tanglebot | bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544

Resubmissions

27/10/2025, 23:14

251027-271bhsay3h10

27/10/2025, 23:10

251027-25ypxabp4v10

Analysis

max time kernel
6s
max time network
29s
platform
android-9_x86
resource
android-x86-arm-20250917-en
resource tags

arch:armarch:x86image:android-x86-arm-20250917-enlocale:en-usos:android-9-x86system
submitted
27/10/2025, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544.apk
Size 9.6MB
Sample251027-271bhsay3h
SHA256 bf943e30db49a3e3f6172c3ff7737ea1cf6e7115af8a98d32888609f4c8a8544
MD5 5d5bdc01e860932b70709c8d87ce4216
SHA1 b9f27a7cfe591c6437f6e45c41f4b28c7ab4ac2c
SHA512 ff609380316878ffcde677a2803863fe21eb4baaca85574f8d862a394c5fe2782bd23521e23d7b9d566134549d92a94c2ebf35e0bcf97ffb57cee6f690c500d7
SSDEEP 196608:P6QxPtkowcPnPfbvqbCivnRhgj98NuO+JMYm:jVtktcPnPfWzG9xM/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion tanglebot infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/4253-0.dex	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.copy.helmet/app_surprise/bLb.json	4253	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.copy.helmet/app_surprise/bLb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.copy.helmet/app_surprise/oat/x86/bLb.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.copy.helmet/app_surprise/bLb.json	4227	com.copy.helmet

com.copy.helmet
1⤵
- Loads dropped Dex/Jar
PID:4227
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.copy.helmet/app_surprise/bLb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.copy.helmet/app_surprise/oat/x86/bLb.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4253

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bLb.json

Path /data/data/com.copy.helmet/app_surprise/bLb.json
Size 1.8MB
SHA256 332cc806a5dcfec3d6bde162ffc590718aee25b8bfe83969b8213fc383109127
MD5 c06637df67a8186bf61d0936b01342fd
SHA1 520a8ca81ee208e047c42ed63a854b4694bd4194
SHA512 8d37f572f972392b55e140520b75fe9802049d67c4df496d9ed291d690d4dc5f8a08c3dd6748885511ebb0f07c58c72d6eaa9bf5ebb03154217bca37668b6dbd
SSDEEP 49152:qNWK1313EdzkgC5yVqFmo914m8C57OqsnfuXGpue:aP3Edze5yM31V5CdfuA
MD5 SHA1 SHA512 SSDEEP

Submit Download

bLb.json

Path /data/data/com.copy.helmet/app_surprise/bLb.json
Size 1.8MB
SHA256 52f9ffc275b8a30e8f0fe6baa5a568e59cbef285e990b55fe805dcf5e13087b7
MD5 6278321a93bf921f1c725317440b7df4
SHA1 2549845d606a02086537ed916d810b27c42c0817
SHA512 1c8970db50523d14fccbddc291957e830695853674f0de78113083573c7740fc4e08f7b210e4ea0e61a3864c0aa638e3ea163eab389d4fa356207760419ab6af
SSDEEP 49152:5c5ja9OTariGiz4or/T/G1+CF28SCjKhTiFWSK0h9WlcOp1J3:5kaOarliEorK8CFICjKhTiIxKUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

bLb.json

Path /data/user/0/com.copy.helmet/app_surprise/bLb.json
Size 4.4MB
SHA256 f5911fc92f1e7dde8ce7ce9b46feb1ae80ffaa7df3fc9d8d956093cf70ead27d
MD5 b20a9acf9c42fb1c8e4664b9db5a8bda
SHA1 c20f51239f73debbd09fa1d4666772d60c3b966a
SHA512 d1555a1ba330ab7b5faf54a3300f6811eccef64aaffcd3bf6c02f4d87fc9b727825fba7cbfe60cf0036aebdcc6a5d802c539cb62e30b2ab3415c50a29ca32bcb
SSDEEP 49152:ITKZybIokybS0XGrK62pek88pmbTc34KazntAzgi/Kjp0111:YK4zma+K62peZbo3mnSd/aO1X
MD5 SHA1 SHA512 SSDEEP

Download

bLb.json

Path /data/user/0/com.copy.helmet/app_surprise/bLb.json
Size 4.4MB
SHA256 84d49b921132bf97c0798c7ea2d18e0f0b1a6fb4c742d5d831c2f3c1ed980a85
MD5 a5b9d6c81d2a0ed65f3f7c62d349fc3d
SHA1 8bdee763ca668ab274db65cdb9c487092e4c6731
SHA512 27eadb5da3df008466455ab3353d061e6adc2367e5e6396994844940566aecd8adf8019a9017bafcb62e8fc5844dd309c2fa9318120c24ee62caae35395519f3
SSDEEP 49152:ITKZybIokybS0XGrK62pek88pmbTc34KazntAzqItBddmhjp0111:YK4zma+K62peZbo3mnSvkO1X
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads