tanglebot | 1aae1e81737161f4db26824a61d8570b775dc882b4d30ecf428452810b63853f

Analysis

max time kernel
5s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aae1e81737161f4db26824a61d8570b775dc882b4d30ecf428452810b63853f.apk
Size

5.9MB
MD5

9f0cb7d6293cd253a6be2c1ae716dfea
SHA1

fa3fdb49ddf5baacca4f427c2c55790edfc08699
SHA256

1aae1e81737161f4db26824a61d8570b775dc882b4d30ecf428452810b63853f
SHA512

0fd8f52d5e56acd601b8d97e65728c31dba6b8384f1e0e4c4ffb14f387b0834fdc83b8572d452a573815b19188c7d701b4076a4301407019e832e08fa2dc3e1b
SSDEEP

98304:wENjmXd2ZrWmCKgOFqZDbD25aCHZkw/8J1YUfF6tQnI1YJG05O86HDevuQ9:RCb7CHqw/+15F6CI1QG05OlHDev39

Score

10^/10

tanglebot evasion infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4360-0.dex	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nerve.typical/app_DynamicOptDex/citLWHN.json	4360	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nerve.typical/app_DynamicOptDex/citLWHN.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.nerve.typical/app_DynamicOptDex/oat/x86/citLWHN.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.nerve.typical/app_DynamicOptDex/citLWHN.json	4335	com.nerve.typical

com.nerve.typical
1⤵
- Loads dropped Dex/Jar
PID:4335
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.nerve.typical/app_DynamicOptDex/citLWHN.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.nerve.typical/app_DynamicOptDex/oat/x86/citLWHN.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4360

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nerve.typical/app_DynamicOptDex/citLWHN.json

Filesize
1.8MB

MD5
79ec2f5470960e88342e31e37f2e6339

SHA1
4b7b6b4bc3143b8de54d6e957818e5b9a244f2d4

SHA256
408875ecbb1d3a6b0f7035ba4c14b55f0c748567ee892722a08592bb3643404d

SHA512
a03389a41f5f68f1af9f3d42bcac8bd800ffe843bcd1c5ddc797f0e2c39ce673c32bb4d16edfa34abbad5372071fb41fcf55a0160d1204f2ee86daa2d4524529

Download Submit
/data/data/com.nerve.typical/app_DynamicOptDex/citLWHN.json

Filesize
1.8MB

MD5
f3e4bf55883305913f8e458db0c0edc4

SHA1
eaf9988789255e20c6172a0e75eec3c351edef83

SHA256
7234224432c17341ab3b103dded0cc2e467dffcf4681c44b24ebfdc0fcbfba9a

SHA512
64359d97a4df80992d6db2f1b0588565058fda587e85eb01a3abc4ac252ddeb7651eda94b46f2509f6e3d264880dc60bdfaa76957225b17d0da8c691a9be931d

Download Submit
/data/user/0/com.nerve.typical/app_DynamicOptDex/citLWHN.json

Filesize
4.4MB

MD5
96d6eb28cdbf74ddc852bfa720af512a

SHA1
1af494f8bd096fa8ebd0aca8c62c65824e828e2d

SHA256
04352f02e616ab41792c8569af4c65c44de707d54c1e6ea3bda5dbed5ca76ffe

SHA512
735e337b6dea0b6fef6f4a7f258f5a3dab657e1815a2bb6bd62e63cd4ed3f587b67fbdd0eb83873852165d9f59e5ba4a38bf845d89ceadfa38e05659913b545c

Download Submit
/data/user/0/com.nerve.typical/app_DynamicOptDex/citLWHN.json

Filesize
4.4MB

MD5
8cf47b42d394e45a6083ea8fd0e1f39d

SHA1
0c493c72cc9b581cf4fa4977ec35b1ed240534ac

SHA256
8e08e56e4dac6827eac048c9684d1eb5f26b2dedb63359d0426e4fbe2a9b9923

SHA512
6d5442c225ac9ba911949acf3df46b887b3208b759659e399c4ad1c52bd162e9cf0933fde5e3539e6cf4dc23df1625728b85af17ff28c87e483bbb415db2e6b0

Download Submit