tanglebot | 1aae1e81737161f4db26824a61d8570b775dc882b4d30ecf428452810b63853f

Analysis

max time kernel
5s
max time network
24s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
21/03/2025, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aae1e81737161f4db26824a61d8570b775dc882b4d30ecf428452810b63853f.apk
Size

5.9MB
MD5

9f0cb7d6293cd253a6be2c1ae716dfea
SHA1

fa3fdb49ddf5baacca4f427c2c55790edfc08699
SHA256

1aae1e81737161f4db26824a61d8570b775dc882b4d30ecf428452810b63853f
SHA512

0fd8f52d5e56acd601b8d97e65728c31dba6b8384f1e0e4c4ffb14f387b0834fdc83b8572d452a573815b19188c7d701b4076a4301407019e832e08fa2dc3e1b
SSDEEP

98304:wENjmXd2ZrWmCKgOFqZDbD25aCHZkw/8J1YUfF6tQnI1YJG05O86HDevuQ9:RCb7CHqw/+15F6CI1QG05OlHDev39

Score

10^/10

tanglebot evasion infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4437-0.dex	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nerve.typical/app_DynamicOptDex/citLWHN.json	4437	com.nerve.typical

com.nerve.typical
1⤵
- Loads dropped Dex/Jar
PID:4437

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.nerve.typical/app_DynamicOptDex/citLWHN.json

Filesize
1.8MB

MD5
79ec2f5470960e88342e31e37f2e6339

SHA1
4b7b6b4bc3143b8de54d6e957818e5b9a244f2d4

SHA256
408875ecbb1d3a6b0f7035ba4c14b55f0c748567ee892722a08592bb3643404d

SHA512
a03389a41f5f68f1af9f3d42bcac8bd800ffe843bcd1c5ddc797f0e2c39ce673c32bb4d16edfa34abbad5372071fb41fcf55a0160d1204f2ee86daa2d4524529

Download Submit
/data/data/com.nerve.typical/app_DynamicOptDex/citLWHN.json

Filesize
1.8MB

MD5
f3e4bf55883305913f8e458db0c0edc4

SHA1
eaf9988789255e20c6172a0e75eec3c351edef83

SHA256
7234224432c17341ab3b103dded0cc2e467dffcf4681c44b24ebfdc0fcbfba9a

SHA512
64359d97a4df80992d6db2f1b0588565058fda587e85eb01a3abc4ac252ddeb7651eda94b46f2509f6e3d264880dc60bdfaa76957225b17d0da8c691a9be931d

Download Submit
/data/data/com.nerve.typical/app_DynamicOptDex/oat/x86_64/citLWHN.vdex

Filesize
65KB

MD5
471dbfb70e010ca4cc568942396deead

SHA1
5439d3dd5da26d91a6bbf4edcce3675b6a734e30

SHA256
da01221024c43de2f12e10c323a3ff870004054fe3c24b25de7d5ea1c9301691

SHA512
82f3c04a958c54d5c4c00980d68904ae7d0aa5c03fd5c788f44f90eeb381892b25be58eb78f72c3b3ea9047f18722b836c04eaf6ca6e557a24e34eddc3a08857

Download Submit
/data/user/0/com.nerve.typical/app_DynamicOptDex/citLWHN.json

Filesize
4.4MB

MD5
8cf47b42d394e45a6083ea8fd0e1f39d

SHA1
0c493c72cc9b581cf4fa4977ec35b1ed240534ac

SHA256
8e08e56e4dac6827eac048c9684d1eb5f26b2dedb63359d0426e4fbe2a9b9923

SHA512
6d5442c225ac9ba911949acf3df46b887b3208b759659e399c4ad1c52bd162e9cf0933fde5e3539e6cf4dc23df1625728b85af17ff28c87e483bbb415db2e6b0

Download Submit