Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
16/01/2025, 22:09
General
-
Target
09c9613365ca619443eb8bd92b2d94f665b14f945061db1040295ef2219e97f1.apk
-
Size
2.7MB
-
MD5
dfd9110e95f81254864eb224edd52775
-
SHA1
a1643ff063fbdf42da7c3a6e0a90cbcabedda2dc
-
SHA256
09c9613365ca619443eb8bd92b2d94f665b14f945061db1040295ef2219e97f1
-
SHA512
72ead9b4d73bf20ecb10b8caa9b385d0cf2bc68175eeb51384e984a89a1c0ce2b9116b9c21a086a7c52c6cc5f4766ed47e148775489d7e1e2340771936a40846
-
SSDEEP
49152:m2DmxHuSk0PQnS1C/k2fCuLukfD2yH6FwfaChylURYOh4q6cv9OHnM:96MnLk2fCHkSRwikylURYOh4ql1YnM
Malware Config
Extracted
tanglebot
https://icq.im/AoLH58xYS0_leBOpXFI
https://t.me/unk22k2k2k2
https://t.me/unkppapeppappe
Signatures
-
TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
-
TangleBot payload 1 IoCs
-
Tanglebot family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.wmwwlvnvzubyoolif.sviekzqwaun1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD5ed6383e28da880c821590a82bfb068ef
SHA17ba6d90c0462cf8b897af076c607cf2aaada03dd
SHA25666df1881e078716d877c64eafba6acba986da296c78984aeaed8f474ab37d4d7
SHA512c40467df98ced23fea29484b3b32dbdbe3aa1ccb22341a391394c8367a0259f90e820062ef74dcfa67166ebe6ecf5b35e9a6703c8340cc0602e9d632c78c3454
-
Filesize
949KB
MD51d718dcdf766a6b758feeb361106257b
SHA1234d10378c3105ad5c67d81cf6935294adbca89b
SHA256d72145239d93261120c4e211ceb5a2338bf920e1fb95c32cd1622f8264ef3299
SHA512a60954b70c08318139b6481f2a731863c39e9d09f2dde73977e76441240099116fcc0ed4d6ea9432a9fc49849532fcc6118dd5754f5c4f45d665703cf0373a21