Analysis
-
max time kernel
133s -
max time network
142s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
04-12-2024 14:23
Static task
static1
Behavioral task
behavioral1
Sample
008db830f8edcbe87ef15195781ebdd0.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
008db830f8edcbe87ef15195781ebdd0.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
008db830f8edcbe87ef15195781ebdd0.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
008db830f8edcbe87ef15195781ebdd0.apk
-
Size
8.2MB
-
MD5
008db830f8edcbe87ef15195781ebdd0
-
SHA1
27ea98e1360452af56ef4c6972ced15fe13eba3e
-
SHA256
9bfef457ff38d9e658b63586075fa3b6db5478b9309b2d0d9bda8c0b9ca7db5f
-
SHA512
60a00a3ac96986f222c374924f5b8bc23347d3c75668dfb633dce05c532a482b6ed7cc802e979e10be120385b6f2ceec7e8b5a380cbd1940d21c1a9191a70f71
-
SSDEEP
196608:wkbu/0PvCjDi4SpWzA2zSWxzL8PVWPn5GMb9dXzd4:wwW0PyxSeVKUP5Rp4
Malware Config
Signatures
-
TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
-
TangleBot payload 1 IoCs
resource yara_rule behavioral3/memory/4453-0.dex family_tanglebot1 -
Tanglebot family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.ltjkqj.erfycvar/code_cache/secondary-dexes/base.apk.classes1.zip 4453 com.ltjkqj.erfycvar -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.ltjkqj.erfycvar Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.ltjkqj.erfycvar Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.ltjkqj.erfycvar -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.ltjkqj.erfycvar -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.ltjkqj.erfycvar -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.ltjkqj.erfycvar
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5897cf21f2a12df450ecf6294fbb3653d
SHA1aebc6b845facc4aa1ecfae91ba81ccbf5a31ff2c
SHA256d803c898445814582805089f296e338fa23bab4415d6e6175d495f131a5101e4
SHA512bc6f9c53229ad3c90c70ec843e420df3ef2aa15aa9eae54e1c1d1b7e05fad6fce9a6e3ece2a9d06f1e1dc1a7307c121e1c9a9d34c7c3d6c2ba968e1d0d453bc9
-
/data/user/0/com.ltjkqj.erfycvar/code_cache/secondary-dexes/tmp-base.apk.classes5663725433535848391.zip
Filesize700KB
MD50e83370014f555fd02f2b5469b26bc93
SHA1e328f134c9124b4d3618f7d5636e045a163fd868
SHA2561f231f7732ab1128d69c199f49abef9a5157466e48239e366c178c28e735870e
SHA5120168b4e4d6fef6572c33672980e14f5d6d8617cc93a2d33beeb7e28933ca2739c14cbce500ecc31145caab433c64b65c705b17b17f8a220a5ffaf0108b9fc587