfr.eyhporaa/files/475896
        • Size 145KB
        • SHA256 1dee12200cdc3b26d0af6be11a8160cc7a305beae199ae7231d193eb63c524a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        475896.so
        • Path /data/user/0/com.yupghxfr.eyhporaa/files/475896.so
        • Size 145KB
        • SHA256 ba8a93243a16ce46b5566f5996d61363ac506cd749ceaee605cb0b2ae5118a12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        475897
        • Path /data/user/0/com.yupghxfr.eyhporaa/files/475897
        • Size 270KB
        • SHA256 572bfb406766d25b1e092913306f4717251b85e05dbfee85fba4792de3d4210b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        475897.so
        • Path /data/user/0/com.yupghxfr.eyhporaa/files/475897.so
        • Size 270KB
        • SHA256 9ae7e452015aa5ac8d1c00a400a34e45d2357945674ac92fca9bd41c5bb44c19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LeSWcaWdSVZAXGztS
        • Path /data/user/0/com.yupghxfr.eyhporaa/files/LeSWcaWdSVZAXGztS
        • Size 1.5MB
        • SHA256 d8f2bbf40bd9f3bfac4fa5bb8d23491fa73bf9ce6b49181017dea6f032aba4f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LeSWcaWdSVZAXGztS.zip
        • Path /data/user/0/com.yupghxfr.eyhporaa/files/dex/LeSWcaWdSVZAXGztS.zip
        • Size 1.5MB
        • SHA256 6c7aac12b0469735dc62db8832f83cf6eb1bab51f810c505a137dd3d1d0bd492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        img_0.png
        • Path /data/user/0/com.yupghxfr.eyhporaa/files/img_0.png
        • Size 4KB
        • SHA256 454b4542d7ac8399ea37ca5fb968101b6c7648921e29193c54878d706951025b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        paper_5.jpg
        • Path /data/user/0/com.yupghxfr.eyhporaa/files/paper_5.jpg
        • Size 13KB
        • SHA256 36e147263ca768f7e1b364ac6a648bb3cb30f37549b443b46e7379b67aa542da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Sistema1793962665211.log
        • Path /data/user/0/com.yupghxfr.eyhporaa/logs/Sistema1793962665211.log
        • Size 85KB
        • SHA256 eff3f12ea4d4434e003b62b4b57799f8e7ed0d3c60f669cf734af8e335f3acab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .ANDROID.PROFILE.PPejeKVpDMQB14HVK1Jc
        • Path /storage/emulated/0/Android/.ANDROID.PROFILE.PPejeKVpDMQB14HVK1Jc
        • Size 130B
        • SHA256 37a1fcfeabb7fc0eb02cdb214f32672f53e60cf43e7c32a1873120f024fc6c94
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .ANDROID.PROFILE.QHb0p6HYdhXxXtBVomXU
        • Path /storage/emulated/0/Android/.ANDROID.PROFILE.QHb0p6HYdhXxXtBVomXU
        • Size 130B
        • SHA256 b73d886ab4501b70d5bd762c64d8075ffab0aa50acdb2ae7ae403027992f6a65
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .ANDROID.PROFILE.sHmrtdH+74aDgJ+RwviY
        • Path /storage/emulated/0/Android/.ANDROID.PROFILE.sHmrtdH+74aDgJ+RwviY
        • Size 130B
        • SHA256 4475d1958242d17a92b59477310c360bc1405c376369f3ec25d653dc21d915e7
        • MD5 SHA1 SHA512 TLSH
        Submit Download