Malware Analysis Report

2024-12-06 02:37

Sample ID 241120-cy4vxatkfl
Target 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
Tags
truthspy banker collection credential_access discovery impact persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Threat Level: Known bad

The file 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c was found to be: Known bad.

Malicious Activity Summary

truthspy banker collection credential_access discovery impact persistence

Truthspy family

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Obtains sensitive information copied to the device clipboard

Queries information about active data network

Queries information about the current Wi-Fi connection

Queries the unique device ID (IMEI, MEID, IMSI)

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Requests dangerous framework permissions

Acquires the wake lock

Registers a broadcast receiver at runtime (usually for listening for system events)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-20 02:30

Signatures

Truthspy family

truthspy

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's calendar data. android.permission.READ_CALENDAR N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION N/A N/A
Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM N/A N/A
Allows an app to post notifications. android.permission.POST_NOTIFICATIONS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-20 02:30

Reported

2024-11-20 02:32

Platform

android-x86-arm-20240624-en

Max time kernel

16s

Max time network

131s

Command Line

com.systemservice

Signatures

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.180.10:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
US 104.21.47.58:80 protocol-a100.phoneparental.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp

Files

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 255e5fd8229f08f1e164a2457b1228bb
SHA1 92e336cbc57ade433051b194c43315065f27c454
SHA256 e3152340b9ded168c55a26733fe77d7b149eef0a559f1bc42d3296e99a08f6ad
SHA512 17e13c149446e179b7ba05fcfd4d78f269ebb456ba2a166cc0d6774e0eb19d434b521a1ff879189c3d93185d3a90bbfd3fd622f14ae154a3354fb728f2b6f9ce

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.systemservice/databases/com.google.android.datatransport.events-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.systemservice/databases/com.google.android.datatransport.events-wal

MD5 161b65a25a678d4005851d8de82c4197
SHA1 d77a87fbeb2bc6d6656c86b8e3e93c9a9d71f947
SHA256 8ecab187d36648ee049d6db4ab685e86df145c259a03c2df17c183d772700e88
SHA512 a0791ac748aa009f69b0e3a9dc9ea9b1e33c072e84999c8b7ee4f3addd80161ccae1cce2787fbe5275d505e6ad9d8a83a51a862d9c4c947df2a33d064e774d4f

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/files/PersistedInstallation6957780141682734627tmp

MD5 4591e6e35f0fb1055e58e0324f2ed974
SHA1 159e104a45da620f6328ce7562d079a295a0e9e5
SHA256 ad2aa97ffb37120580e2639d4f0567a362ee3efa25f93e208764841f17fc7b3f
SHA512 86698f5e3c466a9f6fb608e0e2a1dec91f2f0402924114e93c72def11531bb324d882899d804b7050854f3118556cb88ef2dbe252bf1d4d0ae4adae8aef2762f

/data/data/com.systemservice/log/log4j.txt

MD5 caf1c98b0f74758a548d85564bd51632
SHA1 a2b7495fc391125b7c97df2de3c8e3f5f774fccb
SHA256 2a0930cc27f0cd75cf374f5805c97dc63d7b034dd93032c32ef1ecf10da799f5
SHA512 ca1a4c354c987335ff54af841bee0ccd0dce2f89699bd2a9c07009e9d93f91c79642fdde084a7645cbb998f4471dc9aaf10a18bbbb3c24e943c8232add83fecd

/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

MD5 cfaa09a9600f18d030c969e4495cc036
SHA1 b03cd64d5493365bff9185bb40b721d3e8123598
SHA256 5732282a9bbe2c8f35cb0af4aa01b1364f219b7749efc7aede95423b7f232409
SHA512 526100f183c8747a27b119f060d0a2b5d5d11bae84b3c4b5e058fdbfdccdfe22b5759a4233805b9ec358699f10064de36b10f9ca3940a4b9e91dc9d9d4e9c859

