tanglebot | a12d7de16cf154591d3d3c155127d1d9339dcf28a652a9476841801aa9ad1af8

Resubmissions

13/05/2026, 04:09

260513-eqrlqagy8n

13/05/2026, 04:08

13/05/2026, 02:03

12/05/2026, 19:19

22/05/2025, 12:02

22/05/2025, 11:31

11/05/2025, 08:28

Analysis

max time kernel
6s
max time network
156s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
22/05/2025, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ICICI.apk
Size 15.6MB
Sample250522-n7e4pasry8
SHA256 a12d7de16cf154591d3d3c155127d1d9339dcf28a652a9476841801aa9ad1af8
MD5 630f5413b7bfaee2963fef2cc1f4ce14
SHA1 88d10444113bb3c7abda6d05e436cd5e094a90e4
SHA512 1851b81bace8d175c8538b3b21714cec27a5ecadd80782bbdfeaf3d433cf79207a9dafcce9484a57dbbd967d6c7bb7ca80bcdcde7fb8602e983e8c35d06ceb58
SSDEEP 393216:iTJNmS8mrpbWSZCBPJgl5X6oaifP3V0k7Dpz+Wh5:eJXoelaifRZCe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tanglebot evasion infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.statgame.gihk/files/arm/classes.dex	4751	com.statgame.gihk
/data/user/0/com.statgame.gihk/files/arm/classes.dex	4751	com.statgame.gihk

com.statgame.gihk
1⤵
- Loads dropped Dex/Jar
PID:4751

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/com.statgame.gihk/files/arm/classes.dex
Size 4.4MB
SHA256 4c1aceb3698a6b7c7c5080c15cc089374f42e18fc2f4164350bb9daea98ed363
MD5 896423006fd3fe7c4a7d3f43bc7b8340
SHA1 44f5f97420576332781b901b3dd777c23df5b9b1
SHA512 b6f5752740187471458cb22759b2ceeade6234adc11d9268faa09f41a56b2eb101e76cdb1fc04e883a45bdbf40ec44443753c5c1ed33b882c00ef366e757a1fe
SSDEEP 49152:FpmPxVH/NkbBK620Xk88pmbTc34KaY3itVFfUXkLSuviIe2rJ:2P/8BK620XZbo3x3yZv1l
MD5 SHA1 SHA512 SSDEEP

Submit Download