Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    base.apk

  • Size

    2.1MB

  • Sample

    250117-n86b9swpcs

  • MD5

    282ba59582d916398073d7907effd023

  • SHA1

    065df5a64c110188349d15f6c537159c20088328

  • SHA256

    6098a436094f1e3e8721fb87ff36781a1a283711cc0388f608723a18132607c4

  • SHA512

    f8b5e5df21a250a3d25c37d7898df430914bca5e324ab30c92d692ebdcc406880daa340d7456782ca5ce165b1bfc22cbf072c36593b83fbda012bbab3eec4cf1

  • SSDEEP

    24576:WiE1gn4LroFyeEZe+Yw/ibT++Z5oqiH6bKD39t9s5gYUzfr2Wd4/C:sqn4X7Y/n++Z5rbKD3ls5gYUzfr2S

Malware Config

Extracted

Family

tanglebot

C2

https://icq.im/AoLH5bRXfAE6eCtbw1I

https://t.me/zedezededeed

https://twitter.com/doplghas

Targets

    • Target

      base.apk

    • Size

      2.1MB

    • MD5

      282ba59582d916398073d7907effd023

    • SHA1

      065df5a64c110188349d15f6c537159c20088328

    • SHA256

      6098a436094f1e3e8721fb87ff36781a1a283711cc0388f608723a18132607c4

    • SHA512

      f8b5e5df21a250a3d25c37d7898df430914bca5e324ab30c92d692ebdcc406880daa340d7456782ca5ce165b1bfc22cbf072c36593b83fbda012bbab3eec4cf1

    • SSDEEP

      24576:WiE1gn4LroFyeEZe+Yw/ibT++Z5oqiH6bKD39t9s5gYUzfr2Wd4/C:sqn4X7Y/n++Z5rbKD3ls5gYUzfr2S

    • TangleBot

      TangleBot is an Android SMS malware first seen in September 2021.

    • TangleBot payload

    • Tanglebot family

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Mobile v15

Tasks