truthspy | 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
18s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
03/12/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample241203-dab1naskel
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access discovery evasion infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy
Truthspy family
truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4328

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 e9ef903d38dc9db4985fd51301847a8f36966d65edc13dc12b00644a64f91ff2
MD5 ff2d80a538661eecce4676839f34315b
SHA1 7f6de23660a92d881af6d9101b7978b53b773789
SHA512 9dce341cc185d9a8ad08e2cdcf2b6687838e7307cfe3e1808ed11cf4a4f46918fe66e774d780d0f098c05126aef24cf76f93deebe663fdddbc488a6f8e3fef44
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSA:RMEX0wIyNjaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 aed599fb08d8f0e1d0f1e2f88ddc96e99ad95b1b906ef140d0241792e8bc2c13
MD5 bb477a1275a2538023b81d33445bd0bd
SHA1 22516df3cf2abd49005718ca5b92f1d9320161f0
SHA512 1845f82f0053fcac9906569521feed66b74bc8d15577926c481a608fb7fb013a90bd5834c93c16c23ba39e1443634f2f347d4a790c05dcbe19ee0acb9cf585b8
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 ea1ed0e1fc61be23add27e51e60b1f2fb27721726c156b2a4e373661d8caaccf
MD5 d58940e3e4eb944d6752e9a49a03dc89
SHA1 b9d62cb018e2d44ed80a204f584fb13a7adb5990
SHA512 f2cf159fb5c74c09278db03b877fdd8865755b9f15cbd394b9726316e475a406a9a9de9bc20e582829329a0fffa5276de6df1345e97601ef9b34d36a327809ee
SSDEEP 6:7+/l97mHn1aokWg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKM:7+tVWqLiuWd7RmBEyPb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 29151c9c042d76712783b42408f82ff5306bd82521411b44563bf62838ff6956
MD5 13a5fe43fa92a902413ee3756b8047b3
SHA1 aa145d4aeecc31c188375c384495f88c527227b3
SHA512 736100259542db2147fe40b1f626415e9f9333e3637d26f2bbea2ceb7bf7946ec0d2a5aed95be64a3705e5bc3ae5e6cc414477d3a84e1ff40ce857266d0b25c4
SSDEEP 6:7+/l9NPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKG/O:7+t3qLJdKBRmBEyPbpO
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download