Analysis
-
max time kernel
144s -
max time network
148s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
05-12-2024 11:12
Static task
static1
Behavioral task
behavioral1
Sample
c76afc95cfd9d6d498387a0ddbd9ec66_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
c76afc95cfd9d6d498387a0ddbd9ec66_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
c76afc95cfd9d6d498387a0ddbd9ec66_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
c76afc95cfd9d6d498387a0ddbd9ec66_JaffaCakes118.apk
-
Size
1.4MB
-
MD5
c76afc95cfd9d6d498387a0ddbd9ec66
-
SHA1
3d6155d6a9cbda5b47c95944be52456c03164d53
-
SHA256
2a302afca7828f8d034c4125ffab96ea09538528302eb7197fac4bb01961edad
-
SHA512
32a62c22280dce6ccc3be5f03be550c6b9f8a9bd0b3c98ce26fa68e18f70eb18e0f54466e4972c70774545e2bba495db1b218f406d68bafbfb4f4cd1fe713212
-
SSDEEP
24576:0aP9hoDCMK0DXfcDeL3D79yDJluOelsfRV+ezMufoKmvMaJr6Aju:0G4DwmTT/9oJsOeerBzMojmvBJr6Uu
Malware Config
Signatures
-
TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
-
TangleBot payload 2 IoCs
resource yara_rule behavioral1/memory/4274-0.dex family_tanglebot1 behavioral1/memory/4218-0.dex family_tanglebot1 -
Tanglebot family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/base.apk.classes1.zip 4274 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/base.apk.classes1.zip 4218 com.mmdwwk.xhznvsae -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.mmdwwk.xhznvsae Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.mmdwwk.xhznvsae Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.mmdwwk.xhznvsae -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.mmdwwk.xhznvsae -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.mmdwwk.xhznvsae -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.mmdwwk.xhznvsae -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.mmdwwk.xhznvsae
Processes
-
com.mmdwwk.xhznvsae1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4218 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4274
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/tmp-base.apk.classes4698161532730070009.zip
Filesize490KB
MD51308dc6ec8e36998113f1b71a3599d4a
SHA19e542143c983a643f4ac83adfca2dea7bb6af74e
SHA2560675bd09487e9ab479dc057fef489e762510554db7613c20d8e727d3c13f0d78
SHA512932ce735636d9b27a6aa05c4db910913891fcb1b3434cf1e34bd45a7f1feda4bba6d2ef68871a02fa5e4db200c1b163c6201d4721b9d3c210e94a958dc78ca02
-
Filesize
1.3MB
MD5eb806935689e1ef3ea57bf62ff0a7c88
SHA13b12cb9e7a205df74bd734d595b73731652d6a48
SHA2560af82a8951c38f0c386b723720278dbe5f59ac3d3176dbc7119f329143f29c7c
SHA512172a8f82415596a3ab8ea83c5d725ed15135c6f17e68a6bdd562419697bb784abc06f58b4d7f183b72c1ea21050c44cfbe76d80a3f6120b50da619cbcd5f55c4
-
Filesize
1.3MB
MD5a1ab19df023dfd397a20fc6fd04c5f99
SHA184ffdc434abe5ed175061d634d8f56246b6a44bb
SHA256f767b028234ceab8af5dab91eeb103495fd7bab4efcac4d7dcd0c4ad2f8b897a
SHA51243b0748b9f8b6ea37e5c70fab09d17452bbaea3d04bcfe38c1bd90f880a07b20e24d247d2cee28a02e7545d7d6d0720031e81a4791d9fee2dc4d98d79d3606ef