Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6

d118bae3c4...f0.apk

android-9-x86

10

d118bae3c4...f0.apk

android-10-x64

10

d118bae3c4...f0.apk

android-11-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    151s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    23/12/2024, 22:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d118bae3c4d5a0d3d1740b75d40e334d0c6114984420b5598797c4ef9f08c4f0.apk

  • Size

    4.2MB

  • MD5

    554de25b8124f49564919a1847818c8d

  • SHA1

    c8896951f7c10330e65e2232fcf51f92b675b1e0

  • SHA256

    d118bae3c4d5a0d3d1740b75d40e334d0c6114984420b5598797c4ef9f08c4f0

  • SHA512

    063181a436c0ce3ac2b38d723539bc0fdfa383ccef3d02a130de061a5d1f556f2e59fe53396c12a85317b5a7872fd6a38624d5f156b7fbf6dc2afd97ea619e9c

  • SSDEEP

    98304:JtPzEX/O8N+ee/e/6rN0LFuz6NIkd9WYGUZhKn4BjDUwu:7U28NZr2CFxIWkD4Bn4

Score
10/10
tanglebotbankercollectioncredential_accessdiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tanglebot

C2

https://icq.im/AoLH58pXY8ejJTQiWg8

https://t.me/pempeppepepep

https://t.me/xpembeppep2p2

Signatures

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot
  • TangleBot payload 2 IoCs
  • Tanglebot family
    tanglebot
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • snapshot.termux.testpen
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4212
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/snapshot.termux.testpen/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/snapshot.termux.testpen/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4242

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/snapshot.termux.testpen/code_cache/secondary-dexes/tmp-base.apk.classes7035316077231229466.zip
    Filesize

    455KB

    MD5

    20870f226232b3b9225132eacf238e1a

    SHA1

    da54895f98182fee8f4d1edc27baf3b005c692c8

    SHA256

    6b5273583bef5856ad487e6af842efd7b632b2dce7382753b0be10a09e331f31

    SHA512

    3d754bdbd9ef574bea3692bcb96ff9451d34f41f75194f32cff519727575f419ed25a05e28a9d36d45a954ea5f07ffdbb2aba1d8d716d5e5cd60d7c471aafd1e

    Download Submit

  • /data/user/0/snapshot.termux.testpen/code_cache/secondary-dexes/base.apk.classes1.zip
    Filesize

    949KB

    MD5

    29d022dc1d5eead2ef8feff9089efe9a

    SHA1

    7cc5720c83cc3e49c6a0090f38c5de7b7b7d38e6

    SHA256

    11045ded31906f23052e93be720c71e7c131ecc5b5164afedaacd30bdb2f9b5c

    SHA512

    32bdb68afcf3c4683742f75f9d3bc4e85665b53c6ddad280010d75014577148bea6503d99873652e9140d2cc770e37ddb6ba766afb781aac785bc1d6fa5fdee6

    Download Submit

  • /data/user/0/snapshot.termux.testpen/code_cache/secondary-dexes/base.apk.classes1.zip
    Filesize

    949KB

    MD5

    88102547b7156f463282084ee8a682b2

    SHA1

    b8568851c1de0b9bc48846504b356761751df632

    SHA256

    3ac8042731096a2c7ab08e5b6e1683a24efa7a43aa495a0d838a0c2fd6587ee1

    SHA512

    81f2e21e9cc1f73cc6da8161418db9ed7b27032d7aaaa9cdc2060930d074c33257976f8db71ad478e197407dfc04f00856fa4065af4aa588017517014d0e5e5b

    Download Submit