truthspy | 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
18s
max time network
134s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
27/10/2024, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample241027-c6rwbazpgn
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access discovery evasion infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy
Truthspy family
truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4317

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 da327a2cc8967b6e0ac54e7c7aba162c24cb2d4ddbb186126b81a73cf7ce38e0
MD5 19682ca1e9198766817f9f6b7c4426b8
SHA1 6cd9010f88bae05089e7c2c907c2b7879f85a7a7
SHA512 c3c5a912ca02aab8711d24b539f53b9aa36dc3b510b7724cdaf317d3694415788c3d9e7a1178b64e935a0efa8fe8fa28bb987b94ba15c17a5576fed9c02f82ab
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSo/:RMEX0wIyNjao/
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 1d7dd935a5faf19d1d58a91970cc0e795856be850e3cda4e9801974d6e42f402
MD5 1679a36908190507109815f4393bbfef
SHA1 8b8d3e979947b84e949133d50882146b51e7408c
SHA512 dbf8ca13696008d256598234e1b00e075d52f6a0f062d2066482b3125d0395b3bd99ac614948da010cc82fabd4e1fe77c9f0540998c4ed16efce6e418916be64
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 bca7f57009b3ca1ee1607c030af53b2c7f8781de0e86bbe4c371685667bb8c35
MD5 462b5ef0d1e72f482e63319fa26b0dde
SHA1 37729498553955f9e934a820944b9c450e4b50d3
SHA512 73144e56ce59eef5f0e898d83aac5122c1a2c17201ed1e6f6c79609956827b1663ebbeff0f3ff552c096a5f51491f229bf8d38699c71097b9d51f20ab1b185d9
SSDEEP 6:7+/l9oQ4n1AYg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKwRD:7+tBxYqLiuWd7RmBEyPbnD
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 82385f9c47b715f6e9a2b179b2bf98cd31aa445668e0989b322d2e3211dfffe3
MD5 11831248850b32dddb88e1e04bae3b10
SHA1 331522f971d9508956908071484c848f3834cca8
SHA512 127785fb80156d4cd7d78e779f88257fb359c4b9bd0fcb4adf37e639c7fe5cae7ac2d2a510a0b314a326be8a3f016e5faccb785199ab911d4f46434483449505
SSDEEP 6:7+/l9q/8HPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuK9t/C/y:7+t8UvqLJdKBRmBEyPbk/Sy
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download