Malware Analysis Report

2024-12-06 02:39

Sample ID 241006-c5c1rsvdjh
Target 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
SHA256 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
Tags
truthspy banker collection credential_access discovery impact persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc

Threat Level: Known bad

The file 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery impact persistence

Truthspy family

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Obtains sensitive information copied to the device clipboard

Acquires the wake lock

Queries information about the current Wi-Fi connection

Queries the unique device ID (IMEI, MEID, IMSI)

Queries information about active data network

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 02:39

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 02:39

Reported

2024-10-06 02:41

Platform

android-x86-arm-20240624-en

Max time kernel

18s

Max time network

131s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 13f73a084050edd22a5fea8e9eefea82
SHA1 52da0c7380642d3917b33511e8eaca20a9317629
SHA256 283907264cd9e6d108f71f69642e28d16b6647987d8817086d55fc2034b7b154
SHA512 9a64bba539104347916321c74b19fcf6a728aa2a281c2d37630d2b3ae666e053cebafdaacbbb9db690eeb7c27bb2344292b923040767ba492a384a6ba87a94d5

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 6ca18be13e35388971485ba97c65a409
SHA1 fb56bcd046d285f99433093b7c01137fae67c9e0
SHA256 14d9b13326126befc577aafa9e3cce15b114f9cfccbc07c9de8352b7afb0b482
SHA512 5318b8ea008b6b6301e2d8e69ccff2d1d6da3d10400a4efc15d8b6c6f574129377e7d7d132e9f9f0da5793a42623eb3b07a1a7fd2c0e384640aded72967a522c

/data/data/com.systemservice/files/PersistedInstallation5630585584490654400tmp

MD5 b765f8714b5c058495b8a53a81c4b9f7
SHA1 3b4a98e15da3a8c104ab5dba3096641477eac59f
SHA256 59940d32baef92c5ba8c3f75beeb86baeea046566e4d0492216dcecc5c087afe
SHA512 24d83027cb24247cddef54cf3472422b7b3536374bc5daa0c204f9518ced82c75a1c83678e977ae3d102cd4febfa5ee2c1b16965e639cfa8a03ba22929a5ef8d

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 c7566ac4846f026cc4a8f1eb3479eafc
SHA1 d544aee021201aca62e2fedf09de6228dc8ee2e1
SHA256 6378a15bae3807c6aa0b10aabbc5294d62a924bcb29f18f0c9639555f355dfd9
SHA512 2529a7d6e79e737b1ce1bce6d5b051e0e3b6c7f12b5a7e3b17e2b76a8285d3850bbc2e0c48ef4497ba752c0a29b7c2ab9c4e85a26e118eaf5056832a4bfc3429

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 b325e2b36d228ec9c0fcce2165f1a799
SHA1 258b91b7cc6276a9bd39176608b6704bfcb6c6dc
SHA256 e8ad21f8040eaded96554a09b19c00a5aa207e11b6f2aa39804e419578c70082
SHA512 92f3a7d9555c995a81f022604a14ed561f4d694e05504af84d52830de6d6e4f611e3b0cadd7599f32763050e6fbad248e4b9a3fa6da105fc45eca610d4eebad9

/data/data/com.systemservice/files/PersistedInstallation1085786851040859228tmp

MD5 01709b72f25932d56e2dd90963a69e07
SHA1 f42851847f53e549691b7b781c9064c56ca9e73d
SHA256 3d4c18dd70349d516e2a2d1b4e0f1d218dec916d4d9f2afe449510da4265f18d
SHA512 8c6febaba806a7f230c3f42b9d0686e612cae0d92a128cbd5a790c70d59cea7f07edc4ae697960960cf179c17c81fc8cad7a559798fdeb7e43a443d6e053c983

/data/data/com.systemservice/log/log4j.txt

MD5 d5fbb326f4dd9cea35d996330c4a30e8
SHA1 13cfc816756778c128b638dfb1e15597284735a5
SHA256 dbe9090fe054412b00a4e2804a073017f627cb7482b303e84fa53572aeb091ba
SHA512 5fa184e2dcc77178215362f40c8971dffc5ade40de97fd20ba8c9861c3b4577add749c5f9d21cd1d1f24cfb9b92b68b7c60c30648d5afdff0fb84f33ffeb5aae

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 cdf14eebd8a36da11c26fb38054a2b21
SHA1 f4d33559313e825a3660afeb7fcd4cdfe75056b9
SHA256 a417f0c72723092b6297edb5e53de1e40c64f1e9bd73fae4774d268de2af842d
SHA512 38dc807bb936ca64b5feac975acb7fb85e6c93b6770ed2cb5d17905de4833da21b1ca71e7dc390fc12e827c84db573ecec584af6914cb00dcd37471fba70c2b5

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7788bc03cff8eb4d7d6298d90929a9ee
SHA1 78b3bb873d65b2d4df722a9e6ebcf97b5ac6731d
SHA256 ee9146f7401aeb8e7006b4eca65059d3d867026be22b140f542b19ac9b898985
SHA512 53cabf0207c765fbf184cb6cf29e394bebad5c3d8ad26fdc43fe5c599cc5c9eb1f004e2ce1ddeb6e70f85e865de10c5f79a3d73cc6fe54f284bd4222b08eddd6

