Overview

overview

10

Static

static

10

Clash royale.apk

android-9-x86

10

Clash royale.apk

android-11-x64

10

Resubmissions

03/05/2024, 17:30

240503-v3bn2aeg5810

03/05/2024, 15:32

240503-syk1ssdb3710

29/04/2024, 16:36

240429-t4ld7aff4v10

20/02/2024, 15:07

240220-shaj5aah266

Sharing

Copy URL Twitter E-mail

General

  • Target
    Clash royale.apk
  • Size 3.2MB
  • Sample240429-t4ld7aff4v
  • SHA256 eeac062c8c9149a6739371238b857f18fb8a61c146443a972d1eb201d504216c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
truthspyandroidbankerdiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

  • truthspy

C2

  • http://protocol-a.thetruthspy.com/protocols/get_synx_now.aspx

  • http://protocol-a.thetruthspy.com/protocols/getsetting.aspx

  • https://thetruth-db94a-default-rtdb.firebaseio.com

  • https://thetruth-db94a.firebaseio.com

Extracted

Family

  • truthspy

C2

  • http://protocol-a748.thetruthspy.com/protocols

Targets

    • Target
      Clash royale.apk
    • Size 3.2MB
    • SHA256 eeac062c8c9149a6739371238b857f18fb8a61c146443a972d1eb201d504216c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    truthspybankerdiscoveryevasioninfostealerpersistencespywaretrojan

    • Truthspy

      Truthspy is an Android stalkerware.

      trojaninfostealerspywaretruthspy

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      bankerdiscovery

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

      evasiondiscovery

    • Registers a broadcast receiver at runtime (usually for listening for system events)

      persistence

    • Acquires the wake lock

    • Checks the presence of a debugger

      evasion
    behavioral1behavioral2

MITRE ATT&CK Mobile v15

Tasks