tanglebot | 17e9149885aa518abba17a8b1d674ae3b9da34c66cdb5e59e31cee051a227c96

Analysis

max time kernel
110s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
23/03/2025, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17e9149885aa518abba17a8b1d674ae3b9da34c66cdb5e59e31cee051a227c96.apk
Size

2.7MB
MD5

6b5a6df7fef23ce3cae8c6e46f15a028
SHA1

f2f0cfe1a5c725cfc5c2b78601d7725fec97c850
SHA256

17e9149885aa518abba17a8b1d674ae3b9da34c66cdb5e59e31cee051a227c96
SHA512

edf2fc515d5fa970e9b6f2aae6d48f26f6c4ae3d9e7134e63c52398a4e126e799df1002e160ab1f43ed33aa5cc913bd8edad897be69f984cf391310d8a170936
SSDEEP

49152:lLTk25NTUI+vBovne7MyL4WDqrdB6GByVUx5i6dpzaW1cwYwmJPM0:1TUHvyfe79MWqJ/taW1cQ8PM0

Score

10^/10

tanglebot banker collection credential_access defense_evasion discovery evasion impact infostealer spyware trojan

Malware Config

Extracted

Family

tanglebot

https://icq.im/AoLH58pXY8ejJTQiWg8

https://t.me/pempeppepepep

https://t.me/xpembeppep2p2

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral3/memory/4761-0.dex	family_tanglebot2

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/nerfs.abcbcm.gondr/code_cache/secondary-dexes/base.apk.classes1.zip	4761	nerfs.abcbcm.gondr

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	nerfs.abcbcm.gondr

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	nerfs.abcbcm.gondr

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	nerfs.abcbcm.gondr

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	nerfs.abcbcm.gondr

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	nerfs.abcbcm.gondr

nerfs.abcbcm.gondr
1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Checks CPU information
- Checks memory information
PID:4761

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/nerfs.abcbcm.gondr/code_cache/secondary-dexes/tmp-base.apk.classes5653262350247583032.zip

Filesize
455KB

MD5
d4af6e53c43e4a06b54bd3a99b51d4fa

SHA1
68050b081e5a7efcf02a936a372ba208830e1d91

SHA256
3fae6b93fd74cf433b9d6ae65e44e2a07d779609e8249e70af856007caeac568

SHA512
0d56c4fe9aaf01dbc7077709afccd3db73364a89a5c915595ca991edbbdacf961481819afc20ea8e4e5f978d29c53b0c8da021a695c6ed3bd8bb1e27c4558e8b

Download Submit
/data/user/0/nerfs.abcbcm.gondr/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
951KB

MD5
f12dd870e8b7b70b1f3fe173851cc38e

SHA1
9485b658de96242a91f8bd8c38a60b806d15cb3a

SHA256
83aceea93245d93cf24be4af99c909ac75bd93219844ecdd870210e4d43ec505

SHA512
6d31657963b0e369c12171dc1aee96ac07b642431d199c8ae26cd21a0e6ce21c91d85f671c1ca99e5682cb8206a6807bad36d1d0ccca008025e51301ceb5b81a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads