truthspy | 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb

Analysis

max time kernel
17s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
29-09-2024 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb.apk
Size

3.6MB
MD5

d836feab9d4bf3c6cf086bdc14724c8b
SHA1

c837cf7b181679a0081165e5fe4aa0eb94f748f8
SHA256

5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
SHA512

8c7801c5f1d8dfda39e0c65bdbea83feb8f217b41b69a245d01dd9e983a6a357c8b0b2be79123bed07e638655fc66ef3a093cc01be68c696ecfea5ab6c692dad
SSDEEP

98304:5s13ZL3Vf6JqeomaMDmQZ75ub8GoRJ6Odp/9hBbW+te6lXhAyHzwI:eTLVf6JumaMiQVWovl9jS+oS4I

Score

10^/10

truthspy banker collection credential_access discovery evasion infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4628

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.systemservice/databases/com.google.android.datatransport.events

Filesize
56KB

MD5
c9f16cec2634fc6858a365893469fedb

SHA1
024ea5727a0ba7a4c07ef3d8a7e9f12641802f57

SHA256
fa1db4ba1e70b7a911fb7a3aad9384f793eb410c6053fac1452edb8084a1f183

SHA512
56fece793acbc1ef287abb41f61cf508d2ad6cdc013e0801e39b73c8394b648bdf1e7fbf2bede2c013efd917c607926a8ed64c89b978b941c8947f8349aabe2f

Download Submit
/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
f3dda1d33dea1e3dcc6558afd4d0cd9d

SHA1
c52c6240a28b2fa125df25d4c92f64f1570274f1

SHA256
c5f978e63270939d02ec8fde22cd2981ea8cd8489f75697b195da12260707a87

SHA512
c948c2f5f3a73d8143967b921ce3bf113afeb7aa4152940a1b4c615e852f45e03f9d45921190b5ade49ffe852d9c0941d6a5cb7a44f21e146ce565a01fc36c91

Download Submit
/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
6baff4c5524afe972f8f0aa24279e785

SHA1
3bab2e56c8bf01e39b9f4d54a52e0c93fb00ee52

SHA256
5a48da321727e79e4350b66bafacc1819ede5c5110825b2a66ce922009c33802

SHA512
eed83aae6bd20cf9464306d524f0a5ce840f723ebadc2c258090d2988cbf617f26a2b4a7739cef5042824bb0ad6ed1ed068cc2cb44fcf337e42f853282c5d8ef

Download Submit
/data/data/com.systemservice/databases/com.google.android.datatransport.events-journal

Filesize
8KB

MD5
dae44c97c618d30d78db8c0c5b5e1861

SHA1
61fa764817c9e0507940c2ee738eeba570554de2

SHA256
a9bc9ead287ce79d5e0485135ad1a8103133cf4d2369268d154ba0669f8b115d

SHA512
941b8b6f831cd8b8e66497f675a6db06322f88d1a03d2a1a294673cd1ae5411cc0b1819fec2b3f02fbf5a0f505e5f00b4e69055fad067fb770d52deaf811b689

Download Submit
/data/data/com.systemservice/databases/core.db

Filesize
36KB

MD5
045489a0639eee27bca52f48828cd93d

SHA1
436e7966e7c019273c44faa4d8c5709b816dfda3

SHA256
0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e

SHA512
c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db

Filesize
16KB

MD5
d9cf75fdd1c2292d986f6c3d5d60f2c8

SHA1
07ecb1d3a26d952ae5fecf54f36699ab498510b1

SHA256
2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a

SHA512
442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db

Filesize
16KB

MD5
d6fd3c130077208101eb494beb12cb4c

SHA1
3a79e5e2ac75adecd23363565bf1b17f3a1672ca

SHA256
bb1520c45cc971ecaa8b50c877ac055b994fe728c4734db6ce3cc875050ea7cf

SHA512
d6d8d763bb2c4229c001bced19d62b00b80490a020435de60564ad4d7cf8afdc10d51ceb8b741ec8ddf4010c638fe920f0b07e0c57e1aaf0470925f87f94f50d

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db

Filesize
16KB

MD5
aae00ed5b092aa908c64a5b1d14467fb

SHA1
a45d54c135085dc66a3a414b2e94d435d1ac5945

SHA256
22dec723e5e11df76dc0ce9894764b31a27f7f9ad2e58a541231c3c857845517

SHA512
0b8ff39a472a0c66dc7ceee98db1fc02f485101f3361610d1e7d3ec48563329ef0a7297a692f1729b88fee908c23e39b3e88565e55d3f3d55f6cbb28d14d82d7

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db

Filesize
16KB

MD5
875a8cb265f99952936694838d511e17

SHA1
bc00f3e8ab2ba937957cfecde31f4b316ea9abf5

SHA256
d1f8ec2576db4e29938d87e39949c6b2c8062189664239cd904af5f8ac21a8e9

SHA512
10a121a0b81c3cbbcdf510b99d7fbfd6c4b260dc715a6537459f9d0db5ba0bc4309632c40c11cacada10a92bf4edfbbebf80e4885d22745582cee39d5b1ddff4

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db

Filesize
16KB

MD5
6436ddeb3835b564cde2c87aefb650e1

SHA1
f7e46aa4d2d1fd08fa0d90f31c8ac6d19d815591

SHA256
d191e80f3409758c9ceb5ffb62d8b4c85606f642e63fa2bff4b3d3b46151d961

SHA512
18820418412bb316e5a1e7eabcd1b7fefd9e738a03ec3b02f509b5c59b8f25fbfde1fffa24e1283fdf3ca8853877f637b18fdcab74a45a244424f44e4bd60793

