tanglebot | 35dd4c361e44c9835da5312cc2543f614f506ddb13916c2b4a655056d5f85948

Resubmissions

08/01/2026, 11:33

260108-nn3ewaap3v10

08/01/2026, 11:15

260108-nclb8azrak10

Analysis

max time kernel
6s
max time network
32s
platform
android-9_x86
resource
android-x86-arm-20260104-en
resource tags

arch:armarch:x86image:android-x86-arm-20260104-enlocale:en-usos:android-9-x86system
submitted
08/01/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35dd4c361e44c9835da5312cc2543f614f506ddb13916c2b4a655056d5f85948.apk
Size 9.3MB
Sample260108-nclb8azrak
SHA256 35dd4c361e44c9835da5312cc2543f614f506ddb13916c2b4a655056d5f85948
MD5 702828fda8a372331423aa8e7141ceeb
SHA1 7de1c8d43229e5a6de0626c4b3f984a31a8e1878
SHA512 aeb535c631418288cec92563f4c3d2647d8d8949426728c1657795327dbd9dc16b451ed2b5248f78a38422549e43bf5debff444cb3bceaaf5a7ba1eca94efcb4
SSDEEP 196608:/+klVZ65dZynPFkzzDy6WNxIvsTXPVCmSKi9/pNjmU1F+oFocvI:9VZ65dsPFkzDyZSmSdSUz+oFocvI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion tanglebot infostealer spyware trojan

Malware Config

Signatures

TangleBot
TangleBot is an Android SMS malware first seen in September 2021.
trojan infostealer spyware tanglebot

TangleBot payload 1 IoCs

resource	yara_rule
behavioral2/memory/4224-0.dex	family_tanglebot3

Tanglebot family
tanglebot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ceiling.waste/app_orphan/fZIsEa.json	4224	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ceiling.waste/app_orphan/fZIsEa.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ceiling.waste/app_orphan/oat/x86/fZIsEa.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ceiling.waste/app_orphan/fZIsEa.json	4197	com.ceiling.waste

com.ceiling.waste
1⤵
- Loads dropped Dex/Jar
PID:4197
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ceiling.waste/app_orphan/fZIsEa.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.ceiling.waste/app_orphan/oat/x86/fZIsEa.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4224

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fZIsEa.json

Path /data/data/com.ceiling.waste/app_orphan/fZIsEa.json
Size 1.8MB
SHA256 d44f7655bafb537ee7dd2992fe8baaeff48a06bd4e8d57df9ea31440d52a76ce
MD5 4df8fb026b8b97f5543f5bec838f247d
SHA1 7d95974f7aaf19f8221d12f19f8d602021fb54aa
SHA512 3f14cfa075b6dfc6a19abfbb9baf3e96f1051696efe9d9d046ce291f24a2bfaa30ddc11dacfd58a396a131c4f1405f36cd600e9ca3dbad49181bebee211d8026
SSDEEP 49152:wF/uywr3E8QxLEUQJWKSraKchEmrjA+iY:wFeEvxLET0rajPiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

fZIsEa.json

Path /data/data/com.ceiling.waste/app_orphan/fZIsEa.json
Size 1.8MB
SHA256 0b8b640a0649f62279ae6ccb3fd1e624124156f08128da57c0b4e304b77c35cf
MD5 34475205b8943e58375b82f289708a6d
SHA1 d5dc546f715c9cecd2770206c050c83763087559
SHA512 d2b321837aab587221c4c7cc8006811b8ebe91d1282fb1ef1e18e2f238ce3e228437cddcb3c4a7df26c878743d9042325a287556f6a13f31ddb71abe9c4596dd
SSDEEP 49152:DORyrooEnPavIzDCPP+uqm9lJ2ou1qvK3Q:DOaooWPlCPP+u79lJ5u1qvKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

fZIsEa.json

Path /data/user/0/com.ceiling.waste/app_orphan/fZIsEa.json
Size 4.4MB
SHA256 b7d8e6b5e2c0fabae1404a8fe787f635ecd10f4d8e9625c288caf86d58f5b32d
MD5 2ce711aba622ef59d773337372a4b758
SHA1 b94ee55f06c05e0cc38a583513f7673d947af44b
SHA512 9a6f711cec3ee8315bc370570e32e7be72c9de6547485db25edc0ffb546356cea30f59dbbbdd8887c868981e39ecbb46920e9e291f5c5337e49c65bdd177551e
SSDEEP 49152:OO/HGbmtsABK62e+k88pmbTc34Ka3qtAd6/NM6EOD6:5/TtsABK62e+Zbo3KqSM/NM6Z6
MD5 SHA1 SHA512 SSDEEP

Download

fZIsEa.json

Path /data/user/0/com.ceiling.waste/app_orphan/fZIsEa.json
Size 4.4MB
SHA256 f5bd38ad7c40608c8404fbce90c41643e56bc91b0316da2ae232c457dfb0c0a8
MD5 046d6f1bab8a65042fb63a5c67a59f26
SHA1 969bdba1dcf3f559bd1db83d9b21abaafcf75aa3
SHA512 b3b27ac99c53c47f8477b57e4b0f6a8f2fcfd90e90f64b81f0bb88100107d0d106a539f4dfca79d4126f0d5afa445bb3543b201c056119093092004209130695
SSDEEP 49152:OO/HGbmtsABK62e+k88pmbTc34Ka3qtAdBeAlbbFnm+OD6:5/TtsABK62e+Zbo3KqSiQVmH6
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads