tanglebot | bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544

Resubmissions

27/10/2025, 23:14

251027-271bhsay3h10

27/10/2025, 23:10

251027-25ypxabp4v10

Analysis

max time kernel
6s
max time network
33s
platform
android-13_x64
resource
android-33-x64-arm64-20250917-en
resource tags

arch:arm64arch:x64image:android-33-x64-arm64-20250917-enlocale:en-usos:android-13-x64system
submitted
27/10/2025, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544.apk
Size 9.6MB
Sample251027-271bhsay3h
SHA256 bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544
MD5 5d5bdc01e860932b70709c8d87ce4216
SHA1 b9f27a7cfe591c6437f6e45c41f4b28c7ab4ac2c
SHA512 ff609380316878ffcde677a2803863fe21eb4baaca85574f8d862a394c5fe2782bd23521e23d7b9d566134549d92a94c2ebf35e0bcf97ffb57cee6f690c500d7
SSDEEP 196608:P6QxPtkowcPnPfbvqbCivnRhgj98NuO+JMYm:jVtktcPnPfWzG9xM/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion tanglebot infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4233-0.dex	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.copy.helmet/app_surprise/bLb.json	4233	com.copy.helmet

com.copy.helmet
1⤵
- Loads dropped Dex/Jar
PID:4233

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bLb.json

Path /data/data/com.copy.helmet/app_surprise/bLb.json
Size 1.8MB
SHA256 332cc806a5dcfec3d6bde162ffc590718aee25b8bfe83969b8213fc383109127
MD5 c06637df67a8186bf61d0936b01342fd
SHA1 520a8ca81ee208e047c42ed63a854b4694bd4194
SHA512 8d37f572f972392b55e140520b75fe9802049d67c4df496d9ed291d690d4dc5f8a08c3dd6748885511ebb0f07c58c72d6eaa9bf5ebb03154217bca37668b6dbd
SSDEEP 49152:qNWK1313EdzkgC5yVqFmo914m8C57OqsnfuXGpue:aP3Edze5yM31V5CdfuA
MD5 SHA1 SHA512 SSDEEP

Submit Download

bLb.json

Path /data/data/com.copy.helmet/app_surprise/bLb.json
Size 1.8MB
SHA256 52f9ffc275b8a30e8f0fe6baa5a568e59cbef285e990b55fe805dcf5e13087b7
MD5 6278321a93bf921f1c725317440b7df4
SHA1 2549845d606a02086537ed916d810b27c42c0817
SHA512 1c8970db50523d14fccbddc291957e830695853674f0de78113083573c7740fc4e08f7b210e4ea0e61a3864c0aa638e3ea163eab389d4fa356207760419ab6af
SSDEEP 49152:5c5ja9OTariGiz4or/T/G1+CF28SCjKhTiFWSK0h9WlcOp1J3:5kaOarliEorK8CFICjKhTiIxKUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

bLb.vdex

Path /data/data/com.copy.helmet/app_surprise/oat/x86_64/bLb.vdex
Size 65KB
SHA256 5042713768d7d3a539e01385d1b259a262f4935e6d5b30bdd5f8d6e384f8066c
MD5 ca361505eb855cf0ce1d61d79461b44f
SHA1 882531022a91798c6fe52105be39ebdbde86acd9
SHA512 27c6a2d8c968b31a03f89323334c14231cd742483c73d72157c31eeb3353e49d9a208cccc4ba7852a388ba3640eeb2006bfa2edd3d4a5a733364fe1fbb199b7f
SSDEEP 1536:q1RRfe+cZ2+Vt3yG6bZZ7GPgpts5aYMRXqSBmjpJ4C+Yahy73VzuDk:x2+Vt3yG6bZZ7GPgbcSXqSB8fkYL73Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

bLb.json

Path /data/user/0/com.copy.helmet/app_surprise/bLb.json
Size 4.4MB
SHA256 84d49b921132bf97c0798c7ea2d18e0f0b1a6fb4c742d5d831c2f3c1ed980a85
MD5 a5b9d6c81d2a0ed65f3f7c62d349fc3d
SHA1 8bdee763ca668ab274db65cdb9c487092e4c6731
SHA512 27eadb5da3df008466455ab3353d061e6adc2367e5e6396994844940566aecd8adf8019a9017bafcb62e8fc5844dd309c2fa9318120c24ee62caae35395519f3
SSDEEP 49152:ITKZybIokybS0XGrK62pek88pmbTc34KazntAzqItBddmhjp0111:YK4zma+K62peZbo3mnSvkO1X
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads