truthspy | eeac062c8c9149a6739371238b857f18fb8a61c146443a972d1eb201d504216c | Triage

Sharing

General

Target

eeac062c8c9149a6739371238b857f18fb8a61c146443a972d1eb201d504216c.apk
Size

3.2MB
Sample

240621-l72lkswapc
MD5

f2b9ffb8bb4684754a7e1eb02f1added
SHA1

b3d4a329b035a97c21f09698eb20e3db732aed82
SHA256

eeac062c8c9149a6739371238b857f18fb8a61c146443a972d1eb201d504216c
SHA512

37ca4bedd0054ab5233b441861e9c30f128238e75849ef744195d92e5c0a8f5da6db633c95b05397a978d0f7bdb31be4c2cfbf696687a3e968dc5cef17043345
SSDEEP

98304:F1yqxOabNLn7Rk3H0bbamJL4F/E+roUWwvlL1K:zLwyNLVcCJk6+rotsl4

Score

10^/10

truthspy android banker discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

truthspy

C2

http://protocol-a.thetruthspy.com/protocols/get_synx_now.aspx

http://protocol-a.thetruthspy.com/protocols/getsetting.aspx

https://thetruth-db94a-default-rtdb.firebaseio.com

https://thetruth-db94a.firebaseio.com

Extracted

Family

truthspy

C2

http://protocol-a748.thetruthspy.com/protocols

Targets

- Target
  
  eeac062c8c9149a6739371238b857f18fb8a61c146443a972d1eb201d504216c.apk
- Size
  
  3.2MB
- MD5
  
  f2b9ffb8bb4684754a7e1eb02f1added
- SHA1
  
  b3d4a329b035a97c21f09698eb20e3db732aed82
- SHA256
  
  eeac062c8c9149a6739371238b857f18fb8a61c146443a972d1eb201d504216c
- SHA512
  
  37ca4bedd0054ab5233b441861e9c30f128238e75849ef744195d92e5c0a8f5da6db633c95b05397a978d0f7bdb31be4c2cfbf696687a3e968dc5cef17043345
- SSDEEP
  
  98304:F1yqxOabNLn7Rk3H0bbamJL4F/E+roUWwvlL1K:zLwyNLVcCJk6+rotsl4
Score

10^/10

truthspy banker discovery evasion infostealer persistence spyware trojan
- Truthspy
  Truthspy is an Android stalkerware.
  trojan infostealer spyware truthspy
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Checks the presence of a debugger
  evasion
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Software Discovery

Security Software Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

truthspybankerdiscoveryevasioninfostealerpersistencespywaretrojan

behavioral2

truthspybankerdiscoveryevasioninfostealerspywaretrojan