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 7237409e0640cfab7bdbd429bf821a3b
SHA1 4c3da934842f8d4835dfe2a9c275a300e5123309
SHA256 5c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512 c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 1ec986f575e2406c8e2b4a88f10c4f09
SHA1 85358ffcf2fb5a626b0e1a8841041ff7edaa9a7d
SHA256 472ed0cbb25404dad442f53a8bcdb339dc4283775e8ae56ecf93b8b797cb3673
SHA512 d6607cced8447f370069394c40fb1fa8369db06c044283ab43ea2b209cd518640a98c8078d110f15612dad49e9c1214d03252967385a2e1c8c03f86de6cf93bb

/data/data/com.systemservice/files/PersistedInstallation2975303002914321782tmp

MD5 340d01d3f21ba4a198286c8a587f7d06
SHA1 3ad5dd08ac8ae63991c94a95c6c4ab6a14e9111f
SHA256 1d4cafc6f9b5c4de8bcd673f38a000cc296d983bcdf0ab806376a948386d616c
SHA512 d41edc6d68dac8c91db038cdd4ed2258e00b5ce10790fbb2b5244bb8c2ae4a208f6e0db350dc2d8f3a71d982e5413cb3cdc739f353f71afb8ac5f66d409c9780

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 25cf45463e961a261d4df047f2685649
SHA1 6c8fd2fc4aab6fa1c8827bc8c545f3580cab7651
SHA256 a8e3411dd4b1ddbfbb013f363d2a75c77dd48d2f563affe9aba092f38267132e
SHA512 df82897cd44a21e1f201a045631f2c5dd4750917126b36b3b16f47f7e4515c39ae4973dda35c45b04a96bd9e3c0661d7d7d5a093293c8a1af0bf15264c4d4f3b

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 426025c850173f2217cbaf8c290e892c
SHA1 6c5e1b03ae43db1bcfb04a34675c46a0cd9b306a
SHA256 e5c003e3433fdcd00a92cd7c599130250c8a30777668bf37b4f6d24ddc6020b0
SHA512 64fa6e5012d231ab4d4fefa2223c6d0bd49b6d9830ca901a19bae0b61048bfdca0fc4c6b38bf609a811b6c1b9336b6c5940fefcd486c154bcbd6d2c3e2a6c338

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 04513eb3639f02756133d588f63ba8ca
SHA1 01a37564c84fa2bfab61b19017535d464a2b54ce
SHA256 6abdfa80a08ccbaed8b5f158c1a67a621d7e00a413df3480e03b8923d25e5eef
SHA512 4e2cac87d9a1c6e5a30bcde386ff075a177238f9d19eb7609bb3b1af6665a913e8b35356724e2a07a1a2274c5695a36ab938404ab45f457e0c1ed4588fac844a

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 b6fe4ba82078a9845671d98fb9d41e83
SHA1 dd4639ec0d9095489bf40c2ffc2354a2231a677c
SHA256 6425e5294fea118fa87d7a3690c69741fe22dfc26fb9558c7cdf43f027e620c7
SHA512 84c8db342dc7b5d189c370285355b0cb4e9ac4cbf03aa6065b26b791d652b848a6e8ebbebb191199485a03aa3e9f8141bec962c9429ee6208e759022433f3717

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 dfd402f574dd5c85f99bda6b8ce79574
SHA1 d445df96ca038289f99acc3c771ac3b9f46486c8
SHA256 fe545dc2b51b35eecc58d602894920246a181a3c95b7a36ddceaac7e27c27e3c
SHA512 e331fbe5297d6a332cedc76ab06d9d87ec1f0830b9363b0ead900e0660acc770db5eaf0e01c66f2f9d2cc3ff6740ab0f8dd151a731fb6cbfdaffe9327eb913bc

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 caa0d9d414ae0410185d0ce6a5ca74dd
SHA1 c6379d64c438620ad1a46a2e0477acad5b9637a6
SHA256 7cc71a693592d78146cc5aa7beb84985e168421b129945e29a192e56fd1915c9
SHA512 8490fd160ea2c9eff7dbaa7b8f24e5808ae6b036f4d211bfeee602c73cf1b92bce0292d9af4e5a3c415562d4a9f5aafaad2112481a8bb62de2adb4d40085428b

