truthspy | 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
16s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
30/12/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample241230-ct72rsvmdr
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access discovery evasion infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy
Truthspy family
truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4509

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 8a4aac22fd4f7f1ddf9c47ec80ff701795ca1983d08f1acc965264f1f6615717
MD5 75db0da7da1077dea2d5c15616804cde
SHA1 bbe42cc37daaeb7ed7871d904b34405b68ca0f82
SHA512 7aa26414cdc60f57c44aff716ebc9fd2e8c96e6f8c0d5fdb54d1d97fcb6320093ec7654315288add46b88e7832aab27fa6bed1e282149412ae6eb12da4cf05e2
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSo:rAMEX0wIyNjao
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 127a6bcffb7fe239cf7da54ef3f529887ab24a775fe50c1086f1621f6c5989ff
MD5 0532cbdd959336cd833cf92dd80c44b4
SHA1 7d62d40ee93cee6b2e1d73850548c8345e20985a
SHA512 d6fdb9f70a35421a0f180e3242e4746a5c8694bebf44c7db3a67519e484df711ac25218b010c4f869ae99b8ffb297f5e0b8abdebeaadb47cad6ee510bc5bb902
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 25c87c97c3d9760fa948bc6f4039400bc422bd1183a82c28db986d4bbccab83f
MD5 e6128243a1171178485ad4c187dba9af
SHA1 0b4ec55468590aa7837a08c20db8ae4a49b3f36f
SHA512 056005e151b30b6a793e86588df1894e9d12be68d6ce2b5b1413c5db14937d08f1a16bcb57806d0e2d63f46f16a40b7a1a64938fdd933b89a1a98bdd7a731ab2
SSDEEP 6:7+/l9+Hn1EWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKc:7+t5WqLiuWdYRmBEyPbr
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 fda3c0d853b04b2b40b1f70347c9d1a73dee88abb53fba01361daa68e782b257
MD5 bf60378801c2cf87996552e625813f0e
SHA1 1a3020c1b2622bcdb4f2bee7210400cf17ab9442
SHA512 ec682a5e244fcd08105c3d9655261dd1d7059e90d95151dbdc879541fb287707d792d96db5a62d2101530aea0270e97453bd4cad71fb26ed4bae305feaad9621
SSDEEP 6:7+/l9EFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKavkt/X:7+tAqLJdeWRmBEyPbf81X
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download