Overview

overview

10

Static

static

6

28c47237b8...35.apk

android-9-x86

10

28c47237b8...35.apk

android-10-x64

10

28c47237b8...35.apk

android-11-x64

10

Analysis

  • max time kernel
    101s
  • max time network
    159s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    24/03/2025, 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    28c47237b8861c611cf6bdefc4acd8a0ddea5262c95542f608e01ffa56502b35.apk

  • Size

    4.5MB

  • MD5

    7f616d343f7c59044a025de341ccfc19

  • SHA1

    3c64f3f5fbf998c74e9664d741fc83e6437a5601

  • SHA256

    28c47237b8861c611cf6bdefc4acd8a0ddea5262c95542f608e01ffa56502b35

  • SHA512

    0814bb0179a7e19d00a9ff2600bb89ef4afb81c3f06919f56e50c00dd6b22c7d9c370dc5eb94228acd2d783a333291cd37749723be68d0917596d3d32f20389a

  • SSDEEP

    98304:Q/O7d9Xwfy9P95P6Rh3YnjW+iTzPRo0FdWfEgoUca7Sk4jJfTr:Q/Oveul3jGiiOoUcxk4jJrr

Score
10/10
tanglebotbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tanglebot

C2

https://icq.im/AoLH58pXY8ejJTQiWg8

https://t.me/pempeppepepep

https://t.me/xpembeppep2p2

Signatures

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot
  • TangleBot payload 2 IoCs
  • Tanglebot family
    tanglebot
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • zzumx.jzops.jkznw
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4274
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/zzumx.jzops.jkznw/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/zzumx.jzops.jkznw/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4302

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/zzumx.jzops.jkznw/code_cache/secondary-dexes/tmp-base.apk.classes4706697655656810150.zip
    Filesize

    455KB

    MD5

    54b5867d56fa3b39a0efa116fc010686

    SHA1

    998e39d9108a6efd851a78bd390bad9a51f4cc12

    SHA256

    ad387557c39cb4b4e9074365df4ea71b25ff9d2aedc596810a0109c3a63d824b

    SHA512

    9eabcf487000afedde5efda79ff66b469a85fa078b474c717ff2a418802abc226e17e3aa5a5a30e90eff5d9e042d5a2e104d1841f72271ee31c3827a6a72ee87

    Download Submit

  • /data/user/0/zzumx.jzops.jkznw/code_cache/secondary-dexes/base.apk.classes1.zip
    Filesize

    951KB

    MD5

    acded66485fbaac5ec363ad816233460

    SHA1

    1018cecd474077fabdb7a56a877a7f210e16e75d

    SHA256

    e6e23dc4840b71000dc76eb51b938182b4f8ce24cf821c7584199e4513a11765

    SHA512

    5c713abbf8c8060b428ca7511ac7fa93a7ce698755bef45ac3de7c8e5de3a74a7f50ca2a2094ad002bb867f6fd6c5d63f8459eff77aacebc9cda4a998bfe1b0b

    Download Submit

  • /data/user/0/zzumx.jzops.jkznw/code_cache/secondary-dexes/base.apk.classes1.zip
    Filesize

    951KB

    MD5

    59925e18a677c72f49e808da58d346e9

    SHA1

    608569a5e90bd52b88ba6200ce183a923c190f80

    SHA256

    d665b60695473e3abf5dfc38c0872bc93f36cf5da3b58773b950cc3aa0c5a73a

    SHA512

    3b20422d5becaf614279e7fc74bce5b7a4de42acac88f7affb767274b8de40e6c76fa123299a24f05a7d0a1c2cb3656b6e483652181f5b325528ecf939d4998d

    Download Submit