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 0e786a193673018e16b60c0a0694e0ca
SHA1 2c1ad6b2cd70b5663e89a0e5204902af9b5823c0
SHA256 19717f1cc2e5c141aca1f503f0b657d0f76d6db11323396bafd764fd4bd340c3
SHA512 89225d23386e9c6c538ff76b59b20d07f51ceec8afbeda6346601cda40a0321ffd4b3ab446960349dcdfa1a52e2c034a681944a944dfff2154c86cbb951552dd

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 f1ba8ce58047453e872219c0c8035b0f
SHA1 b3647e379126d43c0e64d72757e347efa82eb7e6
SHA256 475424462ca6faaa9dd6679cd6f67b9a6b24971570721305344c94bdc9a3aa8c
SHA512 9d6bd125f527491fa2039ac55a5605a78432afa79b05de077b090ac84f3e0ef90a66b157fff3197789aa177920d3f20fd2c68f9466562df5e6d59c871969f355

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 ecada1412f27221670296d00b4624eec
SHA1 228c6325cea07fb4cd77e9cb9163d9976db1a5f3
SHA256 b827f2996c016e198717f83e931fc8db20017ec5e6353da65989068b9b3a6865
SHA512 10805426c8e02e1fdb4b00307adff15e59ca4fa26983d80ab1479d365985caa0d46fcdc8fdfc51742a84b14340cc10555a5ace90492e55c0af1d29a53edc900d

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 1efce72c9475ac8328707cb17faee024
SHA1 7ac7b116a75cb610a8484f1c1927f23fb9605b44
SHA256 1a59bedd4241711178ca21caea77ec2e291fafe10e849a3ab304486030b414c6
SHA512 a5a1c444ce45fbce223a9400c89fbad09fd666bfc40d57adacfefb7c8da9c07ed8db83ac5efb109f45a33e09fb27f4f7697a881a5e57c6139392153b2d8dfbc4

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 06a8a6e6fd4aa2bf2aefc4f28d72a73e
SHA1 30369b89b2903ec033190ff178d722726c5f92e9
SHA256 2a9808533e1f7abf2017517257b09d999938c006e9f1d60ecd371e2228bef240
SHA512 6b49aeffa0a9b92ffa047abd08693d0bfce725f526b15b51729d5bdcbad59eaa7596b5902c8e345d0db7d6d7a31936c97ddc586b04a835854f1cabb0e716b428

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 ed8d1ebb7f154f5fbeb0ad1578959e2b
SHA1 ac1ed9ceba91f9dd825e47837dae9887e341bd37
SHA256 0dae51ed8823fc3fec6e55d2304c89372af713af9ad81bddbff26aef0d2503bb
SHA512 c76637e05753ad7488d4ea826ddb2b22aebfa232c603c3f95e3e6b1d3405f3b05bff83c64b6010b0a7d5d04050e814242828ee866216bfecbe23dd2a620248c4

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 7623498dc258c204a64bb017ada04f23
SHA1 277fd99cf38b124175de4529d51691669abe88d3
SHA256 99075c4815913f8bf035249053937160f0e14a6b71c040997f0ed608151865a1
SHA512 0d24246c9121ac69178f740777701f3e436a0d1565a43127bb159990f262863c42340b4fbea3f3c8a9954f56af26932f624d8cb4411f5e87e093f4bdbd58d1a2

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-06 02:39

Reported

2024-10-06 02:41

Platform

android-x64-20240624-en

Max time kernel

4s

Max time network

146s

Command Line

com.systemservice

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.178.8:443 ssl.google-analytics.com tcp
GB 142.250.200.34:443 tcp
GB 216.58.212.227:443 tcp
GB 172.217.169.74:443 tcp
GB 216.58.212.227:443 tcp
GB 216.58.212.227:443 tcp
GB 142.250.179.228:443 tcp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.180.14:443 android.apis.google.com tcp
GB 142.250.180.14:443 android.apis.google.com tcp
US 1.1.1.1:53 g.tenor.com udp
GB 216.58.212.234:443 g.tenor.com tcp
GB 216.58.212.202:443 g.tenor.com tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 ab2aa6c16dc29613ffb6f00e5d11ad67
SHA1 afc6fc9b6610f54ecb3ecdc35376ca898a4cdcac
SHA256 6575818a646e142f45685bd9822e7b545574aa0ac26e8dd69bbda55cefbc3df1
SHA512 c022b02e56276c6952c9d4dd52bbad701dfde6541a1c8f4a9b78a2402ee3adc5e773cd402993167d7f16ef336a7f022a0919e76fdea615e3dd9d84a0ee92d8ec

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 163b0e3f017becbc89b9d7f330b78f09
SHA1 1ef9cd8ac8655190468d0ccece0a4738634ab0f9
SHA256 cf01452c3b494692386f6c5faac340eb3eb894bd416391002d56645aa8a9ea36
SHA512 6a85a30d16fa58a4fbbb05d469778ee69ca79deaa74316ccb5be3ee07fdf78dde22e95db3edb1b88b18478e8747047445f85baaf9556b9a1e55d9a02a80baffd

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e