Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    25/03/2025, 22:01

General

  • Target

    157cd42754b90779792182a2f82cdb29d9a032f13e240316ff323cb873c299e0.apk

  • Size

    3.6MB

  • MD5

    05577929f8039455b564903620af37bb

  • SHA1

    50bf043253d499d8c281d452597649196b4469a3

  • SHA256

    157cd42754b90779792182a2f82cdb29d9a032f13e240316ff323cb873c299e0

  • SHA512

    8aa0f357e1dd30c4932cac1d088a63bc8ee06db47e4060e5b8361278033044be05866cadd73db90d6e0029e7a00e84f2b8ea742dd98ad98f50991fafc8317e58

  • SSDEEP

    98304:8HCh46Co/yj1+ME5CL8xWPe1x/X+UJCDQJmgz:kChv6j1+MdsYe1x/X+UJIQJTz

Malware Config

Extracted

Family

tanglebot

C2

https://t.me/+LFAFYjStX6wzZmFk

https://t.me/+s8bf3BX_dUYxMzU0

https://t.me/+sklwiGKlByJhZGM0

Signatures

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

  • TangleBot payload 2 IoCs
  • Tanglebot family
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • xzhiddn.ijikh.pjgu
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4261
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4290

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/tmp-base.apk.classes6089066595647793119.zip

    Filesize

    455KB

    MD5

    42681cdb297c6616afe51ccecc3cf921

    SHA1

    9432f62c18161af84a4b810d4495aaab3e824292

    SHA256

    17a9f078bd253df2d4565c6ab5b9bbcc9c8611f6403be9e8c69ec4397c15c0c4

    SHA512

    59f9bc31d47bc5c7cb0ae8e3bf3c2081d7d28395c39443aed995d5da1eca866f4f9f202715432628adb56a1db76aad9cb5af3fcfde43db04c69ae9ebfd2f6f9e

  • /data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    951KB

    MD5

    a2eeaef903d770e7f505918d77c462aa

    SHA1

    58f8c992a2ccd64905f6f767fd8ede671ba67239

    SHA256

    6af373ca9726427af5f0ba3938736b29efa207371809c757c5f452040f532d2e

    SHA512

    de8134041ac1d9d0cf4ed4fe09af26d20e5a525eb6d044a067f038895d1be9329d983b41ea6d1667dc2ebc442abd99f80509eadb4623aacaeb1c83296170a3af

  • /data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    951KB

    MD5

    a4ece24452f41bcc33f274fb702aabf3

    SHA1

    5d6f552929c88188b60f64dd6876271b9cae8cc6

    SHA256

    997e3a47478f03b79e9446f68a21d6e01b028a6cda72fc1c3298a0459cca2934

    SHA512

    49a154cd169ce532cbcacd537a1df79e9a7fb3ec794f2e6ae1249a42cd8186991a68491d8adc889f5ce06905a384e0b944d2f12d3bd0cd965b53eabd8dd04fbd