tanglebot | 3bb05c8c6865a071ad4c293811c8fdd7580e33e0d5483db33082172c8bc2cc73

Analysis

max time kernel
5s
max time network
27s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
21/03/2025, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb05c8c6865a071ad4c293811c8fdd7580e33e0d5483db33082172c8bc2cc73.apk
Size

8.4MB
MD5

bd00428d52ab48809177b61b90e45685
SHA1

75ea7f94ca74fcba014cf90f488212748b9063a4
SHA256

3bb05c8c6865a071ad4c293811c8fdd7580e33e0d5483db33082172c8bc2cc73
SHA512

40a51692e46339ec22f172f14ffe1a5fd828af161263ffb583e552b74b354dca89bc0150d63d56adc561fa8863f1abd2f706eee391fb63e933e47539bae2e108
SSDEEP

196608:KCCmOLs2ptAniW6ffltjuCD4bXWU3JAyuYdvJ546VI7:imj2ptaz6XvNDaGIAW54F

Score

10^/10

tanglebot evasion infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4488-0.dex	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.industry.advice/app_time/CRYr.json	4488	com.industry.advice

com.industry.advice
1⤵
- Loads dropped Dex/Jar
PID:4488

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.industry.advice/app_time/CRYr.json

Filesize
1.8MB

MD5
84bc67165f4587a6ba4e86bbfe1024e2

SHA1
c4f47acb82bd42c76c0b8f4eedb387495e47238f

SHA256
1cce843a2fed56cebd7f40c4d67c25310ca12dcf7e60e3e258ef28a4cf0d5810

SHA512
ad165ca851b7085fa6a769ce1d68f49da530d8bac6dd2b4db758b7ca0bfba3c542b6f89e1322c6725607c22d72883a1796a29165576578e765e8c745ae49a9a5

Download Submit
/data/data/com.industry.advice/app_time/CRYr.json

Filesize
1.8MB

MD5
9d2e1caf3b6ffd53e5e92caf0040dac4

SHA1
d242d9331ffe3fbf989f040bd93f517e34967a68

SHA256
4b7ee80e7397761bd8adb35acf623beb1f4796bfacabfdb120a29201966f612a

SHA512
4d176ac2a0e345b27a65338b8f041e1f2fcacf9ac7fafc5568397200fd20fabf9a0df7cb7de268b033c36d7732dff6376291ea76e092042542cf75fbf0816321

Download Submit
/data/data/com.industry.advice/app_time/oat/x86_64/CRYr.vdex

Filesize
65KB

MD5
99773ccfc6c39a33cccb150307083966

SHA1
f6e16244798de45eb9e6252c2f702c2ef5e88cac

SHA256
0c5ca7c33d1d2dbf05003b43752cd5aabe251ac72e482bdbed6f7a013a7657db

SHA512
836cf4cee5a6cf3cfd3b8a89650494cec209cfe7ba09b274e8e75e86bfde0eda178470b800685a5aa5176fc1d91155492948c5071d7a716ab888ba7b205e3cf3

Download Submit
/data/user/0/com.industry.advice/app_time/CRYr.json

Filesize
4.4MB

MD5
0009ff27e902dd76ee55b0eee4ae06dd

SHA1
acc410719411b49897dd262ac326bff859308f66

SHA256
ff18034aeda156280384f0871c3ad2f2d7a4353416256a23d7596241dbee54e8

SHA512
e3663666ff378b0ca83936afa53adefe5fd7a529558052b16afa48d771f20c8408626fed838bef3735465232a100403bd7028bbfc4c9cd04eea0f779ccf58d61

Download Submit