truthspy | 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc

Analysis

max time kernel
18s
max time network
149s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
05/10/2024, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc.apk
Size 3.6MB
Sample241005-cr2f7stgph
SHA256 2c193c9f18db13d13903e0cd15c90ff9c3623d2a0b3b74c4d9e2a173e87cc4dc
MD5 39fa2c58237de702fc3458251f358cab
SHA1 16e4e5003046f5d07a0fb1eff0dad56d9ce53be3
SHA512 023b77900582d0b6629d587f7411ce5153124cd3870b9533cf9afc5304b874e4353d8dabb7adf8a199768992123e707bc6a87ee682463c3bdccecc8a060e7126
SSDEEP 98304:kyHTjmHgJcyw+WoeX89z6Odp/9hBbW+te6lXhAyHmz:k+jmKcyPsXMl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access discovery evasion infostealer persistence spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.systemservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5062

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 6ca08c96ab7589b0a955eb033b4b2bea37e5085c4cb0cfacda352b31d45249ac
MD5 ac629a04584aea495cf5cd2b84744047
SHA1 04f07b46295a881b58f37a6e92aa2bdb415c9ff2
SHA512 43697ebdb460bbb2141d528287aa6682672eb35f7f98636a858bba5761640e29e051e6cf4e6535cb27538a59ea5a09359c6831e82f09df8532552b98d9abd946
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSBi:8MEX0wIyNjaBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 4ebc3a4eab79045d49297d6812bf0159d1eab7226027abb09f7b5b7304a89309
MD5 93d437f2dd991630ec65382c88e1b40c
SHA1 c5ac41760226155e27f79be66e91c1c50614c9c2
SHA512 c3eca80c1f9c89c31d036b66d5c0790a328b3c464d3fa05f59751a25e84f04fa4ad3c1af8332d42737e1fb2b38a6977a840fd8a008047f81c82dc1c25ec88c96
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 3e1ca991c2b2241e6d77dcba4ceba0a0255f3b572efb46d4d4148cf31d024879
MD5 c6d84e8a4d57007bd759524410cfbd16
SHA1 eecee3cf845ce87b4b58acc055606a8699c8c2e6
SHA512 eb2377f3319a2d2fd030dcd7484bc49318aa3314695550b02a10c091cc35fdc5d4b624b85aa11abe98cecb6bed568deec685d6b8bff13eb5e0bfa2f72608edd3
SSDEEP 6:7+/l9Jecn1Izg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK/:7+tazqLiuWdwRmBEyPbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 f1792bb250e4ef8b3b4a5074c6e4f8b1bf9ec1fe1d558cde63944903041b9a71
MD5 b8da4cb81852ea1a6ab6dcb5f96e7ae9
SHA1 375cef9448be283f72ce4753f81a90e29d272c9f
SHA512 dfb96e914b77463cc60f21fb7fa5f0a1db8a77c926e5686466f70b537822a4270aed8c98829cadef9045db237c74462155d707c312ea78d32f747a61d65384a2
SSDEEP 6:7+/l9Fw/gPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKQYs//Cn:7+tw/4qLJdTRmBEyPbXYsCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download