tanglebot | 8764d9efce4330f29c1119364d395b37ebb980031b9aef29a9ee73502da9ed66

Analysis

max time kernel
8s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
26/03/2025, 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0605536d2a3bc8e57d978d71d596aeb.apk
Size

10.8MB
MD5

f0605536d2a3bc8e57d978d71d596aeb
SHA1

1c6c1fa65b0960e5ef9ec8c335c085ced70784db
SHA256

8764d9efce4330f29c1119364d395b37ebb980031b9aef29a9ee73502da9ed66
SHA512

b93a773c73a06b25d1fd1ee8d0c359ac5ff4d583acf355cabafd7dbc5095b7f50a3f8df60235592e6bc158eaf075b38e3bd7be7ad444686294ddc0ecc77e756b
SSDEEP

196608:RFX3a/isaGmdMsjym0IIwItorSCWdDDo6pqIswY8p/cswRoGFIQBsHKj:jKaJ3dMsj9rIwICrSrXZrXwOGFIUsHKj

Score

10^/10

tanglebot evasion infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xinobideveloper.installer/app_mph_dex/apk.crazy-v1.AndroidManifest.xml	4367	com.xinobideveloper.installer
/data/user/0/com.xinobideveloper.installer/app_mph_dex/apk.crazy-v1.AndroidManifest.xml	4441	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xinobideveloper.installer/app_mph_dex/apk.crazy-v1.AndroidManifest.xml --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xinobideveloper.installer/app_mph_dex/oat/x86/apk.crazy-v1.AndroidManifest.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.xinobideveloper.installer/app_mph_dex/apk.crazy-v1.AndroidManifest.xml	4367	com.xinobideveloper.installer

com.xinobideveloper.installer
1⤵
- Loads dropped Dex/Jar
PID:4367
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xinobideveloper.installer/app_mph_dex/apk.crazy-v1.AndroidManifest.xml --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xinobideveloper.installer/app_mph_dex/oat/x86/apk.crazy-v1.AndroidManifest.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4441

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.xinobideveloper.installer/app_mph_dex/apk.crazy-v1.AndroidManifest.xml

Filesize
4.4MB

MD5
7ea973ca96f723638d634b907ab02a9f

SHA1
1162faeff741c4b554c90e69d6cb7d1f43ddf410

SHA256
5743b752567f711668176290c4cc4742d92cf3583faa6c2573e93c0b08d231dd

SHA512
42d49b51171dc95afe63d3a33a1f8a1efb464a2b597ced023c5e2bf418cdcbc33990a09514bfb5c942c8ee619fc94486a6f95396258b762fc6d17642b9a566cc

Download Submit
/data/user/0/com.xinobideveloper.installer/app_mph_dex/apk.crazy-v1.AndroidManifest.xml

Filesize
4.4MB

MD5
e7f3f6d4264518c04c4a1d3c2ab1e4a2

SHA1
2b5145cc0723f6adf4cd67d39e1168e6684c7f5b

SHA256
93c6e3d42bc9dfee1fa6afe4045928323d170e8549830eba22032de20bee5b81

SHA512
dbb092854ad359d26cf62cb89b53693042c1e6f6e7c361852357955945a20df7a7e617a751b617c9e7fe6751c139661e5d1c0124821725d080ce641def4e44e4

Download Submit