Overview

overview

10

Static

static

6

b511f84da4...11.apk

android-9-x86

10

b511f84da4...11.apk

android-10-x64

10

b511f84da4...11.apk

android-11-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    167s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    25/03/2025, 22:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b511f84da489807100c2e2fa60cd8fab67ed99336b10e02444c59efb371e5a11.apk

  • Size

    3.6MB

  • MD5

    6a17967c055deefd8708b8af40602cf7

  • SHA1

    279b6a97c95d16a8e361e4f978a509da7d55f1ab

  • SHA256

    b511f84da489807100c2e2fa60cd8fab67ed99336b10e02444c59efb371e5a11

  • SHA512

    1910de1bbd6e050ae4a7f5dc160a1686eecfa2677e927f18d15ca4a8c321328a04b589b3b31effe8b993d491ae6a25ecd662a02626babf33d2bbc6e966da7c0c

  • SSDEEP

    98304:8HCh46Co/yj1+ME5CL8xWPe1x/X+UJCDQJmgT:kChv6j1+MdsYe1x/X+UJIQJTT

Score
10/10
tanglebotbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tanglebot

C2

https://t.me/+LFAFYjStX6wzZmFk

https://t.me/+s8bf3BX_dUYxMzU0

https://t.me/+sklwiGKlByJhZGM0

Signatures

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot
  • TangleBot payload 2 IoCs
  • Tanglebot family
    tanglebot
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • xzhiddn.ijikh.pjgu
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4298
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4328

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/tmp-base.apk.classes5563117157171748956.zip
    Filesize

    455KB

    MD5

    42681cdb297c6616afe51ccecc3cf921

    SHA1

    9432f62c18161af84a4b810d4495aaab3e824292

    SHA256

    17a9f078bd253df2d4565c6ab5b9bbcc9c8611f6403be9e8c69ec4397c15c0c4

    SHA512

    59f9bc31d47bc5c7cb0ae8e3bf3c2081d7d28395c39443aed995d5da1eca866f4f9f202715432628adb56a1db76aad9cb5af3fcfde43db04c69ae9ebfd2f6f9e

    Download Submit

  • /data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/base.apk.classes1.zip
    Filesize

    951KB

    MD5

    a2eeaef903d770e7f505918d77c462aa

    SHA1

    58f8c992a2ccd64905f6f767fd8ede671ba67239

    SHA256

    6af373ca9726427af5f0ba3938736b29efa207371809c757c5f452040f532d2e

    SHA512

    de8134041ac1d9d0cf4ed4fe09af26d20e5a525eb6d044a067f038895d1be9329d983b41ea6d1667dc2ebc442abd99f80509eadb4623aacaeb1c83296170a3af

    Download Submit

  • /data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/base.apk.classes1.zip
    Filesize

    951KB

    MD5

    a4ece24452f41bcc33f274fb702aabf3

    SHA1

    5d6f552929c88188b60f64dd6876271b9cae8cc6

    SHA256

    997e3a47478f03b79e9446f68a21d6e01b028a6cda72fc1c3298a0459cca2934

    SHA512

    49a154cd169ce532cbcacd537a1df79e9a7fb3ec794f2e6ae1249a42cd8186991a68491d8adc889f5ce06905a384e0b944d2f12d3bd0cd965b53eabd8dd04fbd

    Download Submit