Analysis
-
max time kernel
17s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
04/12/2024, 02:54
Behavioral task
behavioral1
Sample
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Resource
android-x86-arm-20240624-en
General
-
Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
-
Size
3.6MB
-
MD5
0366ae0abf0ada8aed90322bfe07dfd5
-
SHA1
2f0779ce64f02944e87674745cb446c5bc620607
-
SHA256
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
-
SHA512
52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
-
SSDEEP
98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
Malware Config
Extracted
truthspy
http://protocol-a100.phoneparental.com/protocols
Signatures
-
Truthspy
Truthspy is an Android stalkerware.
-
Truthspy family
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.systemservice -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.systemservice -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.systemservice -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.systemservice -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.systemservice -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.systemservice
Processes
-
com.systemservice1⤵
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4256
Network
MITRE ATT&CK Mobile v15
Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD542608d4f3b5d94f4f7d2d922c255d203
SHA11522728232af2c6e0f7b5325315ad0aebc11fef2
SHA2562d20b21901255cb00f3cddf6df68e367b34a35a7c1c14f6563faebd9bd1aab37
SHA5122de0ef92dbc9012983fb1c3967005228e5abee9d00f6c6e086b92d53fe8a6a0bd2f02815b23c4976611f4d5d2283534241bdf1fc54d75fa1f8534d7637248cf4
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
68KB
MD57d2f8929161f0f88b7147e56b7d31c37
SHA180babbc9cb71348912b0f991a4a1103636a7d64d
SHA256e5d4a9b61fc5ebb839c787e20c1da3d33985cd4c592ad34cab5157dc62c9caf7
SHA51277415bc69ada09ad8da5fde03aec6f73cb920f8456158b2c068c5e2dd9b36f52ade07a962830caa27ee29bd94494d7a5158085a4337db3e0d35772260d82820f
-
Filesize
36KB
MD5045489a0639eee27bca52f48828cd93d
SHA1436e7966e7c019273c44faa4d8c5709b816dfda3
SHA2560151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
SHA512c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
-
Filesize
16KB
MD57237409e0640cfab7bdbd429bf821a3b
SHA14c3da934842f8d4835dfe2a9c275a300e5123309
SHA2565c8e1b63d187efafe1e09bfadd83fd360176d689b57b5a0cc40e6854c12449fa
SHA512c8afaf6a8ee43ce3601feff417bfaec563c01bcff0aae24577054034112b2020967f25b0b1a919c3c9e5e81d62a21a87e908b782c4d5cb8bba8ac259108e9c1f
-
Filesize
16KB
MD5bf1f71a3f7d15e8787c7d2163e4a57fd
SHA10ccd535689455be49db41f0ee1975109e7150f3a
SHA2566cb37209a96d0ceb43c02ef6c4585e00b7de77575135a38d67644ee7304d86f4
SHA51243b34c34d33caed5b8df5d491ecad5bb0cb8bffc99244606ee0198105f80d42c4092ddedbed14d612a7ce11f31e8a6c832b4e8623c3b5fa54df08a791e50a430
-
Filesize
16KB
MD5ae2d142cfafe624e50abc124d05a5e4a
SHA17a67d03b69e32e3378e4467bbb60efeddf2eb0b1
SHA256eae28357aa6f5486d0e3390599dcedf00cfdfdf879f5c0a01c9e36f1f1b98049
SHA512d15e11e08aa7ed87c99e832e74ef16477b07b15176f8b132f60be96d5584537846529b46ee821bd4b3094b93aae2f3372029c8138c58de6dc6e4382fe6d19004
-
Filesize
16KB
MD50bdac8545d0342e46a5961d43a5fc8c7
SHA180387a07241a1c46bd804a10f3aadc46badd7d02
SHA25640bd37ec74b972c2f04e66652c0e7a70f2a805b7bb753815136c4271abda9174
SHA51277a0c8ee1c30db8620116b268c27003634ed77ce06665ebd7bf93d46c2d3cd217fce2143daba66da42b14f11277f82e8e417d9baf309dc55ea3eb30762811c57
-
Filesize
16KB
MD556f76c6150216ca210108c083e402696
SHA1aa56f48c9cb1f0d0a717d1d89601413ffa326424
