Overview

overview

10

Static

static

6

37172730db...41.apk

android-9-x86

10

37172730db...41.apk

android-10-x64

10

37172730db...41.apk

android-11-x64

10

Analysis

  • max time kernel
    100s
  • max time network
    152s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    26/03/2025, 22:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    37172730dbb1a6dd1ad846b32fd64d9b09b43ce2b9fe41d22f3c98e6cf39e241.apk

  • Size

    3.7MB

  • MD5

    3993d424e29a77ac1022d87a015f4841

  • SHA1

    53f5617ff33bf8014bce697bdce5c1dbf9d3d9f8

  • SHA256

    37172730dbb1a6dd1ad846b32fd64d9b09b43ce2b9fe41d22f3c98e6cf39e241

  • SHA512

    8b6ebf3aa7c4a11d0319313b8b7d3a89b239bda5f457aaffe1460ef0bb07b2f2270bdaba7c74da35db1fde5237ecc3f2de2b6c63c287ff86f46d02ec8939edec

  • SSDEEP

    98304:gTpRe6axXPeN8AeN8LWXMi+j8koAxWS6v3:Mp4PhNLcgkoIWSC3

Score
10/10
tanglebotbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencespywaretrojan

Malware Config

Extracted

Family

tanglebot

C2

https://t.me/+LFAFYjStX6wzZmFk

https://t.me/+s8bf3BX_dUYxMzU0

https://t.me/+sklwiGKlByJhZGM0

Signatures

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

    trojaninfostealerspywaretanglebot
  • TangleBot payload 2 IoCs
  • Tanglebot family
    tanglebot
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • dznixxl.xpxol.zmxpl
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4399
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/dznixxl.xpxol.zmxpl/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/dznixxl.xpxol.zmxpl/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4428

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/dznixxl.xpxol.zmxpl/code_cache/secondary-dexes/tmp-base.apk.classes2789785886451168679.zip
    Filesize

    455KB

    MD5

    75f7b5e317c80d3bd5e2325df2f633e8

    SHA1

    4c211635d5f9bbac15f3665d5795e5b70ec73c9c

    SHA256

    fa53a94830c1a7997bafe508b35472bc80ee04ab060ca0c0551eb974404a2d5c

    SHA512

    0d2bd52aa1b15e1695f847bf9739fe7394aa3a8847a81619c7d412d0ce895dd599bcf4f4f90b4989aed5011d1f8e95d54871557e71f87398ab09072f8d439d44

    Download Submit

  • /data/user/0/dznixxl.xpxol.zmxpl/code_cache/secondary-dexes/base.apk.classes1.zip
    Filesize

    951KB

    MD5

    b2aee8d96213dc6dda5c3d32c21a6184

    SHA1

    467861d9d29f0d5e982d3fbdae7637f023489fb0

    SHA256

    73aaba5db5b55ca54640b86886190cc495b25ecf348c6bd1fe37b374f3e95c46

    SHA512

    fa9e13c077231d7cf0494ff8553d10bd73b90f7526a126991d99ff15344e95b4fe1eac930a29df74747eb2bcf253696a1d302ed8bf0fa3b93523d9628dbdece6

    Download Submit

  • /data/user/0/dznixxl.xpxol.zmxpl/code_cache/secondary-dexes/base.apk.classes1.zip
    Filesize

    951KB

    MD5

    9cd92531bece8d391ab59d69498e3847

    SHA1

    1976fa73b62cab5faa8abb07044be85213c7f51c

    SHA256

    23027b31d3096aff8e805ab54d44fa5cfeb35ba1c44e8e70e0b3f5856b06d5da

    SHA512

    ca2509e0f26932c6817b5ece685741fe400aaee5e5cae1f14b418d5f9f31d4af8a5a506362d8177f17cf92bbbe170f90760e3d107d36277b0fb8ffa3244d443a

    Download Submit