teabot | f313461db8938e4e65889817d4cde09835c6e4703d5014b7867f0914f7b33773

Analysis

max time kernel
1455508s
max time network
160s
platform
android_x86_64
resource
android-x86_64
submitted
10-05-2021 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Correos354.apk
Size

3.4MB
MD5

92cc082b345b2ac79bcb86f159543e89
SHA1

d23b2ebe25c9d6393bf5427aaf4f002752ece63e
SHA256

f313461db8938e4e65889817d4cde09835c6e4703d5014b7867f0914f7b33773
SHA512

694a4e5dca9533898a8918b5af4716a4bc7951c6846432075a418a31f61461efbf1736ab3d3be60ab79b69e95c64ded3ac5cb943eef3699484b19841e8c81daa

Score

10^/10

teabot banker infostealer obfuscation trojan

Malware Config

Signatures

TeaBot
TeaBot is an android banker first seen in January 2021.
banker trojan infostealer teabot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

wolf.pony.limb

ioc	pid	process
/data/user/0/wolf.pony.limb/app_DynamicOptDex/usrktm.json	3605	wolf.pony.limb
/data/user/0/wolf.pony.limb/app_DynamicOptDex/usrktm.json	3605	wolf.pony.limb

Uses reflection 28 IoCs

obfuscation

Processes:

wolf.pony.limb

description	pid	process
Invokes method java.lang.Object.getClass	3605	wolf.pony.limb
Invokes method android.content.res.AssetManager.addAssetPath	3605	wolf.pony.limb
Invokes method android.app.ContextImpl.getAssets	3605	wolf.pony.limb
Invokes method java.lang.Object.getClass	3605	wolf.pony.limb
Invokes method android.content.res.AssetManager.open	3605	wolf.pony.limb
Invokes method java.io.FilterInputStream.read	3605	wolf.pony.limb
Invokes method java.io.FilterInputStream.read	3605	wolf.pony.limb
Invokes method java.io.BufferedInputStream.read	3605	wolf.pony.limb
Invokes method java.lang.Object.getClass	3605	wolf.pony.limb
Invokes method java.io.BufferedInputStream.close	3605	wolf.pony.limb
Invokes method java.lang.Object.getClass	3605	wolf.pony.limb
Invokes method java.lang.String.getBytes	3605	wolf.pony.limb
Invokes method java.lang.Object.getClass	3605	wolf.pony.limb
Invokes method java.io.FileOutputStream.write	3605	wolf.pony.limb
Invokes method java.lang.Object.getClass	3605	wolf.pony.limb
Invokes method java.io.BufferedInputStream.close	3605	wolf.pony.limb
Invokes method java.lang.Object.getClass	3605	wolf.pony.limb
Invokes method java.io.FilterOutputStream.close	3605	wolf.pony.limb
Invokes method android.app.ActivityThread.currentActivityThread	3605	wolf.pony.limb
Acesses field android.app.ActivityThread.mPackages	3605	wolf.pony.limb
Invokes method java.lang.reflect.Field.get	3605	wolf.pony.limb
Invokes method java.lang.Object.getClass	3605	wolf.pony.limb
Invokes method java.lang.ref.Reference.get	3605	wolf.pony.limb
Invokes method java.lang.ref.Reference.get	3605	wolf.pony.limb
Acesses field android.app.LoadedApk.mClassLoader	3605	wolf.pony.limb
Invokes method java.lang.reflect.Field.get	3605	wolf.pony.limb
Acesses field android.app.LoadedApk.mClassLoader	3605	wolf.pony.limb
Invokes method android.os.SystemProperties.get	3605	wolf.pony.limb

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads