Analysis
-
max time kernel
138s -
max time network
140s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
05-12-2024 11:12
Static task
static1
Behavioral task
behavioral1
Sample
c76afc95cfd9d6d498387a0ddbd9ec66_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
c76afc95cfd9d6d498387a0ddbd9ec66_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
c76afc95cfd9d6d498387a0ddbd9ec66_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
c76afc95cfd9d6d498387a0ddbd9ec66_JaffaCakes118.apk
-
Size
1.4MB
-
MD5
c76afc95cfd9d6d498387a0ddbd9ec66
-
SHA1
3d6155d6a9cbda5b47c95944be52456c03164d53
-
SHA256
2a302afca7828f8d034c4125ffab96ea09538528302eb7197fac4bb01961edad
-
SHA512
32a62c22280dce6ccc3be5f03be550c6b9f8a9bd0b3c98ce26fa68e18f70eb18e0f54466e4972c70774545e2bba495db1b218f406d68bafbfb4f4cd1fe713212
-
SSDEEP
24576:0aP9hoDCMK0DXfcDeL3D79yDJluOelsfRV+ezMufoKmvMaJr6Aju:0G4DwmTT/9oJsOeerBzMojmvBJr6Uu
Malware Config
Signatures
-
TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
-
TangleBot payload 1 IoCs
resource yara_rule behavioral3/memory/4504-0.dex family_tanglebot1 -
Tanglebot family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/base.apk.classes1.zip 4504 com.mmdwwk.xhznvsae -
Makes use of the framework's Accessibility service 4 TTPs 3 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.mmdwwk.xhznvsae Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId com.mmdwwk.xhznvsae Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.mmdwwk.xhznvsae -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.mmdwwk.xhznvsae -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.mmdwwk.xhznvsae -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.mmdwwk.xhznvsae
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5a1ab19df023dfd397a20fc6fd04c5f99
SHA184ffdc434abe5ed175061d634d8f56246b6a44bb
SHA256f767b028234ceab8af5dab91eeb103495fd7bab4efcac4d7dcd0c4ad2f8b897a
SHA51243b0748b9f8b6ea37e5c70fab09d17452bbaea3d04bcfe38c1bd90f880a07b20e24d247d2cee28a02e7545d7d6d0720031e81a4791d9fee2dc4d98d79d3606ef
-
/data/user/0/com.mmdwwk.xhznvsae/code_cache/secondary-dexes/tmp-base.apk.classes3002713009382812432.zip
Filesize490KB
MD51308dc6ec8e36998113f1b71a3599d4a
SHA19e542143c983a643f4ac83adfca2dea7bb6af74e
SHA2560675bd09487e9ab479dc057fef489e762510554db7613c20d8e727d3c13f0d78
SHA512932ce735636d9b27a6aa05c4db910913891fcb1b3434cf1e34bd45a7f1feda4bba6d2ef68871a02fa5e4db200c1b163c6201d4721b9d3c210e94a958dc78ca02