truthspy | 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb

Analysis

max time kernel
22s
max time network
153s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
09/10/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb.apk
Size 3.6MB
Sample241009-c2eeeszalf
SHA256 5d2ff3a0a3820997a9929df3c53768079a7b4515f28ec4dc87dcf646a543d8fb
MD5 d836feab9d4bf3c6cf086bdc14724c8b
SHA1 c837cf7b181679a0081165e5fe4aa0eb94f748f8
SHA512 8c7801c5f1d8dfda39e0c65bdbea83feb8f217b41b69a245d01dd9e983a6a357c8b0b2be79123bed07e638655fc66ef3a093cc01be68c696ecfea5ab6c692dad
SSDEEP 98304:5s13ZL3Vf6JqeomaMDmQZ75ub8GoRJ6Odp/9hBbW+te6lXhAyHzwI:eTLVf6JumaMiQVWovl9jS+oS4I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access discovery evasion infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4484

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 db2a9f15d13efb5ea4b80dc3b9b29df8922925fc8e5389089cfc5e48e46f7f9a
MD5 8b5979ffc6a42c23977a407245c87efc
SHA1 d649f6eaa66c734952c6cc45a7be903602e6c0f7
SHA512 d592c606590138ed2fd3b18f408a67d73a08e2f91f48d02181df04f4f05df3840ba04a21cb4707c21d03d3998a75b8ab3139b7ced576f3f0bed8738e167051a3
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPS76l:RMEX0wIyNja76l
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 9ee308c8f297a351760562afe889de7b533c5deaf4fb164c37e5ccd5987f7a91
MD5 75a33bc7ec9b34bf3dcde41b11567e10
SHA1 eea222fd59272e9e646360cb0e63ec5529600441
SHA512 05717765609c0cb6bf2512f6e852cb6a3765522f708b5554f0cdfc5afdafb1a7087aab631018994590dc0722efe7acb67170bee3af3af97a7d9190c66ca9a3bc
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 2cf19491ba7782270d60a96433b4c1ad89809b8e2e7763d09a9bc1c7e75c21e4
MD5 9cc1531ed5f896fcdfb0e22a141a8291
SHA1 a8171a845f2a5c99c5778d7ebbe5ef92503a3b05
SHA512 37bd020d2d2ca99e4e12631ae3360b377a51d3394669030b3de2fc6ff56ef914f75f68d76f577e36c4221af5641ad91fd3e854173a333acd8fcfefb95d65f10d
SSDEEP 6:7+/l9bc/gn1Ytng9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKA2:7+t56RqLiuWd7RmBEyPbj2
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 68cec5953b9ba2f04b2e9380a5543e070a1ad8edd2109e28266dcc3d3bf85738
MD5 f14bfd043ed2565b8ba0b7b4d7422473
SHA1 d3ddbef05a662e58a0a7d1b0aa78241e7695cf26
SHA512 e1f3bac0147b56762757023d5262e38b7eecbafa115320c7ab50b9a27e5accb0857538a4940a69e79a292dc7bfd71d8ccdde1c3b35d362b59cbb185eb1fd9e2a
SSDEEP 6:7+/l9OgPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK4xQs//i:7+tTqLJdKBRmBEyPbti
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download