truthspy | 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
17s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
25/11/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample241125-c21yestnav
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access discovery evasion infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy
Truthspy family
truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4496

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 28502896a403e798d10e8de049e0873aea454b8994aff0f791d2b660b08bd2ca
MD5 351c034f022324ced6a7d43855f5540d
SHA1 6b23b760f57a90d42e0cdb325475304e9f40968e
SHA512 d7967a7cbc9216f570bfefbc383cb63c39a795c20245ec924ae2093035f6a7f828e4c0a8b2cac985c153b0da926e3c318a526d172ee9acabb8c10abe997b6d32
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS0:rAMEX0wIyNja0
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 c722a73446b9872161e41b2cc167cd436f4556ac5488f041d98e69a7aa5e922b
MD5 f368c7901ddb8ce0db32e6661c4458f3
SHA1 cc4bde14254c5bb447f8f6896333f8386b46023e
SHA512 b45205eea51a55bb7d28250d6b38acf0a9376e07649cb69cdc2dd784c26c67a3cdce6cad276bf4324df0982754dcf4b0897133da523bc2afc5358a64b551eba7
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c266379424644e5cd80cdb7de86794a5eeaeb260aac0e61f38cdd0e2c8992fbc
MD5 c3c43abb7e7d868451ca8a0adc714644
SHA1 d72538a8aa2b4d8e76fba06858b55dad2bbde9dc
SHA512 16a8dde72b1c755a34591fece7823b633341c670a81983af1b510a475bc104acd689a70622063cf32f78e82bb45da6489b2a5b5e3bd03a92c14199a009830a87
SSDEEP 6:7+/l9TGn1EIXvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKPa:7+tnIvqLiuWdYRmBEyPbl
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 2cf19388ddca08f903bb05f2aa19f64b5045c9595b03247c9e46def2b5aa7932
MD5 69de297571e610c5d15d1c6254203fbc
SHA1 ed08fa9691bbd7c526ba9f91cf4a0d76bfc60e5c
SHA512 eca9a955921021d041d8c3716c67cde495fe48336f98f5d916190a3a6680be583bdabaee166e8a09e2a4fdfe00762769f146924611f19e2879b04f905bd1a031
SSDEEP 6:7+/l9JOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK1SlU/x:7+t7iqLJdeWRmBEyPbjqx
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download