Analysis
-
max time kernel
131s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
19-12-2024 22:08
General
-
Target
9353775f44ad8d6f7c687bff942bbda6836196a2218edbc5491fba7e8b02a741.apk
-
Size
1.8MB
-
MD5
191c5458cee2fd98aa6183bac62d9325
-
SHA1
9feb0f47afebd9e329edc688fe05f865fc46f5d2
-
SHA256
9353775f44ad8d6f7c687bff942bbda6836196a2218edbc5491fba7e8b02a741
-
SHA512
785f2b6785783dcc44d63fefc5c7ee160ff856f1ea95b7e5448421b97103a8d3f81127e46cb3560f410b3d8a0af7cff4b455e1138d9e1f93a2467d9bfab7aeb9
-
SSDEEP
24576:aSkHeuJgMiBvHIIJlAXA4+T2hosWAP7rTmxHV01zzZ6X2+HtfsT/9YkgjgQ7hMzm:aSkOMyoIH2DmxH8ZjXT/VgjbhG/fm
Malware Config
Extracted
tanglebot
https://icq.im/AoLH58xYS0_leBOpXFI
https://t.me/unk22k2k2k2
https://t.me/unkppapeppappe
Signatures
-
TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
-
TangleBot payload 1 IoCs
-
Tanglebot family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.rdyxvyhyuiynu.ncggqrmsikupzntz1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD5bf1bee6ed3f78ab2fdc24246e8dcfcdb
SHA10a7e2e1c34a19bc2ca62a97f0717311da17f0268
SHA256e02a0ae5b9a13be91c4e82f1d722b9de56f8c9ed2f65ccdd2db4b23e72ad94b0
SHA512b76fa6bd56397f89b8ac050ca8ef53e8a045167e16b67c4c4df2196d29f1054befc9ed175e61804ab0f11ba8d9113db60f2fd14221cae59e63b1c98ece4b2466
-
Filesize
949KB
MD54482f2fcb8cd383f0757bdd933c150c7
SHA170892375a28d89430cf3f2b6f681fed3e74bd554
SHA25611e34879facb696c5516fa8878a0dd14b57478f047472b859dcf908192fd2e8c
SHA5122796ffe6bd6ce9d4cfcf123286b8613c89a7e59041b2a30593313764978e2dac030a2f17042236df319fbbb9155bf3593b84458185f1ed230471952ee803289e