Malware Analysis Report

2024-12-06 02:38

Sample ID 240921-cn5dpazhpn
Target 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
SHA256 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
Tags
truthspy banker collection credential_access discovery impact persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb

Threat Level: Known bad

The file 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery impact persistence

Truthspy family

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Acquires the wake lock

Requests dangerous framework permissions

Queries the unique device ID (IMEI, MEID, IMSI)

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Queries information about active data network

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-21 02:14

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-21 02:14

Reported

2024-09-21 02:16

Platform

android-x86-arm-20240624-en

Max time kernel

17s

Max time network

104s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
GB 142.250.180.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.201.110:443 android.apis.google.com tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 79cc51902bd5880a8df632308d4744a7
SHA1 3f33e181315a8e53a2de463b4f28ff9adc0c2365
SHA256 1cd0b9db112a9c08c8a4a14dff38063de538cc8de674214fac88ff153b0a2398
SHA512 02129bc471935065f4313f9ea8d4aabb53fa475b64e5eeb8cc45101c64f5e67ff63eaba582531d511de15c7316049e7c21f1cb7b1143c212a217da1665198e9f

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 b7847ff6a39105c88bec63076fac534a
SHA1 ece8ca5f876bcc53f45c6fe755c3d3f2c19eb56c
SHA256 0aa6ed863d5693677c9d4004050842396597a9a8182cda692702bac9128bb839
SHA512 e6c4c736b1a087e6c5ae45c11a97c595364f04d021a4a460930bd67f72419fdca20316ea19b32ecf3e26a8c822e96686738540462acd214dc400a82304f4ce00

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/files/PersistedInstallation251486300154820144tmp

MD5 85bcdf981cddec8a05340abc0ce9942a
SHA1 21a575097ea0c24543ef7bc334dbb265f0577f5e
SHA256 b043b5e7d73f374056daec26d917cf3bc3660d960e2101a8c23c7ed7033b1c7b
SHA512 f5139922b90547628746905b54cbcb7c769bfba91914c0832dce33ca2029b2e1ff2c3168de9e214f2df0e1f21b717eac97f7c3a32cba1e981f5a06998a44ada9

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 b5b5fb649216db1557a1a7eb6dd8efa0
SHA1 4475fef18b7c0ed9a4eed3d0d03fc43cf05cb2ec
SHA256 757d66673e3752f09b99a8f2f4244a2754830327665378cbb819bfd5b0e50fca
SHA512 be16a0f6b7bff38b8858432614de685fc4c2e0b1309aeb96e291e1eaf21449a38fe7380bf811cdad0aa70362a621b6756958c63824c713860fac2a4f61fd176a

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 cb2ea26dba8f1b24be7f41db9f54b8a7
SHA1 d6a656c3271dd2bd68804214bbd897b8312070e7
SHA256 d31b740cad1d9fea6711b409b5b60316323360429725ff99356eb4a028519307
SHA512 001fe232cda6d1eed644fd66062da87fb5234b0f94e31b99a2127310c1fc6109ebb5aa301939eb3bcd8073c9cde6efa99c48dc701d58da0e37c5463d998ecb28

/data/data/com.systemservice/log/log4j.txt

MD5 045bb23defbbb8e10f71c80b712408b7
SHA1 80c6251faf11d1abfc486a753396b750d05bc8b3
SHA256 2ce1e6eaab796cf6788c4c493e6dc976791e69c13199a6c05c55bcebed6af24e
SHA512 4a8b428ac57897f3471edab5e0c792b628409dd041ee2dafd68f2c7148b1378aa6e5ab287bc1adf0907a6099a13275227ba9ace71bdde9c7c42ef8186e36f39d

/data/data/com.systemservice/files/PersistedInstallation1143622491890343399tmp

MD5 97b64278eabc9a1f81b5126212dd0792
SHA1 4ca915704cfb36c5d7d80c07aad663787c658a30
SHA256 f9d6e6367193e6c97c6040c0c03b0bf1eaafe1c25c04b73cdd8f5d2f13ce40e0
SHA512 4d516e0d6905302eb6eae35d5ad8e33dcd3107d3f170518be4b215a1b92c935c903b07ce72ee10949e76f6d2b63afd85e8ae857e04114173b266c952165f3567

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 e3e69fdb5b56f2886a6abb410158b080
SHA1 7e85933636302bea0895352e2a212da2201d109c
SHA256 41542b1a334b1959289b3a6e22560957b55e57c668ec1877b41d3b4bb5a7a6ed
SHA512 732e3b3fce2c63c44e6852dbe7f6a3f7d032a274069394e43626186e280ecb9a20e3c527a75af58410465a17bdf16c47ef10191143e9754845315c7787c88cf3

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 184812760eaec8146e6fefc87b902880
SHA1 039715707291352ae2458003257afa466f1b4a7c
SHA256 c46ecd81493522531d2f8a2172f31bf9150ad294f95a19b62ebc9f16a19d95e3
SHA512 3da0a440bc61ee5e71de47f5dccca4dcfa96cda9de9f0d4f05093ae6c73b52fc0e5e1309ad4c412d85c145b20260908beddf644321ed999bce828c5b31a35a4b

