tispy

Sharing

Copy URL

Twitter E-mail

General

Target

1c767d97ac32cd7b61007889f50cce7c4bc2079ba03a79fbfff33da4766132e0
Size

3.4MB
Sample

240701-c2lthaxaqk
MD5

3304aa0bceb15110a017e7fa693cefdd
SHA1

0dcb501897efd47336ed882e2eff2875c52f1dc5
SHA256

1c767d97ac32cd7b61007889f50cce7c4bc2079ba03a79fbfff33da4766132e0
SHA512

e2fc6d8a3c8fcfa5aa734de7cc39e2bf886ea885b31561aeaa2f5b138263bf4164307878cc36010515feeae433677e511fe372de56f5650b85ff822e3ddf3a57
SSDEEP

98304:mCkHQn6NP248QCYsmvMir7JRRqjKn6DeYsNotgi:7l6NOVgZvM07JD1n6Dfdtgi

Score

10^/10

Malware Config

Extracted

Family

tispy

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_01Jul24&rtype=T

Targets

- Target
  
  1c767d97ac32cd7b61007889f50cce7c4bc2079ba03a79fbfff33da4766132e0
- Size
  
  3.4MB
- MD5
  
  3304aa0bceb15110a017e7fa693cefdd
- SHA1
  
  0dcb501897efd47336ed882e2eff2875c52f1dc5
- SHA256
  
  1c767d97ac32cd7b61007889f50cce7c4bc2079ba03a79fbfff33da4766132e0
- SHA512
  
  e2fc6d8a3c8fcfa5aa734de7cc39e2bf886ea885b31561aeaa2f5b138263bf4164307878cc36010515feeae433677e511fe372de56f5650b85ff822e3ddf3a57
- SSDEEP
  
  98304:mCkHQn6NP248QCYsmvMir7JRRqjKn6DeYsNotgi:7l6NOVgZvM07JD1n6Dfdtgi
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- TiSpy payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1