Tango analysis

Tango is a voice-/text-/video-messaging application. It has over 100,000,000 downloads in the Play Store.

Package name: com.sgiggle.production

Note

This package name is seemingly innocuous and could be overlooked by an examiner thinking it was a game. This is an example of why every application should be analyzed.

Version: 3.13.128111

Files of interest:

• /sdcard/Android/data/com.sgiggle.production/files/storage/appdata/

  • TCStorageManagerMediaCache_v2/

  • conv_msg_tab_snapshots/

• /files/

  • tc.db

  • userinfo.xml.db

The /TCStorageManagerMediaCache_v2 path on the SD card contains images that were sent and received with the application as well as profile pictures of contacts. However, it also contains many images that were never seen or used in the application. They appear to either be images for ads or stock emoji-type images that can be attached to conversations. The filenames found here can be correlated with tc.db to find the exact image that was used in a conversation.

The conv_msg_tab_snapshots...