tanglebot | 1e3999f77e043954cc7638fdb481f07caa777da32bf3d72a80dd67567b82dc41

Analysis

max time kernel
91s
max time network
160s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
23/03/2025, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e3999f77e043954cc7638fdb481f07caa777da32bf3d72a80dd67567b82dc41.apk
Size

1.0MB
MD5

0a1f2dabacba4fe6c79443615c600ae4
SHA1

34e3df4bf369f02dfcad167ad0b49d0728eb1a5a
SHA256

1e3999f77e043954cc7638fdb481f07caa777da32bf3d72a80dd67567b82dc41
SHA512

314c606eebf89cd91721d59b2bfbc2782c256940e6023c461e9abf83b58fdf7e4d9669d23a9a700df358e1ba338fad66c1e5c9b0dce51d813de6bb951c15fda7
SSDEEP

24576:ddLTUwqRxcvAX8XcRmEoJzKLh+1z5UsQk:PLT6n8XVJVsQ11UsQk

Score

10^/10

tanglebot banker collection credential_access defense_evasion discovery evasion impact infostealer spyware trojan

Malware Config

Extracted

Family

tanglebot

https://icq.im/AoLH58pXY8ejJTQiWg8

https://t.me/pempeppepepep

https://t.me/xpembeppep2p2

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral3/memory/4807-0.dex	family_tanglebot2

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/ewon.nxgx.evilo/code_cache/secondary-dexes/base.apk.classes1.zip	4807	ewon.nxgx.evilo

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	ewon.nxgx.evilo

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ewon.nxgx.evilo

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	ewon.nxgx.evilo

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	ewon.nxgx.evilo

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ewon.nxgx.evilo

ewon.nxgx.evilo
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Checks CPU information
- Checks memory information
PID:4807

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/ewon.nxgx.evilo/code_cache/secondary-dexes/tmp-base.apk.classes5945463696465349056.zip

Filesize
455KB

MD5
d5ac1612c8c7e31f612065e7577f1725

SHA1
62a5dac0628036c8ca6b96414ff78e537be0e992

SHA256
f4547817889eba08465d8dbdcc5180b758cf1cb4e6aa3ab7de3f266d6700130e

SHA512
11fcd500b7aef2f7f524a95f122cf4cc1fcd8dd89f5a66fda2514d6e66a4c16534d3225cdfc9131725daddbaa0ec5a642ac37ddd600f8a31e3d31cd4104fc9c6

Download Submit
/data/user/0/ewon.nxgx.evilo/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
949KB

MD5
d2143ed14a2c66480e0bef1a2801b2cf

SHA1
7ec8664e50e73603542c84f3c4bc1629f69226a7

SHA256
5c9035e83894a344f493faa5a46fbc9385539736522f648a81a0bd5e23d145e1

SHA512
6b41c780e81fcf5e0004c2348562d00d22e971f8e7df130f78feeebb3cfa533f74b2b8a0dd09dac08d4041023aaf08ef69a437a7c453c9862d9e91b5d613a46b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads