truthspy | fefc35ce29a326420873597eae3662904649f5db16f09901048eade4d06110b6

Analysis

max time kernel
12s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
08/12/2024, 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d541a70a27d275d4da01af02ab3e555a_JaffaCakes118.apk
Size

1.5MB
MD5

d541a70a27d275d4da01af02ab3e555a
SHA1

991bfee5c575ecd5c1472f77c81fcd58232279a8
SHA256

fefc35ce29a326420873597eae3662904649f5db16f09901048eade4d06110b6
SHA512

95a011314925caaec5dab0c4db618233439f375501d2515bcb2e62ac36c75e26bfa89449cd07c18da6811e5fc760712cc9faacab71c9add894bb2c996b313c01
SSDEEP

24576:UukV0IX4rkOSVq17KBNicW29CoVViNEsbkb7aZKZQNXORemW3hEhUukfrWF0p5d9:ULV0SgkS17EW2riisa73ZQ0zWKMrWgr9

Score

10^/10

truthspy banker discovery infostealer persistence spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a79.thetruthspy.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy
Truthspy family
truthspy
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.systemservice

com.systemservice
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4209

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.systemservice/databases/core.db

Filesize
26KB

MD5
9c45b23a93be7dc2e2179931cf8ff5cc

SHA1
5ba1f16802c041e85faa0196e30b70a5da7c9616

SHA256
bfbe842056582a3d3f8c3cc3bbcb0f9f91554be050a02084e58c721b25206d9c

SHA512
ebc900671b13983d33e258c6306d3413e1880d1aebb595885ac2872a5ea39e64c960bf41760ac3d18c228ee281612385d5fbd3191dc4d97f0510eb90f2d6a6ac

Download Submit