tanglebot | 3bb05c8c6865a071ad4c293811c8fdd7580e33e0d5483db33082172c8bc2cc73

Analysis

max time kernel
5s
max time network
27s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
21/03/2025, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bb05c8c6865a071ad4c293811c8fdd7580e33e0d5483db33082172c8bc2cc73.apk
Size

8.4MB
MD5

bd00428d52ab48809177b61b90e45685
SHA1

75ea7f94ca74fcba014cf90f488212748b9063a4
SHA256

3bb05c8c6865a071ad4c293811c8fdd7580e33e0d5483db33082172c8bc2cc73
SHA512

40a51692e46339ec22f172f14ffe1a5fd828af161263ffb583e552b74b354dca89bc0150d63d56adc561fa8863f1abd2f706eee391fb63e933e47539bae2e108
SSDEEP

196608:KCCmOLs2ptAniW6ffltjuCD4bXWU3JAyuYdvJ546VI7:imj2ptaz6XvNDaGIAW54F

Score

10^/10

tanglebot evasion infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/4241-0.dex	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.industry.advice/app_time/CRYr.json	4241	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.industry.advice/app_time/CRYr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.industry.advice/app_time/oat/x86/CRYr.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.industry.advice/app_time/CRYr.json	4216	com.industry.advice

com.industry.advice
1⤵
- Loads dropped Dex/Jar
PID:4216
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.industry.advice/app_time/CRYr.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.industry.advice/app_time/oat/x86/CRYr.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4241

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.industry.advice/app_time/CRYr.json

Filesize
1.8MB

MD5
84bc67165f4587a6ba4e86bbfe1024e2

SHA1
c4f47acb82bd42c76c0b8f4eedb387495e47238f

SHA256
1cce843a2fed56cebd7f40c4d67c25310ca12dcf7e60e3e258ef28a4cf0d5810

SHA512
ad165ca851b7085fa6a769ce1d68f49da530d8bac6dd2b4db758b7ca0bfba3c542b6f89e1322c6725607c22d72883a1796a29165576578e765e8c745ae49a9a5

Download Submit
/data/data/com.industry.advice/app_time/CRYr.json

Filesize
1.8MB

MD5
9d2e1caf3b6ffd53e5e92caf0040dac4

SHA1
d242d9331ffe3fbf989f040bd93f517e34967a68

SHA256
4b7ee80e7397761bd8adb35acf623beb1f4796bfacabfdb120a29201966f612a

SHA512
4d176ac2a0e345b27a65338b8f041e1f2fcacf9ac7fafc5568397200fd20fabf9a0df7cb7de268b033c36d7732dff6376291ea76e092042542cf75fbf0816321

Download Submit
/data/user/0/com.industry.advice/app_time/CRYr.json

Filesize
4.4MB

MD5
04b4aad39dbf1fd299e94886a33741a3

SHA1
40f3f4c6919006e7b29c1392e1aff8bff997667b

SHA256
7e5b6e619c77c96441b6870a8f021c1f76438f61f52596054367978b6d6bf3f7

SHA512
ea757ac8aacefcd5419b99b4f5d37aa5a09d8e996e765620dcbbb884b18fa4a5192f74e9ac91ddcbee4ae3dc54fd31239cb490e276b7b1d22c0475b4f1a9ff23

Download Submit
/data/user/0/com.industry.advice/app_time/CRYr.json

Filesize
4.4MB

MD5
0009ff27e902dd76ee55b0eee4ae06dd

SHA1
acc410719411b49897dd262ac326bff859308f66

SHA256
ff18034aeda156280384f0871c3ad2f2d7a4353416256a23d7596241dbee54e8

SHA512
e3663666ff378b0ca83936afa53adefe5fd7a529558052b16afa48d771f20c8408626fed838bef3735465232a100403bd7028bbfc4c9cd04eea0f779ccf58d61

Download Submit