tanglebot | b511f84da489807100c2e2fa60cd8fab67ed99336b10e02444c59efb371e5a11

Analysis

max time kernel
13s
max time network
137s
platform
android-10_x64
resource
android-x64-20240910-en
resource tags

arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
submitted
25/03/2025, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b511f84da489807100c2e2fa60cd8fab67ed99336b10e02444c59efb371e5a11.apk
Size

3.6MB
MD5

6a17967c055deefd8708b8af40602cf7
SHA1

279b6a97c95d16a8e361e4f978a509da7d55f1ab
SHA256

b511f84da489807100c2e2fa60cd8fab67ed99336b10e02444c59efb371e5a11
SHA512

1910de1bbd6e050ae4a7f5dc160a1686eecfa2677e927f18d15ca4a8c321328a04b589b3b31effe8b993d491ae6a25ecd662a02626babf33d2bbc6e966da7c0c
SSDEEP

98304:8HCh46Co/yj1+ME5CL8xWPe1x/X+UJCDQJmgT:kChv6j1+MdsYe1x/X+UJIQJTT

Score

10^/10

tanglebot banker collection credential_access discovery evasion impact infostealer persistence spyware trojan

Malware Config

Extracted

Family

tanglebot

https://t.me/+LFAFYjStX6wzZmFk

https://t.me/+s8bf3BX_dUYxMzU0

https://t.me/+sklwiGKlByJhZGM0

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/5069-0.dex	family_tanglebot2

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/base.apk.classes1.zip	5069	xzhiddn.ijikh.pjgu

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	xzhiddn.ijikh.pjgu

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

Application may abuse the accessibility service to prevent their removal.

evasion

Prevent Application Removal

T1629.001

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	xzhiddn.ijikh.pjgu

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	xzhiddn.ijikh.pjgu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	xzhiddn.ijikh.pjgu

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	xzhiddn.ijikh.pjgu

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	xzhiddn.ijikh.pjgu

xzhiddn.ijikh.pjgu
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5069

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Impair Defenses

T1629

Prevent Application Removal

T1629.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/tmp-base.apk.classes6767323124175689335.zip

Filesize
455KB

MD5
42681cdb297c6616afe51ccecc3cf921

SHA1
9432f62c18161af84a4b810d4495aaab3e824292

SHA256
17a9f078bd253df2d4565c6ab5b9bbcc9c8611f6403be9e8c69ec4397c15c0c4

SHA512
59f9bc31d47bc5c7cb0ae8e3bf3c2081d7d28395c39443aed995d5da1eca866f4f9f202715432628adb56a1db76aad9cb5af3fcfde43db04c69ae9ebfd2f6f9e

Download Submit
/data/user/0/xzhiddn.ijikh.pjgu/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
951KB

MD5
a4ece24452f41bcc33f274fb702aabf3

SHA1
5d6f552929c88188b60f64dd6876271b9cae8cc6

SHA256
997e3a47478f03b79e9446f68a21d6e01b028a6cda72fc1c3298a0459cca2934

SHA512
49a154cd169ce532cbcacd537a1df79e9a7fb3ec794f2e6ae1249a42cd8186991a68491d8adc889f5ce06905a384e0b944d2f12d3bd0cd965b53eabd8dd04fbd

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads