truthspy | 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
13s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
12/12/2024, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample241212-c692wsslfj
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access discovery evasion infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy
Truthspy family
truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4574

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 26566b8a91b6969497fe0ead42e7ab426cf74ff9c2e90dacea9afc1461b1f7e1
MD5 0e6ac530b7592fb7ea9b2ffeb6d562ff
SHA1 9e20d8cb850a5f2d955bf36aea5ffcf71fe8d1ad
SHA512 e7efad5cacf6de4e8cd918cfa9f6d2cb25677a6ba30aa1e414af69f629def14450425aa1bc65e3bb7e9b14c1ca045ef38378aadc70c61d2fa277844b3b9838f8
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSB6:rAMEX0wIyNjaB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 b76eaaf4a10aa1ba2a50ac38ffac0611978b687b60d7747d12b269ac4e6cafc3
MD5 58b3dbe4a475ea32d6c91afa7caa7ffb
SHA1 4631b7887f2a689a87adfc86b1377ce659f5cf7b
SHA512 0553901889eff83f2e650fd5478bcedca73e702bd515708d175ea846786ec7c8aacc7daf737a894b046264196d237fb17ff7987b67514d4c4c3abe00ac53da69
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 bfaa3070965e70af609e65389b6f0a9489e2c1bc0df5bd4f628477d739761840
MD5 c72b5fa3cba60d026f5dea89a8487024
SHA1 484ee99f632981211da43ce0d67b159b1cce07a8
SHA512 297a6a0901b9474d239828af369c7e6fcc2667c6dab0a8d631d4b5d5d48bdfcb996855e63a6a5d4f959f4779b576d98c9b6c9d79f333258fc9e9632b1e70771f
SSDEEP 6:7+/l9R3n1wscfg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKn:7+tysUqLiuWdYRmBEyPbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 3b9a5a2af9e9f34ecc8a81226d2727ed736c3bf8fb6eafd7b3307e0dc1647403
MD5 5b0724f401010c14cdc385be00c8ce27
SHA1 5b48eec985453b43b938e4f4549a6e2b80f1300f
SHA512 014a9a548bd538b1f27d3fd68eaa25b98eae05a7b43deef3b9f360cc901e9e384dbf7dcd8ba96539c807bd5a78543d32b061b03e707d20913aef31b0440d21b0
SSDEEP 6:7+/l9xOHHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKqrK//Fn:7+taHvqLJdeWRmBEyPbbOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download