truthspy | 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
16s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
05/01/2025, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample250105-c8dfps1mcq
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access discovery evasion infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy
Truthspy family
truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4474

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 5ddc1a2c8a7542bd27d4a61bb6f71d6497592224e2a3391a1f5d2a11d7ae80e5
MD5 ce4427cd552e4bda097307b10d780881
SHA1 10f6ab1c7d03ef696c656bc7d23a54c1baa7aef2
SHA512 0c2bca7dd59e73530bf6688c8a77a1dc90346b6f0635a142c78dd47ca4b1e2fde2be036a8acbb65a373e2aafc13160e8f8a9d15ee82c7aeeda01314cd410295c
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS0:rAMEX0wIyNja0
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 66a8a29ec4e16699cd9b1234395310d9ff0e8c141ed6c4443fe026f537be8e6d
MD5 03f5654136e45cb72d3845514877c01f
SHA1 9e773972066733e6986434814b84ad3425ec3e96
SHA512 1697126b4f0c2db79ee8d60fca04c4f3257398d439077c667a8fbfe34ee0b81a1c2edfde1d52c8946d70a9af8dd87aefaa34d3fc93cd60d27f609f20725eb775
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 4a28847d096a36537431a56b035c388fcc0409d19f11e7a85561c90f181fda23
MD5 394648f2012d04b874433ade08451974
SHA1 eb0f72c84d0321a788967c2d51494a4cf389ef20
SHA512 d3da14949e2d480ff119a74f787090953eb96343821ba826f8f1671660e6c1f3db07bd7c0e1ea7befdf2e9ffc9d13080d71031209e5b85db0ab81dc9344cf73f
SSDEEP 6:7+/l9j/Gn1Tpg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKm:7+tkqLiuWdYRmBEyPbV
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 336b342b42d04f70bc270ba43b1a6ebe4e562aa765f54bc49b1245cd10083989
MD5 76d3f49cc0758aa4c62b536c7c0762a0
SHA1 03b9ee95f52231dfe83dd5167efb18be1b8a35a9
SHA512 f3d463f060034636e9e2e6fcb25de10898c64311bac2f3f161f5ecafe118c97fbc29498747abde8a200eb9146d94bafaf63ad13b33e52165274a4505f85d5061
SSDEEP 6:7+/l90qVPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKZs//MV:7+t5RqLJdeWRmBEyPbKsMV
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download