tanglebot | 19605d10876e75e584278116e31b97832c6348054c2505ae9a2aa77a3135aef6

Analysis

max time kernel
7s
max time network
134s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
27-11-2024 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19605d10876e75e584278116e31b97832c6348054c2505ae9a2aa77a3135aef6.apk
Size

9.1MB
MD5

814d41046b902f963076fcec5b11c686
SHA1

494544386347dc8db10c16baecd7e9f9c98f9deb
SHA256

19605d10876e75e584278116e31b97832c6348054c2505ae9a2aa77a3135aef6
SHA512

7fc3322cc054b91fa26e4b70b4b732670a6abd73b269ef8168b58fa85e00c41c865617c0e6388e12338c11a4ebf97a70bba39439416cc8e0ce26b16d234084f1
SSDEEP

196608:jnFV2/ZVktqJcfTrh6Q0vIrxfAfsNUxRGooPAoXlY4x38p709VBN:jFgxyYJcf/wQ0wQxYdPA8hx3cQb

Score

10^/10

tanglebot evasion infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4283-0.dex	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.walnut.document/app_kidney/Hj.json	4283	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.walnut.document/app_kidney/Hj.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.walnut.document/app_kidney/oat/x86/Hj.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.walnut.document/app_kidney/Hj.json	4256	com.walnut.document

com.walnut.document
1⤵
- Loads dropped Dex/Jar
PID:4256
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.walnut.document/app_kidney/Hj.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.walnut.document/app_kidney/oat/x86/Hj.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4283

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.walnut.document/app_kidney/Hj.json

Filesize
1.8MB

MD5
a964b1ae4b934a1904456496fee42a49

SHA1
830037f4f85130b0b408d26844e4bf5433bd7b08

SHA256
30f57febc66a9ff47936654f2917381cda18222e8670f4d77006c8b9e004a0f0

SHA512
7ccd704a1b1e8dc413b0a6252e416796ad8769469c1ad4e68ff1e7886a85b9fd11248d668809d23217b7b87edccef1fdf3f4025a687fc8ed3d36aa5ad38c14e3

Download Submit
/data/data/com.walnut.document/app_kidney/Hj.json

Filesize
1.8MB

MD5
e1c8658c0ecf7b198a0d2e56ed2aa354

SHA1
12d76b3c3b1736e9423940528bab4b65cf381ce1

SHA256
a5762c300f142ddb65c9b6a494cba432696e0163098953e04dd90747e60030c9

SHA512
79fb27774da49abc3960a57e8d16602b8f02112b9bf6ecd14307e685f37072aa50a1e63bd0630cd68a8e8fcfce41935ceaeeae7bb61825d95f59c32ea9c60805

Download Submit
/data/user/0/com.walnut.document/app_kidney/Hj.json

Filesize
4.4MB

MD5
dd40fff1cfa5cbd88621eff2df43c2b4

SHA1
64957fb3a28eb763785d86e7013fda273e8c1646

SHA256
369b82a96b75cf578e52de2b19f279b7093136752cd0d001b5aa8c274dfc4265

SHA512
60e76962956fbcd28680d39901dd3aa604c4ffbefb5149b51a1d588cdddd56428ad9a1643e420a0b09d3770358b73528133a40d804097dcc36d949c4c6f73973

Download Submit
/data/user/0/com.walnut.document/app_kidney/Hj.json

Filesize
4.4MB

MD5
118fe68c141e4958813a16679d197c36

SHA1
e8c765c07791786fb44523c33353ace376f77e6d

SHA256
bf5d7574bf3e09ab48d98b4230a661cedc6330761304346214700b419b1be208

SHA512
fa50aed12ecf072854248277e61036bf7bacb6cf23465c8a3bd1fa6d76b56b2e50d2a2c4d8b2004d503fc5b1f95174e51a6c5c696e5d112df665a5e305912b17

Download Submit