Analysis
-
max time kernel
19s -
max time network
152s -
platform
android-13_x64 -
resource
android-33-x64-arm64-20240910-en -
resource tags
arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system -
submitted
26/03/2025, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
f0605536d2a3bc8e57d978d71d596aeb.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
f0605536d2a3bc8e57d978d71d596aeb.apk
Resource
android-33-x64-arm64-20240910-en
Behavioral task
behavioral3
Sample
rex.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral4
Sample
rex.apk
Resource
android-x64-arm64-20240910-en
General
-
Target
f0605536d2a3bc8e57d978d71d596aeb.apk
-
Size
10.8MB
-
MD5
f0605536d2a3bc8e57d978d71d596aeb
-
SHA1
1c6c1fa65b0960e5ef9ec8c335c085ced70784db
-
SHA256
8764d9efce4330f29c1119364d395b37ebb980031b9aef29a9ee73502da9ed66
-
SHA512
b93a773c73a06b25d1fd1ee8d0c359ac5ff4d583acf355cabafd7dbc5095b7f50a3f8df60235592e6bc158eaf075b38e3bd7be7ad444686294ddc0ecc77e756b
-
SSDEEP
196608:RFX3a/isaGmdMsjym0IIwItorSCWdDDo6pqIswY8p/cswRoGFIQBsHKj:jKaJ3dMsj9rIwICrSrXZrXwOGFIUsHKj
Malware Config
Signatures
-
TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
-
TangleBot payload 1 IoCs
resource yara_rule behavioral2/files/fstream-1.dat family_tanglebot3 -
Tanglebot family
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.xinobideveloper.installer/app_mph_dex/apk.crazy-v1.AndroidManifest.xml 4498 com.xinobideveloper.installer
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
MD57ea973ca96f723638d634b907ab02a9f
SHA11162faeff741c4b554c90e69d6cb7d1f43ddf410
SHA2565743b752567f711668176290c4cc4742d92cf3583faa6c2573e93c0b08d231dd
SHA51242d49b51171dc95afe63d3a33a1f8a1efb464a2b597ced023c5e2bf418cdcbc33990a09514bfb5c942c8ee619fc94486a6f95396258b762fc6d17642b9a566cc