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 df382a3090cf733b570ac29e8013fec1
SHA1 2a219a8a78f6224d7a4e2aa0bd30dd09f43c2caf
SHA256 ec8c6ef3c5a9cb1a26bd87741c9e07fc995e2df73ba62634e3ff03e51a69d9ba
SHA512 63f863c04ba6663b44ed9a547e6887a084b4392b1a60c93f410b8fcd87d0f871cc9c9d5fe5554702bea238643eab3efc7dd7703f28b3bb156b90f93569844f68

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 4d5d4a855b677a07022e2af370808ba2
SHA1 1b083d2ad18d884a8d62af236e6be396a511e454
SHA256 ebccf67b7c30ca74d8e37fde409c1512e248ac4c79e9873be1f1244cbcc1eaae
SHA512 0644e78ae6d16323bf37306f5dec2c56e11254acfff5e20b23d54d84d8915dcb3500e37af4ea0afc2160f5a90c232d8159c7294b80e4cd1e9c0b7563da506861

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 c086a729754b8b02cc2ab833437d69c6
SHA1 d43af38ce1d32da97e4921bde7c9bc88cf7a8de3
SHA256 bb1934fffd86d2d3881adc9a1de672c1c80eb375de1bc0ec01576dda9aeec778
SHA512 17ce247294d82a4e2d5e59d776c044efe08c5e5ec3811a26cf6f8eb58bb4a7f1b8c7a32a1f7d97b09c64d91ce865baac55ced889e25202ca48283750ea90b9a4

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 d8c45bab7c82fabaf0754fa378a64db6
SHA1 6bdab0b65883081f826b5e1b9c8889693e4159fd
SHA256 4823f1fc61bfab75c8da21a4f37646832e5d78253af4a39d98cd5caea051649d
SHA512 0094fa45d9b14c8815aa20079c34d5f0e5745f2ac6153740967fb60f2a2f2b807b2e5aaaefbb42050d2b97859755ceecb34ccd5fc6391b20db246e9e9a83c75a

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 d381e810c3317813071ad3e3bc96a855
SHA1 3cbcdb8e2ef164a18ea14a53e64dd8f666e05d54
SHA256 75204228640715193507955b0e270ea594cdd5ca2a597f033e23b7204f8d3e6a
SHA512 b05b118c72c744c8eca40a41ebb17dbf6ac1f100e714ca2a3fbb46b7f52b96cdd19e5bb75a03ebbbcc328246914b1521a1ba3fc09ed63b1b9b708779541d37de

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 44e0292691e81b468f9cc82281d7e322
SHA1 366f264494314bb459e0ba232f7cfe165c515afe
SHA256 9cd84332b2158178fc8c18a0347baff6269a440d2ad536679f358217052da08e
SHA512 777e3fca68cac2f264e8f85c0fc0a4bb237bf42c5238bca02ef026611137863676067c2e51bf1afc9bedfa2def7c185472f7038a1d89891ad47c0f261591adde

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 eb77299b82aa71fd94573ec4eaa6faed
SHA1 d40b5ee3ec55568a66bcafd7ff6434ce194b94f3
SHA256 1ce2a5dcd2d809fe9f9b346418a39c5ac39c2870ed0b200cd198deacfe6bdb35
SHA512 a909a3944f2cc6dac788456ac751da67a5acf148cedea7fbba11e942f85ac0209a03b443913e18d5e6244941777ba4534b427cab6ede502f9acec48e36c34e38

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-21 02:14

Reported

2024-09-21 02:17

Platform

android-x64-20240624-en

Max time kernel

3s

Max time network

138s

Command Line

com.systemservice

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.232:443 ssl.google-analytics.com tcp
GB 142.250.200.34:443 tcp
GB 216.58.204.78:443 tcp
GB 216.58.212.227:443 tcp
GB 216.58.212.227:443 tcp
GB 216.58.212.227:443 tcp
GB 142.250.179.228:443 tcp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 g.tenor.com udp
GB 216.58.212.202:443 g.tenor.com tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.200.4:443 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
US 216.239.34.223:443 tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 bd5d185141ab23b4b8a17e6a17a6961f
SHA1 ae2e23c3055b768a80cbde3cc7a18fb54c9d1dd8
SHA256 b9f3711ebad0824619fa5d7693c3e462af2aa3233991fcb823a85d7f68e55658
SHA512 f6423f6176aec04b954d8b81f42e49b540253f1a0ae45bf38ad3351fcc2be849bc907c6f4b1d9be12f86f996b0a0ebd1d7c3e938e297dd8fbdc88a02f17079ed

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 ea628e04765adaf4238a5dcdff4bbd51
SHA1 a801947619ea8c368efe9c006a324dc6339ac60b
SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
SHA512 c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 22ff2cc8fdf9dca6b460c54e1bf935a5
SHA1 8f6802e2d7828de63a91698a25ef1c47199f57db
SHA256 7f2159fccebd061f9fc35138eb07de0aba851eec1f24c4a39d167cdbe7db1a5e
SHA512 3efb26f595feda3e245eef0fc6ba54d507e46104a924d33bc479d77f2afc8af35a1d11765994bd28fc5e9e1f4028b8ca451f0d95e50a05cf592f315674e3c07e

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e