tispy

Sharing

Copy URL

Twitter E-mail

General

Target

72ccbc356c84971e0d56d582f74ae8771bd6a9496eb39bbd9b4e0a9eef6b09e9.apk
Size

3.4MB
Sample

240705-btx15a1fnb
MD5

4aebbd6365a4bef8513ff49baa114b25
SHA1

ebebf178021d817f2dfffcebdcac2b8eba4d645d
SHA256

72ccbc356c84971e0d56d582f74ae8771bd6a9496eb39bbd9b4e0a9eef6b09e9
SHA512

9fb25ac486de89f40a0cdc6aa14e4d420c314dc0c31eca2a9dcb30688790cbac3a64e8d71cffccbab925fbb3e0365d865bce7c5aaec946e2aa443a6675b535ac
SSDEEP

98304:j0CoknKl3PeHIuWu60XAozEYz3/rO540g+NVo36u:gyKpWHljxQozEwq540RVs6u

Score

10^/10

Malware Config

Extracted

Family

tispy

https://auth.familysafty.com/TiSPY/printIPN.jsp?screen=IntroScreen&model=Pixel+2&osversion=28&deviceid=358240051014041&version=3.2.183_04Jul24&rtype=T

Targets

- Target
  
  72ccbc356c84971e0d56d582f74ae8771bd6a9496eb39bbd9b4e0a9eef6b09e9.apk
- Size
  
  3.4MB
- MD5
  
  4aebbd6365a4bef8513ff49baa114b25
- SHA1
  
  ebebf178021d817f2dfffcebdcac2b8eba4d645d
- SHA256
  
  72ccbc356c84971e0d56d582f74ae8771bd6a9496eb39bbd9b4e0a9eef6b09e9
- SHA512
  
  9fb25ac486de89f40a0cdc6aa14e4d420c314dc0c31eca2a9dcb30688790cbac3a64e8d71cffccbab925fbb3e0365d865bce7c5aaec946e2aa443a6675b535ac
- SSDEEP
  
  98304:j0CoknKl3PeHIuWu60XAozEYz3/rO540g+NVo36u:gyKpWHljxQozEwq540RVs6u
Score

10^/10

tispy collection discovery evasion infostealer persistence spyware trojan
- TiSpy
  TiSpy is an Android stalkerware.
  trojan infostealer spyware tispy
- TiSpy payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
behavioral1