Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
153s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
29/01/2025, 22:00
General
-
Target
26f9d006961132dcc7d45af6ab2deeb857155d53acb005971d5de9abfc64b99c.apk
-
Size
4.6MB
-
MD5
7fcf49ac27d4d26d009e59e40c6ef42c
-
SHA1
6f95724243e934c2588e1bca18d3aad5552ed788
-
SHA256
26f9d006961132dcc7d45af6ab2deeb857155d53acb005971d5de9abfc64b99c
-
SHA512
ed2198e767dad277d44f2e0ece220e85220a2375c6210a6adbd0b62abcaacac5620fc1f45849cd320e5b833cceb61f50475b73cf51713c4b6dfe665f56e3683d
-
SSDEEP
98304:GutqxFjyktx8EqiRa9ChUN7mUaHOlsH9SZIf1qaXcC:pQjykcNn9CuMUU9SCdqasC
Malware Config
Extracted
tanglebot
https://t.me/+ZJAj-vCkxkE4N2E0
https://t.me/+jz7SONzTmCI0YmM0
https://t.me/+saoiPgiTyD1iZDBk
Signatures
-
TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
-
TangleBot payload 1 IoCs
-
Tanglebot family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
yyd.lvbn.orra1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
455KB
MD57f82e38e3e286dc6ae8446cfe44e2488
SHA17088892e009a65497427933032accd2fd55384ee
SHA2565a04ae773605cc2fa8af7c22865db5b1ef4dc7dcdeeedb97ebd9d301199b5f22
SHA5121140106a049f5f3db2f4d18051b910bedde6cc9676fdde4d613bbcd04a9a19829439aa2321ed539491b7c340a693466e7a98e146ac01720c33877f7e867f2785
-
Filesize
949KB
MD5a71e6af4a9cd29bb049faa046222e01e
SHA17758128c2cc5d3ba024f3450670b7a7d6f6aa2cb
SHA256d1de395fb9e5acd84aa9223515206045eeb191302144d2ebd5f7121459a3fa65
SHA5129d5942748a279c77d398aff6749c4fbdc3a0b5e3dfaefbe0d639396ae8fb804ca8812b3f303cc69eaa22c71d1b2b75ef8e6a83d953e5025e09af5fb52b4f1e34