Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    09c9613365ca619443eb8bd92b2d94f665b14f945061db1040295ef2219e97f1.bin

  • Size

    2.7MB

  • Sample

    250116-127mza1nhv

  • MD5

    dfd9110e95f81254864eb224edd52775

  • SHA1

    a1643ff063fbdf42da7c3a6e0a90cbcabedda2dc

  • SHA256

    09c9613365ca619443eb8bd92b2d94f665b14f945061db1040295ef2219e97f1

  • SHA512

    72ead9b4d73bf20ecb10b8caa9b385d0cf2bc68175eeb51384e984a89a1c0ce2b9116b9c21a086a7c52c6cc5f4766ed47e148775489d7e1e2340771936a40846

  • SSDEEP

    49152:m2DmxHuSk0PQnS1C/k2fCuLukfD2yH6FwfaChylURYOh4q6cv9OHnM:96MnLk2fCHkSRwikylURYOh4ql1YnM

Malware Config

Extracted

Family

tanglebot

C2

https://icq.im/AoLH58xYS0_leBOpXFI

https://t.me/unk22k2k2k2

https://t.me/unkppapeppappe

Targets

    • Target

      09c9613365ca619443eb8bd92b2d94f665b14f945061db1040295ef2219e97f1.bin

    • Size

      2.7MB

    • MD5

      dfd9110e95f81254864eb224edd52775

    • SHA1

      a1643ff063fbdf42da7c3a6e0a90cbcabedda2dc

    • SHA256

      09c9613365ca619443eb8bd92b2d94f665b14f945061db1040295ef2219e97f1

    • SHA512

      72ead9b4d73bf20ecb10b8caa9b385d0cf2bc68175eeb51384e984a89a1c0ce2b9116b9c21a086a7c52c6cc5f4766ed47e148775489d7e1e2340771936a40846

    • SSDEEP

      49152:m2DmxHuSk0PQnS1C/k2fCuLukfD2yH6FwfaChylURYOh4q6cv9OHnM:96MnLk2fCHkSRwikylURYOh4ql1YnM

    • TangleBot

      TangleBot is an Android SMS malware first seen in September 2021.

    • TangleBot payload

    • Tanglebot family

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks