Analysis
- max time kernel
68s - max time network
131s - platform
android_x86 - resource
android-x86-arm-20240624-en - resource tags
- submitted
26/01/2025, 16:28
General
- Target 86361fcace1ac9458d930d3cabffece4caaaa37ea17b690c2e0eafec5976795d.apk
- Size 3.9MB
- Sample250126-tyttdaxnel
- SHA256 86361fcace1ac9458d930d3cabffece4caaaa37ea17b690c2e0eafec5976795d
Malware Config
Extracted
-
truthspy
-
http://protocol-a943.thetruthspy.com/protocols
Signatures
- Truthspy
Truthspy is an Android stalkerware.
- Truthspy family
- Checks if the Android device is rooted. 1 TTPs 3 IoCs
- Removes its main activity from the application launcher 1 TTPs 1 IoCs
- Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Acquires the wake lock 1 IoCs
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.systemservice1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/sh2⤵
-
ls /sbin/su3⤵
- Checks if the Android device is rooted.
-
-
ls /system/sbin/su3⤵
-
-
ls /system/bin/su3⤵
- Checks if the Android device is rooted.
-
-
ls /system/xbin/su3⤵
- Checks if the Android device is rooted.
-
-
-
su2⤵
-
-
/system/bin/sh2⤵
-
ls /odm/bin/su3⤵
-
-
ls /vendor/bin/su3⤵
-
-
ls /vendor/xbin/su3⤵
-
-
-
su2⤵
-
-
su2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
1System Network Configuration Discovery
1System Network Connections Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
androidx.work.workdb
androidx.work.workdb-journal
androidx.work.workdb-shm
androidx.work.workdb-wal
androidx.work.workdb-wal
core.db
core.db
core.db-journal
core.db-wal
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db
google_app_measurement_local.db-journal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
google_app_measurement_local.db-wal
log4j.txt
com.google.InstanceId.properties