tanglebot | 19605d10876e75e584278116e31b97832c6348054c2505ae9a2aa77a3135aef6

Analysis

max time kernel
7s
max time network
134s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
27/11/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19605d10876e75e584278116e31b97832c6348054c2505ae9a2aa77a3135aef6.apk
Size 9.1MB
Sample241127-3dlrpsvpfz
SHA256 19605d10876e75e584278116e31b97832c6348054c2505ae9a2aa77a3135aef6
MD5 814d41046b902f963076fcec5b11c686
SHA1 494544386347dc8db10c16baecd7e9f9c98f9deb
SHA512 7fc3322cc054b91fa26e4b70b4b732670a6abd73b269ef8168b58fa85e00c41c865617c0e6388e12338c11a4ebf97a70bba39439416cc8e0ce26b16d234084f1
SSDEEP 196608:jnFV2/ZVktqJcfTrh6Q0vIrxfAfsNUxRGooPAoXlY4x38p709VBN:jFgxyYJcf/wQ0wQxYdPA8hx3cQb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tanglebot evasion infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4283-0.dex	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.walnut.document/app_kidney/Hj.json	4283	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.walnut.document/app_kidney/Hj.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.walnut.document/app_kidney/oat/x86/Hj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.walnut.document/app_kidney/Hj.json	4256	com.walnut.document

com.walnut.document
1⤵
- Loads dropped Dex/Jar
PID:4256
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.walnut.document/app_kidney/Hj.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.walnut.document/app_kidney/oat/x86/Hj.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4283

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hj.json

Path /data/data/com.walnut.document/app_kidney/Hj.json
Size 1.8MB
SHA256 30f57febc66a9ff47936654f2917381cda18222e8670f4d77006c8b9e004a0f0
MD5 a964b1ae4b934a1904456496fee42a49
SHA1 830037f4f85130b0b408d26844e4bf5433bd7b08
SHA512 7ccd704a1b1e8dc413b0a6252e416796ad8769469c1ad4e68ff1e7886a85b9fd11248d668809d23217b7b87edccef1fdf3f4025a687fc8ed3d36aa5ad38c14e3
SSDEEP 49152:fla7fYWNdGwHwdwE2AKCISBwKc1BxKrHMd34GErjJ3Fh:flQvGpdJ2AKCIewKc1TjdIGEr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hj.json

Path /data/data/com.walnut.document/app_kidney/Hj.json
Size 1.8MB
SHA256 a5762c300f142ddb65c9b6a494cba432696e0163098953e04dd90747e60030c9
MD5 e1c8658c0ecf7b198a0d2e56ed2aa354
SHA1 12d76b3c3b1736e9423940528bab4b65cf381ce1
SHA512 79fb27774da49abc3960a57e8d16602b8f02112b9bf6ecd14307e685f37072aa50a1e63bd0630cd68a8e8fcfce41935ceaeeae7bb61825d95f59c32ea9c60805
SSDEEP 49152:2MX2i+JCoAzcCMwsZhHW8xMS9X3qxxcyF:2MGJwzcqchbvJaPcyF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hj.json

Path /data/user/0/com.walnut.document/app_kidney/Hj.json
Size 4.4MB
SHA256 369b82a96b75cf578e52de2b19f279b7093136752cd0d001b5aa8c274dfc4265
MD5 dd40fff1cfa5cbd88621eff2df43c2b4
SHA1 64957fb3a28eb763785d86e7013fda273e8c1646
SHA512 60e76962956fbcd28680d39901dd3aa604c4ffbefb5149b51a1d588cdddd56428ad9a1643e420a0b09d3770358b73528133a40d804097dcc36d949c4c6f73973
SSDEEP 49152:+EVjDhWtbCSXSzK62Gnk88pmbTc34Ka2f3itVOD6MGHMAUa:RVjNnMyK62GnZbo3Zf3FD6MGsHa
MD5 SHA1 SHA512 SSDEEP

Download

Hj.json

Path /data/user/0/com.walnut.document/app_kidney/Hj.json
Size 4.4MB
SHA256 bf5d7574bf3e09ab48d98b4230a661cedc6330761304346214700b419b1be208
MD5 118fe68c141e4958813a16679d197c36
SHA1 e8c765c07791786fb44523c33353ace376f77e6d
SHA512 fa50aed12ecf072854248277e61036bf7bacb6cf23465c8a3bd1fa6d76b56b2e50d2a2c4d8b2004d503fc5b1f95174e51a6c5c696e5d112df665a5e305912b17
SSDEEP 49152:+EVjDhWtbCSXSzK62Gnk88pmbTc34Ka2f3itVWViWi9n9NNMAUa:RVjNnMyK62GnZbo3Zf3bEWaoHa
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads