General

  • Target

    811932026_lnatTvPRO1.apk_temp

  • Size

    6.2MB

  • MD5

    5b3ce001c0ea9a77b5665c1a306577bf

  • SHA1

    b62e459587848bdecca63ef848349ecdaa6a97d0

  • SHA256

    1f8aa27d59c8b9c5d1f28610c1f195c7c6efa2c80f98842fd3fb18b4241472c3

  • SHA512

    338c3f164516ad3670bf3690732db14c3b684d450979ed3ff5d5b8fd297d50308fb8323ccc43f61f06a65f5d7027f3b7c57ad393b247c295dc3b9223881cf168

  • SSDEEP

    98304:Cd2ZrWcENKuqxWc8fL84x5i+/fg6QMzfr2J5cTYFxpVuSaLsjA2ridR:mkuq684x5MtcTsvVRciAGcR

Score
10/10

Malware Config

Extracted

Family

tanglebot

C2

https://t.me/anbsh26

https://t.me/anbshaa

https://t.me/anbshbb

Signatures

  • TangleBot payload 2 IoCs
  • Tanglebot family
  • Attempts to obfuscate APK file format

    Applies obfuscation techniques to the APK format in order to hinder analysis

  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 15 IoCs

Files

  • 811932026_lnatTvPRO1.apk_temp
    .apk android

    com.twenty.totor

    com.mem.installdropsession.InstallDropSession


  • base.apk
    .apk android

    com.hqnxyxefsxbjbppnc.grqsoegnhznihjq

    com.hqnxyxefsxbjbppnc.grqsoegnhznihjq.MainActivity


Android Permissions

811932026_lnatTvPRO1.apk_temp

Permissions

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.BLUETOOTH

android.permission.CAMERA

android.permission.ACCESS_NETWORK_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.BLUETOOTH

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.ACCESS_FINE_LOCATION

android.permission.READ_EXTERNAL_STORAGE

android.permission.PACKAGE_USAGE_STATS

com.google.android.gms.permission.ACTIVITY_RECOGNITION

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.GET_TASKS

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_LAUNCH_BROADCASTS

android.permission.READ_PHONE_STATE

android.permission.ACTION_MANAGE_OVERLAY_PERMISSION

android.permission.WAKE_LOCK

android.permission.READ_EXTERNAL_STORAGE

android.permission.GET_PACKAGE_SIZE

android.permission.BLUETOOTH_SCAN

android.permission.QUERY_ALL_PACKAGES

android.permission.QUICKBOOT_POWERON

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.USE_FULL_SCREEN_INTENT

android.permission.INTERNET

android.permission.VIBRATE

android.permission.CHANGE_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.DISABLE_KEYGUARD

android.permission.BLUETOOTH_CONNECT

android.permission.RECORD_AUDIO