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 dd5a6c6f5636351884570933c579a92d
SHA1 2f061ff4465ef4ce117cf804e1b5bff74b7d44c9
SHA256 748293075c01d80b768cbac674a11d5a69d2a7725db4bbff996151b858e2dcc3
SHA512 0407c556b70e2dd0df312b312e306b504eda6296446901b7faf0fbd6eb385a1eecaa1293134f5e3f56f15a5d694470093f087985c7fc913fcd571370fefcd6dc

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 a7c8be1d281852bfa8de433d0beb6d81
SHA1 61ce3b87080d99b474e4ccae31dd16f1f2f812a3
SHA256 148f95afe5405374d07c25760abb3050eda31bd56f957ce036ffbf3cd680d3b4
SHA512 d62e796613779baa30fc9de5c37425dd62e020f960fbe22d197e8d172f6982ede40bfeb26ff9c5a8b76c6b30fa907b24d90e1afff44235c74049b780ffeffacc

/data/data/com.systemservice/databases/google_app_measurement_local.db-wal

MD5 06b8af79263d6793e1b8e0c7c76b451c
SHA1 baeaeae913be9090b6cdbcdf3bbfe7f30697e18f
SHA256 559cd6cbd0ca7dbbc5cbb9e1ff93a39f78b1fa26862e8125c9a292b023353d8d
SHA512 bea6ee44dec0dc94461104cf3dbc6d2bf120f4ea7bce4e9ee253814d91bad788361fdca82d8e9809bddafea6bab7c9fd67190a63dc98a1a4b3549bb5ec4cb1dd

/data/data/com.systemservice/databases/google_app_measurement_local.db

MD5 835cfc7decf507cdc5e54f602e3f9699
SHA1 4a55d424cb32e766554672cb2d0b3804fc47552f
SHA256 29257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA512 2ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-20 02:30

Reported

2024-11-20 02:32

Platform

android-x64-20240624-en

Max time kernel

6s

Max time network

136s

Command Line

com.systemservice

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

com.systemservice

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.213.8:443 ssl.google-analytics.com tcp
GB 142.250.200.34:443 tcp
GB 216.58.212.227:443 tcp
GB 172.217.169.74:443 tcp
GB 216.58.212.227:443 tcp
GB 216.58.212.227:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 protocol-a100.phoneparental.com udp
GB 216.58.212.206:443 android.apis.google.com tcp
US 172.67.144.220:80 protocol-a100.phoneparental.com tcp
GB 216.58.212.206:443 android.apis.google.com tcp
US 1.1.1.1:53 g.tenor.com udp
GB 216.58.204.74:443 g.tenor.com tcp
US 216.239.34.223:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 216.58.204.68:443 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp

Files

/data/data/com.systemservice/databases/core.db

MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 86436d0bb7475ae10fbf409792a8509c
SHA1 9408029a5e2b5bf2321c506583d98f5911ceff34
SHA256 6c17d42fc021968a413663f6da57c004904a0ce3790de0437a44b5c1aa1b44b3
SHA512 e31789fade837f5dcac83d63eeba98f3adaee56251a74d97fdb7cbd7353997ac014857e5f4d6a57b972a238edd73a2636e8ad1d61f2498b9ab81c28b4af71595

/data/data/com.systemservice/databases/com.google.android.datatransport.events

MD5 163b0e3f017becbc89b9d7f330b78f09
SHA1 1ef9cd8ac8655190468d0ccece0a4738634ab0f9
SHA256 cf01452c3b494692386f6c5faac340eb3eb894bd416391002d56645aa8a9ea36
SHA512 6a85a30d16fa58a4fbbb05d469778ee69ca79deaa74316ccb5be3ee07fdf78dde22e95db3edb1b88b18478e8747047445f85baaf9556b9a1e55d9a02a80baffd

/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

MD5 eefeca27a35a0857d50941f508f33965
SHA1 fb35478b1a3f6d0e4fd829b3abb71c2ed8c5f463
SHA256 3b0cc339ca06440d407d598cd3f7241793bace7a81f98284d6635bb7f743a028
SHA512 384f5542621288fe83098f50ef62119862f24ca5e89a82500e26e19d86606d66b981ea6b9c20df3511d4767f05bc655361e8b374980f92e63cca6805f0a899c4