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db

Filesize
16KB

MD5
2238195eab25764b61f2d26ef6a720af

SHA1
d366efd0cc079f0f87d23c630ec8d99f90541731

SHA256
599d63ed390f7e8e81d82b379c9a733ffbf454bfa5843bd0c909737c8d40dfef

SHA512
478111185428119bc92f0ffa3b6d88a7c644108c4b1d9b14a53bea1d74278bc78e67752e41d464dd81e3d600de8b7a723d0c7fa0ce920250ffd26977f9fa3470

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
43cf57fa24c2cdcf87ee4a3ce76f6a2d

SHA1
9b16586d903b0abec5e041adc3d12c86df6cad67

SHA256
1d1c9ab52df1ded2b53d07dfdc3302c15999d3ce5929c0d93fc19ba5d80c9f16

SHA512
08c0afac6553d66270e01fb7488097ee5cf53315e2b10c83da5b2e3108806160044ed22b268ee6e4004c017f2794f655eee48d6a7cb391f0b1fd5011aa383681

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
1663c06fad36f3c40500e1be887104a6

SHA1
2d9f1ae166077f6bc0a251ffad552e90e62a765e

SHA256
dc084977e89c0fb2466cab9af45e0338fc7fc3bf032cc9053e4881e94d6f4000

SHA512
a5dcf5824f423506ba7ac86052a58b545748b59654abdaf040059a44b5a7b0d3c44e5a79810581c4ada888ba8d4c1c1fc2ad6fc64a5ea9c06270d60205524c1a

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
6c1e1c8422dce45b904695730b28d8ae

SHA1
9aa889a1b11ad9a18e99afaf2a7330d27a9e28a5

SHA256
6adc14f4d0c888779af5b5561c490662c8ae9177ba0b323f6b79196697ec6854

SHA512
9ee44d4c74c0a769765a859a72ee91fef7d53a1eb3cdb08b9582a7919ce0af0a26b039de2be609f45378b81ee6306e5e722bb017668fc4a88fba147ad9f0e527

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
f33ac721f60a8e2e360e17619ad6a1ac

SHA1
6e9d306a4eeec8878ba0b4c9af799ca17032891a

SHA256
e149b065c09536170f5172ccbc63ce6fc9cdbdd202a8a3d431721b420f4e62c6

SHA512
943e06ba873c6a2cc7b386d46cad793fcf2d4baab85a489901ce13fef53b9a709653efb2f74586f4491b56d4d598ce4bbe9f75e2498d43311a34466fde122d16

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
999e16a9233572ad9f72a6171ffcf478

SHA1
d51257b621d26b143c9f508b884cecedc3d0821e

SHA256
d8b3e4065b8fccd3fc3479dd7918783eecf2baecf190af279d322ad76e68162a

SHA512
3de0da2c6f12ad1d119d6d28d2c7ab8ed9a8650f41c2c679fd2245eaaa43fe61cb678b87c498d9429c01b4ce4a58639c3b7822f3f50ca1fe7359d599f77c841c

Download Submit
/data/data/com.systemservice/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
8fba371ee8439b103d41f8db3de181a3

SHA1
42ed7ab5c46983b278bed0aa2e712dfbec578ed5

SHA256
ac1302aa4e8f4ba38b5253ded6f9316b446fd43c5b29a1aab35d81fca5826f52

SHA512
dfea429f62ef2521873b43105ce6de65ff39ceda635ec04e6ba895eb26d0fcf52af55b039026f2c88f137543dda7753bddaa4b721216ee45d1694fc2897f273d

Download Submit
/data/data/com.systemservice/files/PersistedInstallation3243988459782544673tmp

Filesize
557B

MD5
1c9aedb49e7d728a5302f00d3a611a58

SHA1
12c3c24793a20e42942dd10c8870408cae2b1a92

SHA256
c23dbd7823a2a0298fa9f221a61aa9092b97b9b3635b83b052a4cce2c71b72fe

SHA512
805c0792360f1690d41890187cd6123296b6998ae06388e8edad6cc0369960ede1b2ad93ea74ff8079d4e240a397168b4d0f1efd8b4d2cb1cbb1955b7e5d1751

Download Submit
/data/data/com.systemservice/files/PersistedInstallation3765849679183053720tmp

Filesize
90B

MD5
8406094c09370ea7fd012b6ba8ce6f95

SHA1
20bbd9b40021a0781786ad0e23101512c0657ed4

SHA256
01f525b1abe7fccdb15ebfd76ead6cd1d234e9286352b96233199b89fc7bdd37

SHA512
e7922cec7bdb83f11250f557d00a40844b7a141d7407c9db6c956510425a047590b6004bd0a5ede47b1b39e3d1e07c77c024e556290f4e2480b84a4fb232ff22

Download Submit
/data/data/com.systemservice/log/log4j.txt

Filesize
6KB

MD5
fd743a3c6a996750cf5aa6420c5903ef

SHA1
9f79508551f3622a693d7a21ece2c018f86e29d3

SHA256
199d820ec553d18c45bad8964c5c63256e423c0ea192825805b7483f445cd9ca

SHA512
1f840649bb5b9fe5d2ee587035e07eb47c689a556c0f6eac14041b14df7cf5e0094e5362489e38ba6a754e75aff1a2d30cb900ae083ccdb017ecea23eb388b84

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads