tanglebot | lnat Tv Pro [.]apk

General

Target

lnat Tv Pro .apk
Size

6.2MB
MD5

cd25af96fa2ba639fc995b14e9d0cd4e
SHA1

ef784882629b4d54bf1b346d12ab8c96787a04f0
SHA256

669c3be3cb02d6a20f74eb13104e145747c8e3d4e7a51103f95f3f97eba958ce
SHA512

d32468e276c124140a5f9e89cc293f913ee78eb0d52f4679aae12677ddc97eefcb11ee4c83b249b3943834c3d6868e2265e9f602bf436abea40bd192d27ccf1f
SSDEEP

98304:Ud2ZrW+ENKuqxWc8fL84x5t+9i8AzfrsmjDUwx6VbrIKMQrB:ykuq684x5t+UDnHub0KMAB

Score

10^/10

tanglebot

Malware Config

Extracted

Family

tanglebot

C2

https://icq.im/AoLH58pXY8ejJTQiWg8

https://t.me/pempeppepepep

https://t.me/xpembeppep2p2

Signatures

TangleBot payload 1 IoCs

resource	yara_rule
static1/unpack001/base.apk	family_tanglebot2

Tanglebot family
tanglebot
Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to discover and pair nearby Bluetooth devices.	android.permission.BLUETOOTH_SCAN
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an application to record audio.	android.permission.RECORD_AUDIO

Files

lnat Tv Pro .apk
.apk android

com.dontdo.okdonow

com.mem.installdropsession.InstallDropSession

Activities

com.mem.installdropsession.InstallDropSession

android.intent.action.MAIN
com.example.android.apis.content.SESSION_API_PACKAGE_INSTALLED

Permissions

android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.BLUETOOTH
android.permission.CAMERA
android.permission.ACCESS_NETWORK_STATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.BLUETOOTH
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.ACCESS_FINE_LOCATION
android.permission.READ_EXTERNAL_STORAGE
android.permission.PACKAGE_USAGE_STATS
com.google.android.gms.permission.ACTIVITY_RECOGNITION
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.GET_TASKS
android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_LAUNCH_BROADCASTS
android.permission.READ_PHONE_STATE
android.permission.ACTION_MANAGE_OVERLAY_PERMISSION
android.permission.WAKE_LOCK
android.permission.READ_EXTERNAL_STORAGE
android.permission.GET_PACKAGE_SIZE
android.permission.BLUETOOTH_SCAN
android.permission.QUERY_ALL_PACKAGES
android.permission.QUICKBOOT_POWERON
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.USE_FULL_SCREEN_INTENT
android.permission.INTERNET
android.permission.VIBRATE
android.permission.CHANGE_WIFI_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_BACKGROUND_LOCATION
android.permission.DISABLE_KEYGUARD
android.permission.BLUETOOTH_CONNECT
android.permission.RECORD_AUDIO
base.apk
.apk android

la.lostecho.hook

la.lostecho.hook.MainActivity

Activities

la.lostecho.hook.MainActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.POST_NOTIFICATIONS
android.permission.QUERY_ALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.FOREGROUND_SERVICE
android.permission.READ_PHONE_STATE
android.permission.RECORD_AUDIO
android.permission.CAMERA
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.WAKE_LOCK
android.permission.SYSTEM_ALERT_WINDOW

Receivers

la.lostecho.hook.Receiver.ScreenReceiver

android.intent.action.USER_PRESENT
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF

la.lostecho.hook.Service.InstallerRestarterService

restartinstallerservice

Services

la.lostecho.hook.Service.AccessibilityControllerService

android.accessibilityservice.AccessibilityService

Android Permissions

lnat Tv Pro .apk

Permissions

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.BLUETOOTH

android.permission.CAMERA

android.permission.ACCESS_NETWORK_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.BLUETOOTH

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.ACCESS_FINE_LOCATION

android.permission.READ_EXTERNAL_STORAGE

android.permission.PACKAGE_USAGE_STATS

com.google.android.gms.permission.ACTIVITY_RECOGNITION

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.GET_TASKS

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_LAUNCH_BROADCASTS

android.permission.READ_PHONE_STATE

android.permission.ACTION_MANAGE_OVERLAY_PERMISSION

android.permission.WAKE_LOCK

android.permission.READ_EXTERNAL_STORAGE

android.permission.GET_PACKAGE_SIZE

android.permission.BLUETOOTH_SCAN

android.permission.QUERY_ALL_PACKAGES

android.permission.QUICKBOOT_POWERON

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.USE_FULL_SCREEN_INTENT

android.permission.INTERNET

android.permission.VIBRATE

android.permission.CHANGE_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.DISABLE_KEYGUARD

android.permission.BLUETOOTH_CONNECT

android.permission.RECORD_AUDIO

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

com.dontdo.okdonow

com.mem.installdropsession.InstallDropSession

Activities

com.mem.installdropsession.InstallDropSession

Permissions

la.lostecho.hook

la.lostecho.hook.MainActivity

Activities

la.lostecho.hook.MainActivity

Permissions

Receivers

la.lostecho.hook.Receiver.ScreenReceiver

la.lostecho.hook.Service.InstallerRestarterService

Services

la.lostecho.hook.Service.AccessibilityControllerService

Android Permissions

lnat Tv Pro .apk