Analysis
-
max time kernel
13s -
max time network
152s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
20/09/2024, 22:04
General
-
Target
47a1edc6ea333754d3f513ce95136aa49ecccab20480bbefa8d9c312e8d46adb.apk
-
Size
4.4MB
-
MD5
a175e333e69320279c6858a24062e17a
-
SHA1
f2665ed7009923a83ffcf78fb7a44a9573882c9a
-
SHA256
47a1edc6ea333754d3f513ce95136aa49ecccab20480bbefa8d9c312e8d46adb
-
SHA512
d25f9145210929ae3617d10d313cb87d8212a8a85c602ebf99c1be93e0028a36ada6c35a4972a8289bd7b48c6ad7cc9f36f8385a50c3561408898061458e97db
-
SSDEEP
98304:L4zibe5yH289FewplheAtTMgkxtPyD8y8tW1YTItS6hYAn8X9:LZbe5yHNzey4z6ZiIcAi
Malware Config
Signatures
-
TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
-
TangleBot payload 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.uuoscbwlg.okyxidavv1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Impair Defenses
1Prevent Application Removal
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e53c1085164dfced004eca8c7b14aec9
SHA18accd034777a78aa27fe77916f4fede89e5ef45f
SHA256965b7b67a17a5ecffb0b551a99a1f53709331d53db6de92f8dda431e02e28d58
SHA5125fe5be96ac7035730fba7c394a19c2d1e946beb2b4990ef19af4915bc7da8dcd12efabbe81e236441c8e19307293b6de0e129e66a6b6b5674e1e72e7c715c654
-
Filesize
590KB
MD54162ef29dea35ed3fd1cee7fa6f679fc
SHA176cb3364d6f727c32edeec145a235dff62851aad
SHA256f6f52ac0f35efba86a490aa3f5e8dcd1c1544a91c4e559b2e82e779575e13b2c
SHA5129e387b31514d4e69b26a512891a7f50db0c7e477ad19e77a2b2b156f83652dc2854db7899740e8d9bbe7b7876cdd5a84c3883e8e6222f232afe33d2280caa9a3
-
Filesize
590KB
MD52110fd2576acb6a61aa675e41b800f0e
SHA1f12ac6b69d1ca2eb069be7649a35e0574690d868
SHA2564263f13745f1ab0a429afec6152dd394fa80df9a88bc479a073f5892d12074d2
SHA5125520c723ab39dcf2ad6b7e8e37724438adb691cea41084c965f0d63c5db5004a3d993ee8b92b9705069a6cbcd1943a3c366e6eeae6f49cf02440e54501c88023