General

  • Target
    BASTIÁN HEIN MALWARE SAMPLES.zip
  • Size 21.1MB
  • Sample260323-a45chscw4k
  • SHA256 940b85d634195d3c1c506da22b2ba3dc98db5df82ba4048b523030f1bfd946bd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • truthspy

C2
  • http://protocol-a.thetruthspy.com/protocols/get_synx_now.aspx

  • http://protocol-a.thetruthspy.com/protocols/getsetting.aspx

  • https://thetruth-db94a-default-rtdb.firebaseio.com

  • https://thetruth-db94a.firebaseio.com

Signatures

  • SLocker payload 4 IoCs
  • Slocker family
  • Truthspy family
  • Declares broadcast receivers with permission to handle system events 1 IoCs
  • Requests dangerous framework permissions 2 IoCs
  • Codesign digest Mismatch 3 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 12 IoCs

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers 14 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • BASTIÁN HEIN MALWARE SAMPLES.zip
    .zip 21.1MB
  • - Память Вирус.apk
    .apk 618KB
  • 1_1176770182396248092.apk
    .apk 488KB
  • 2_5267499572879431632.apk
    .apk 2.6MB
  • Dilshod.apk
    .apk 2.8MB
  • Telegram Sirlari.apk
    .apk 310KB
  • Zarina Nizomidinova.apk
    .apk 3.4MB
  • gen_signed.apk
    .apk 184KB
  • Андроид Краш.apk
    .apk 1.6MB
  • Блокирует и просит пароль вирус.apk
    .apk 182KB
  • Заморозка и фотка лайка.apk
    .apk 478KB
  • Телефон_удалится_ядро_через_24часа.apk
    .apk 5.0MB
  • заморозка и одна картинка.apk
    .apk 573KB
  • سکس ایرانی.apk
    .apk 3.0MB
  • فیلم سکس لانا رودز.apk
    .apk 2.1MB

BASTIÁN HEIN MALWARE SAMPLES.zip

  • SHA256 940b85d634195d3c1c506da22b2ba3dc98db5df82ba4048b523030f1bfd946bd
  • MD5 SHA1 SHA512 SSDEEP TLSH