Analysis

  • max time kernel
    139s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    05-12-2024 11:12

General

  • Target

    c76afc95cfd9d6d498387a0ddbd9ec66_JaffaCakes118.apk

  • Size

    1.4MB

  • MD5

    c76afc95cfd9d6d498387a0ddbd9ec66

  • SHA1

    3d6155d6a9cbda5b47c95944be52456c03164d53

  • SHA256

    2a302afca7828f8d034c4125ffab96ea09538528302eb7197fac4bb01961edad

  • SHA512

    32a62c22280dce6ccc3be5f03be550c6b9f8a9bd0b3c98ce26fa68e18f70eb18e0f54466e4972c70774545e2bba495db1b218f406d68bafbfb4f4cd1fe713212

  • SSDEEP

    24576:0aP9hoDCMK0DXfcDeL3D79yDJluOelsfRV+ezMufoKmvMaJr6Aju:0G4DwmTT/9oJsOeerBzMojmvBJr6Uu

Malware Config

Signatures

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

  • TangleBot payload 1 IoCs
  • Tanglebot family
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • com.mmdwwk.xhznvsae
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4995

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/tmp-base.apk.classes4569267785994133174.zip

    Filesize

    490KB

    MD5

    1308dc6ec8e36998113f1b71a3599d4a

    SHA1

    9e542143c983a643f4ac83adfca2dea7bb6af74e

    SHA256

    0675bd09487e9ab479dc057fef489e762510554db7613c20d8e727d3c13f0d78

    SHA512

    932ce735636d9b27a6aa05c4db910913891fcb1b3434cf1e34bd45a7f1feda4bba6d2ef68871a02fa5e4db200c1b163c6201d4721b9d3c210e94a958dc78ca02

  • /data/user/0/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    1.3MB

    MD5

    a1ab19df023dfd397a20fc6fd04c5f99

    SHA1

    84ffdc434abe5ed175061d634d8f56246b6a44bb

    SHA256

    f767b028234ceab8af5dab91eeb103495fd7bab4efcac4d7dcd0c4ad2f8b897a

    SHA512

    43b0748b9f8b6ea37e5c70fab09d17452bbaea3d04bcfe38c1bd90f880a07b20e24d247d2cee28a02e7545d7d6d0720031e81a4791d9fee2dc4d98d79d3606ef