Extracted

• • Target

    b1675c9cb796a0390983db7dd05d09eede378b42df53ce87deb7a528e63c7104.bin

  • Size

    4.2MB

  • MD5

    c42c41730b49ec1d4e39360e06d261e3

  • SHA1

    cfc7232d46632f764f38888c040c886c711cb935

  • SHA256

    b1675c9cb796a0390983db7dd05d09eede378b42df53ce87deb7a528e63c7104

  • SHA512

    22f27d829c67b1bb3af3d367fa8b07d0cda86eb8f199bf97b1ad3d1b1f3acfad492e2ab1627354f84cdfede7f6143aafdc955043ffc7c81235c56aa9b0edbe09

  • SSDEEP

    98304:u38ZqvYrO/TcvKPjae6gTHLak9K8Zo6tKdkTMaTj2bzsOg1IN:e8ZqvogqQa/gT2kAwtK2TMMj2XsOgSN

  Score

  10^/10

  tanglebotbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencespywaretrojan

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot

  • TangleBot payload

  • Tanglebot family

    tanglebot

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2behavioral3