SHA256d6df33e70078a8df44ca7a0ac0c17b91c0e2c06777486659b80ecf40835ca479
SHA512a00adb3eae7f16f7fbd887b0d0d409ac7de969abd4de87581ea4900a866b6c3df50a9a9a4ccd4273b374cd92fc6f0711cedfc21fdbf0554ec708cd05691f6a76
-
Filesize
16KB
MD5835cfc7decf507cdc5e54f602e3f9699
SHA14a55d424cb32e766554672cb2d0b3804fc47552f
SHA25629257dbf2b37d226ace65bd68d001398801235d93ed830a35435bd4bab4de852
SHA5122ab470c2200d97b545693a4cdc661100e46b0299f3d3890773681bc5f22f29eeda6b6a83a5c627fa22119726f3ce78d40021362a3f018a4f3afb4a08476c253d
-
Filesize
512B
MD5d71da3c1c484070119a9463db6b639fc
SHA1d34af918b3f3ec5db92ee0bdd4fd9e944597fbb3
SHA25683bf7fc69733d0e5e107ceb69bf260b85ba16fb028f0ffbe102da34856dba5ff
SHA5129bf9b719513198f1fe38411c5bea491b010dc8f07e20b87f51f6cf8f194ef8d23cc7bbf68dc8be918652b5b559b5a56ad78ec7f9af7a989c9d9e6e7e4d63af32
-
Filesize
36KB
MD58fa4f18fe40ec167ade1a84256871a21
SHA1b8370ed0138361f176c4bdf0eb9e729d2df9c2e1
SHA256c6eee4560a567b14309ed610af8efdd272964f61c53906e15401517b500a2887
SHA512ce61304b49f14fec72e43ccbb35c48d28dced69d167f886717aefdc2a0622fe7f5ac0a4ecd104c4c0099647d07e83d324f2857bcb8d20ba9c74f616be1c775bc
-
Filesize
4KB
MD59067547a06367224811ccccdd619485b
SHA158be77967a1a357d86fe4e056c628f8357d4cc23
SHA256b42b8dcfa5caa6ee7b60df66ce88c429804a4260874f5aafd48ac0a86f128f9b
SHA51264ebe9cfa90dc26908b72764dff0b23b7588d738d3974de54b39ac8c865e5e6b740ac87c0bb7f3f66512da0653bca00e6d9c8f0f317c1d61377a51fa8f9cc3e7
-
Filesize
4KB
MD5926dcf0c61a9193bd873a2ef19cde7a8
SHA19e77d448af380d3c103c5fa778f7a9b7d1920031
SHA2569f5d22073e027f0cb9ea428285274be3da2cec94898c6b5fd804a429efebabb5
SHA5123182619e63527412309a96981c6885a55dd415112a4856764bab164d49c66eaae618e1c60ca130f5d60886921866c4c82a960fcb7326a5defb769189364e72b8
-
Filesize
4KB
MD59d1d68058788a501963d11308e0b958b
SHA137e94c4f59c1f123bae7d1b4552e2a12b97c80a4
SHA256884668b04a497a29507e3d653af515e59c0457a353a3d00afa1b0e8c22abee65
SHA5128dbb300dcef9ee350d491d0aeaee091e613609dcc6de3e7bf4fd6454ffdc7a82401580ed780c0968e8821a3661422a7e45e8d686103b52e264d75757ccc8f825
-
Filesize
4KB
MD520a1dbd275c0e05f25189ceb092f6d46
SHA19241375c104b6cec5b6c4c6780a5d7e67e52a0fc
SHA256ecbb9d336199d2fe3d964c4400f4a75db3e760c96519936b691d359500017860
SHA512259934f80a0531bd6dc946cf401faf7183abbddfc0797b88a4b059ec23de009f4487b5995cfc6c887929af2d543c2c8ffe9480bf08eb189756483bd52aa1d71e
-
Filesize
4KB
MD577582cec7abc621f8473d7fe0129072c
SHA14f3583103674bb525a4c951c354024629521b6ed
SHA25678c5c15e753ea673d684f9575e2d9e2e13f3572015a144fdc5d4ad9ac4e74ae8
SHA5126b742026a16170d7b1f564179335d3f01b0188df5053b0b414dee68f311e17a69ccebf7b938cd572447f854f0741730b2ea9e33271792a9136cb0438d00ba0ff
-
Filesize
90B
MD54a875e03e7ff1f2b84321edb1ffe064f
SHA1475a1d746041f88818865762316552dc22121263
SHA256980aab63e52edf35adbe0e14ac8214f1e3c3d966b4469c04b67eebf52885587b
SHA5120a0f77877d30ecc9b91903f9e451af6a90f6ce66747d7e95914efbaab0429b831ac66375b21d1d4b2a946b4f4bcbd3007d616099a417c4ebb66b388a91210c50
-
Filesize
556B
MD5e55f2845e399321ecc6c627b09466d6c
SHA14d6be94f960e5d015f2af3e973934cd61c63ddd1
SHA256090d62da6c8bd919bcc3e1a2dda45bddc8461b5db00866ee08a890d13c74a8bf
SHA512ee87c25b1b0ee78a8b0d3b736bf64afa34d174e9056b4e2eb5652138820b68d92c228473cad780a39a386a09956ba64018360879169e5a477acbf47422191115
-
Filesize
3KB
MD55ec681e5be740d93949a9f2c89a689ee
SHA129d7ebd12223764c942ed23cefc55cea63901e16
SHA256d95f5d07a7f37c2786033e3693076a74f6ac42e49aae1a6a100759e68ab01a54
SHA512ad6744fb072dc6ba5b8365fe4ce3f06a44d8512c02382a57ad34ecae0f168d7e133f34bf8da6f5a77e0c54f86d8b00f818316dc288efe1d404267504f28b17c3