Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

cbf2b3250d...5b.apk

android-9-x86

10

cbf2b3250d...5b.apk

android-10-x64

1

cbf2b3250d...5b.apk

android-11-x64

10

Resubmissions

16/12/2024, 22:36

241216-2h8xcssrgk 10

16/12/2024, 22:35

241216-2hwxsssren 10

13/12/2024, 22:04

241213-1za6zszkcx 10

Analysis

  • max time kernel
    47s
  • max time network
    150s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    13/12/2024, 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cbf2b3250d5228c6006c5edd0d42fff890f24b80d54525b5cba5e5dfc1e4de5b.apk

  • Size

    4.2MB

  • MD5

    f159d49f84925f204549ffd7f742955c

  • SHA1

    e536079d38b426dc9abb34ff2aa7fbfd8297a093

  • SHA256

    cbf2b3250d5228c6006c5edd0d42fff890f24b80d54525b5cba5e5dfc1e4de5b

  • SHA512

    258ef43c7e0ab8482a8f37c79fb59788b57facf4fa4eeb7aadf9d0803bd306c0f773478cf6fd559f04959a4254379465a1b4b1901203a75c434de8c989edad1b

  • SSDEEP

    49152:7Ygrkl7d9SbMbwUzfr2+63lRWY5dO3hrXFTUgoxYkAn9tTQ:9rkl7dJzfr2+eF5cRrVYUnTQ

Score
10/10
tanglebotbankercollectioncredential_accessdiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tanglebot

C2

https://icq.im/AoLH5bRXfAE6eCtbw1I

https://t.me/zedezededeed

https://twitter.com/doplghas

Signatures

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot
  • TangleBot payload 2 IoCs
  • Tanglebot family
    tanglebot
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.dyuymkaiacl.zyshpnspmznlnqzzn
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4256
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.dyuymkaiacl.zyshpnspmznlnqzzn/app_DynamicOptDex/cuaTZX.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.dyuymkaiacl.zyshpnspmznlnqzzn/app_DynamicOptDex/oat/x86/cuaTZX.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4285

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

1
T1628

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

2
T1422

Lateral Movement

Collection

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.dyuymkaiacl.zyshpnspmznlnqzzn/app_DynamicOptDex/cuaTZX.json
    Filesize

    706KB

    MD5

    860274d16f9b3f4109092163474b0673

    SHA1

    31d0fe9a2a0a4b39fe4748a532b43f71e294474d

    SHA256

    540964e823ed651f95add5497ef4799a41f10db0b9fc6ecc8897bfba1d5d0501

    SHA512

    e985cda84e254788a08f1cf6a14d86210ea66b7c3aac0ad11d579a3a1a48aa8225854d8dff23171455cbe80c5165755c6526c3e1b69677e44a777572e56fa995

    Download Submit

  • /data/data/com.dyuymkaiacl.zyshpnspmznlnqzzn/app_DynamicOptDex/cuaTZX.json
    Filesize

    706KB

    MD5

    3b995b1416bc5a5d94b57293b57c87d7

    SHA1

    b64684345756c30a4339b5cb7cab0bf0b7648272

    SHA256

    6582356000bef473c5b300e929e2fe6d35855b549af946334f6e387348bed951

    SHA512

    2fb0e09df6f67290b87d28ae5ed9eb888b52d6213a8deea9e96f824fb65a03623bfa5236e47475c8ab94f154418ea8d9ff64904dc8ed7af8240ef3043bf01c38

    Download Submit

  • /data/user/0/com.dyuymkaiacl.zyshpnspmznlnqzzn/app_DynamicOptDex/cuaTZX.json
    Filesize

    1.5MB

    MD5

    a54b498e04c3b58a9e8426faec478e53

    SHA1

    ac7430d43dad74489148d4e205de115f62f3eff2

    SHA256

    5352eacc68c12499413c56a3bb56987bc668f3815ae22a0f670383befb513ea3

    SHA512

    2a50516e1d31c066b22d9943c6bec328b57259282815e5030bc6d9d088e7d79730434e1ccda6127efa5ff4d99f4d50375549ff0c0c5212084d64a960eb4aefd9

    Download Submit

  • /data/user/0/com.dyuymkaiacl.zyshpnspmznlnqzzn/app_DynamicOptDex/cuaTZX.json
    Filesize

    1.5MB

    MD5

    05fa4ec5c772d2aed2c0b2183374315c

    SHA1

    13bb8c957f02eb3c9cc17782980ec68a17b146ea

    SHA256

    c4744d90dde7eb8047a7db07e01ff3bceedecccfb27e86bdc773381e473cb568

    SHA512

    68a494dd3f5429f6021fb6c3ef0bef1889829f0740ccede64dcad73cfa19386411e36c123a6cb057a3892f685663182280667161055bded48d7745f2efce1315

    Download Submit