General
-
Target
86361fcace1ac9458d930d3cabffece4caaaa37ea17b690c2e0eafec5976795d.apk
-
Size
3.9MB
-
Sample
250126-tyttdaxnel
-
MD5
f428eb0d94bdedc983728a056aca7d27
-
SHA1
9f9244c99a4143100bed3b45ec8a6962c421eede
-
SHA256
86361fcace1ac9458d930d3cabffece4caaaa37ea17b690c2e0eafec5976795d
-
SHA512
2474fa5c3350461e7801fd30130ce8d65df690089b6834e0e3670310aff963e2ab760a96bac331d2cb002333eb21018270cd08ff0c94c55e50849613552fdf6d
-
SSDEEP
98304:0OcVtd8n4x6QAP3ftPq3tE2LV62nGxbsTQ9We2ePdlD2AWy:0TyFQa+c+GhMWVH3Df
Behavioral task
behavioral1
Sample
86361fcace1ac9458d930d3cabffece4caaaa37ea17b690c2e0eafec5976795d.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
86361fcace1ac9458d930d3cabffece4caaaa37ea17b690c2e0eafec5976795d.apk
Resource
android-x64-20240624-en
Malware Config
Extracted
truthspy
http://protocol-a.thetruthspy.com/protocols/get_synx_now.aspx
http://protocol-a.thetruthspy.com/protocols/getsetting.aspx
https://thetruth-db94a-default-rtdb.firebaseio.com
https://thetruth-db94a.firebaseio.com
Extracted
truthspy
http://protocol-a943.thetruthspy.com/protocols
Targets
-
-
Target
86361fcace1ac9458d930d3cabffece4caaaa37ea17b690c2e0eafec5976795d.apk
-
Size
3.9MB
-
MD5
f428eb0d94bdedc983728a056aca7d27
-
SHA1
9f9244c99a4143100bed3b45ec8a6962c421eede
-
SHA256
86361fcace1ac9458d930d3cabffece4caaaa37ea17b690c2e0eafec5976795d
-
SHA512
2474fa5c3350461e7801fd30130ce8d65df690089b6834e0e3670310aff963e2ab760a96bac331d2cb002333eb21018270cd08ff0c94c55e50849613552fdf6d
-
SSDEEP
98304:0OcVtd8n4x6QAP3ftPq3tE2LV62nGxbsTQ9We2ePdlD2AWy:0TyFQa+c+GhMWVH3Df
-
Truthspy family
-
Checks if the Android device is rooted.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
MITRE ATT&CK Mobile v15
Defense Evasion
Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
2