truthspy | 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c

Analysis

max time kernel
16s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
26/02/2025, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c.apk
Size 3.6MB
Sample250226-c2kw7ssps3
SHA256 92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c
MD5 0366ae0abf0ada8aed90322bfe07dfd5
SHA1 2f0779ce64f02944e87674745cb446c5bc620607
SHA512 52f50f2f847628b1fb498784660050a6f189d8c7cc520c0d3a06ca28cc35ee4961d0a3daca71a540e263ab930ab629b884c3ff187d4abcd8f58549fdf87f9677
SSDEEP 98304:mD/SWbGiowrvH6Odp/9hBbW+te6lXhAyHtu:mWWbGjuvl9jS+oSc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truthspy banker collection credential_access defense_evasion discovery infostealer spyware trojan

Malware Config

Extracted

Family

truthspy

http://protocol-a100.phoneparental.com/protocols

Signatures

Truthspy
Truthspy is an Android stalkerware.
trojan infostealer spyware truthspy
Truthspy family
truthspy

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.systemservice

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.systemservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.systemservice

com.systemservice
1⤵
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
PID:4452

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events
Size 56KB
SHA256 2e0064136c9dcc1d28744876222f627654e6b1b772fd2d0203449cceb1186822
MD5 4f827d5707ae262645ba7dce672594c6
SHA1 7408fbd4a7ea5cb91c3bfc7a42e6007bceeef46f
SHA512 1c2f60c9304ed5ba508a599b0c6332c74989c5c750599722ca3d88b45053bee8fb535641d5ad55a39a7dc141b147e16037e38b4a3826681b963638646fcff9e1
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSo:rAMEX0wIyNjao
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 5c944c109548e0702296b4edd18782cb8871dbecd6a91bdda713b3b3ec3314a9
MD5 d5b192289177812a7a16871e8b9d47e7
SHA1 623f46198d2c041ce49cb5ac90192ec91490a862
SHA512 5bcb6c170c48500d23c973620d64f41d9d341bf24fd1cb1fbaa488aad301df814616a1c5070dead1de087c983db5f77d8a88e46169bbb56a3d5c0adf2372e5d6
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 b4be8f3a02a4089b9a08024b24330608f45d7fec04d9d0f5b8ddc94c317ccf0b
MD5 b9455353d4ac5e7154bf56fd3a182204
SHA1 2a8d25da34265a5a74a4d292b1010b4db43900f3
SHA512 498544671d146a100ae4b16022b924ffcc99ba68860455b8228f5f8337176e39c23e8498efba0694a90d6c36d4a159210ea541eb08ac1ff75b7a7a022776de15
SSDEEP 6:7+/l9fXn1Eg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKV:7+t9aqLiuWdYRmBEyPbK
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.systemservice/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 712e05f20a17e46bd5aaea2ff112519f181f39b10e405bab2daa5a8ab084d9d4
MD5 07000d8c6a6d471a5958921d664a99d1
SHA1 46c6fcda77e50064ce03c8265dae4584737264b6
SHA512 ecf641b4a860ce188c2751021a3745eae65e04f6ab40167db790a71b3b7499ca92c20f0ec077f88ba8082fe13f2895fce43065c325b76ab29d1fad3a5f367e60
SSDEEP 6:7+/l9R/SFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKukt/T:7+tv4qLJdeWRmBEyPbnk1T
MD5 SHA1 SHA512 SSDEEP

Submit Download

core.db

Path /data/data/com.systemservice/databases/core.db
Size 36KB
SHA256 0151eae0eec786abb19ab59d7361b3291ae98411fae12cbbdfecd1612e16996e
MD5 045489a0639eee27bca52f48828cd93d
SHA1 436e7966e7c019273c44faa4d8c5709b816dfda3
SHA512 c8739a723a8648b0e380b946a97fb6cd83d6c4769ec3679bf4bc003ad0049ff5cccfc8f75a6ea272feced0020b13d3129f792f0f22cf442f0d0127f399eba22e
SSDEEP 96:eMzKMilNJzt69l/mwICfPDKOjK0Eg745TN3PafDDKsgZK5AgZWgZK5cf/ShOqLE0:AuldjKiKvI45TNAKfUf4hI2q1UpKorKS
MD5 SHA1 SHA512 SSDEEP

Submit Download