Analysis

  • max time kernel
    144s
  • max time network
    143s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    04-12-2024 14:23

General

  • Target

    008db830f8edcbe87ef15195781ebdd0.apk

  • Size

    8.2MB

  • MD5

    008db830f8edcbe87ef15195781ebdd0

  • SHA1

    27ea98e1360452af56ef4c6972ced15fe13eba3e

  • SHA256

    9bfef457ff38d9e658b63586075fa3b6db5478b9309b2d0d9bda8c0b9ca7db5f

  • SHA512

    60a00a3ac96986f222c374924f5b8bc23347d3c75668dfb633dce05c532a482b6ed7cc802e979e10be120385b6f2ceec7e8b5a380cbd1940d21c1a9191a70f71

  • SSDEEP

    196608:wkbu/0PvCjDi4SpWzA2zSWxzL8PVWPn5GMb9dXzd4:wwW0PyxSeVKUP5Rp4

Malware Config

Signatures

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

  • TangleBot payload 1 IoCs
  • Tanglebot family
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • com.ltjkqj.erfycvar
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:5001

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ltjkqj.erfycvar/code_cache/secondary-dexes/tmp-base.apk.classes5277044189033070590.zip

    Filesize

    700KB

    MD5

    0e83370014f555fd02f2b5469b26bc93

    SHA1

    e328f134c9124b4d3618f7d5636e045a163fd868

    SHA256

    1f231f7732ab1128d69c199f49abef9a5157466e48239e366c178c28e735870e

    SHA512

    0168b4e4d6fef6572c33672980e14f5d6d8617cc93a2d33beeb7e28933ca2739c14cbce500ecc31145caab433c64b65c705b17b17f8a220a5ffaf0108b9fc587

  • /data/user/0/com.ltjkqj.erfycvar/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    1.9MB

    MD5

    897cf21f2a12df450ecf6294fbb3653d

    SHA1

    aebc6b845facc4aa1ecfae91ba81ccbf5a31ff2c

    SHA256

    d803c898445814582805089f296e338fa23bab4415d6e6175d495f131a5101e4

    SHA512

    bc6f9c53229ad3c90c70ec843e420df3ef2aa15aa9eae54e1c1d1b7e05fad6fce9a6e3ece2a9d06f1e1dc1a7307c121e1c9a9d34c7c3d6c2ba968e1d0d453bc9