truthspy | 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
17s
max time network
132s
platform
android_x64
resource
android-33-x64-arm64-20240624-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
submitted
25/01/2025, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample250125-c2d4na1mdy
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access defense_evasion discovery infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy
Truthspy family
truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4336

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 719dc4e73c4dc17703a7d4d588783cfdeb0736435d0104e5d760b8af40255b40
MD5 04ff4cc9c2e362296cf1d0d7b82f0128
SHA1 b80c5d6ceefabc56b6bec3d103ff0fcaf22fb1a4
SHA512 1c1cc43d8b62c5e0bc6cde0c584716a65268c722494b70149b11cee9e288c965eff3954a09e0746c544a5346cfce2cba515a9af3cc3cbbb42acfb9bfd5e16573
SSDEEP 48:TIg59MENZBdUdndVd/729IvdldHlq8/Jq4qPSg:RMEX0wIyNjag
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 06abd47c0b0aaa04a5e4950ebdc62556cde0a71af63ea0d3adf1953eef29af1c
MD5 570cad075f2b6f435ed9857ab1cf9868
SHA1 a1a228ebd7c90d6e0b3877b92ea85cd97990ed2d
SHA512 a082af563f1461eb9d994a9e8bbc4f75d69d288e501e7bfe6cf8b4a1ac61efeb4d905461b27f78ff1225c3dd66c13c0cb7070a7558866dea46dccfcc589da3fc
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b231b123224e8a7a8658b79f014102a3d08f153dd0efc444b87c4ee81146b5a3
MD5 4d1105458b0b5592915cbd2d4fd0fc89
SHA1 fe6e66c07a2e38fef7ff6462361e4842f2b09748
SHA512 201a00e6336de8fd3d180e94cc901b276cb0230e1af350bfa5dcd73f6922c909d6358516bc48c952bb19268aabc642d2beaa31c438e8248a308b0e858397510c
SSDEEP 6:7+/l9vfFn1kPRg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuK094n:7+tNgpqLiuWd7RmBEyPbH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 cb8767f0d3100fc29560243eb26711615fc8bfa66e6f799084b2da7a8f717db0
MD5 d1a20d54c8922446c9c26124d5d4f9c0
SHA1 69f2959363c5dde7bbce67996f3ae01fbcd8405c
SHA512 f7c0fb2b8daaa483181901f99116d4060f35a389391cf881808c1c319187ef6d85f85482a6b952d83b7a9fce0bd5c61d52fbb75595aae9dd4f40f4522ef53d7b
SSDEEP 6:7+/l9FgPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKq/ls//Hn:7+t0qLJdKBRmBEyPb5yXH
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download