tanglebot | 5b816dfb3d57947f7d6372ce1bce8126935a0989ca5d0cc0f311f173caff9ac6

Analysis

max time kernel
13s
max time network
161s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
23/03/2025, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b816dfb3d57947f7d6372ce1bce8126935a0989ca5d0cc0f311f173caff9ac6.apk
Size

2.7MB
MD5

80e282c6fb92b87af392eb28e230f5f1
SHA1

a54eecde8a2c50b7ded9825723c4ac758909f5c5
SHA256

5b816dfb3d57947f7d6372ce1bce8126935a0989ca5d0cc0f311f173caff9ac6
SHA512

33997b2fa51ce6acd2b49679d051bd26872ce27527fd1e061a8b2647af9d3d371e7f8f88dcea643415360128edf63fab3f1092354e4503342a764ec75e07f55e
SSDEEP

49152:lLTk25NTUI+vBovne7MyL4WDqrdB6GByVUx5i6dpzaW1cwYwmJPMv:1TUHvyfe79MWqJ/taW1cQ8PMv

Score

10^/10

tanglebot banker collection credential_access discovery evasion impact infostealer persistence spyware trojan

Malware Config

Extracted

Family

tanglebot

https://icq.im/AoLH58pXY8ejJTQiWg8

https://t.me/pempeppepepep

https://t.me/xpembeppep2p2

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/5093-0.dex	family_tanglebot2

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/nerfs.abcbcm.gondr/code_cache/secondary-dexes/base.apk.classes1.zip	5093	nerfs.abcbcm.gondr

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	nerfs.abcbcm.gondr

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	nerfs.abcbcm.gondr

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	nerfs.abcbcm.gondr

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	nerfs.abcbcm.gondr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	nerfs.abcbcm.gondr

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	nerfs.abcbcm.gondr

nerfs.abcbcm.gondr
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5093

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/nerfs.abcbcm.gondr/code_cache/secondary-dexes/tmp-base.apk.classes1297026363528463981.zip

Filesize
455KB

MD5
d4af6e53c43e4a06b54bd3a99b51d4fa

SHA1
68050b081e5a7efcf02a936a372ba208830e1d91

SHA256
3fae6b93fd74cf433b9d6ae65e44e2a07d779609e8249e70af856007caeac568

SHA512
0d56c4fe9aaf01dbc7077709afccd3db73364a89a5c915595ca991edbbdacf961481819afc20ea8e4e5f978d29c53b0c8da021a695c6ed3bd8bb1e27c4558e8b

Download Submit
/data/user/0/nerfs.abcbcm.gondr/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
951KB

MD5
f12dd870e8b7b70b1f3fe173851cc38e

SHA1
9485b658de96242a91f8bd8c38a60b806d15cb3a

SHA256
83aceea93245d93cf24be4af99c909ac75bd93219844ecdd870210e4d43ec505

SHA512
6d31657963b0e369c12171dc1aee96ac07b642431d199c8ae26cd21a0e6ce21c91d85f671c1ca99e5682cb8206a6807bad36d1d0ccca008025e51301ceb5b81a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads