teabot | d778c50ddf8ccd41c7f9cdd913c38d90c7d0a59cb44e650068e671db6ce3e5ab

Analysis

max time kernel
1522256s
max time network
154s
platform
android_x86_64
resource
android-x86_64
submitted
11-05-2021 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shrimp.paddle.merit.apk
Size

3.7MB
MD5

49e960105bd79e726d5e89824798712d
SHA1

b6d825471c3045d62e8548d66efb836716930147
SHA256

d778c50ddf8ccd41c7f9cdd913c38d90c7d0a59cb44e650068e671db6ce3e5ab
SHA512

14c547c15c2ab9adc09e6a352b4f6887196c3a64a42ca5e8b9cbac5957916201448df714d8cbdbfa803a626d9a099244bfb606354f30ad392ea47a9460d04d17

Score

10^/10

teabot banker infostealer obfuscation trojan

Malware Config

Extracted

Family

teabot

http://lukabukazykasas.top:80/api/

http://lokaspitroaksi.top:80/api/

Signatures

TeaBot
TeaBot is an android banker first seen in January 2021.
banker trojan infostealer teabot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

shrimp.paddle.merit

ioc	pid	process
/data/user/0/shrimp.paddle.merit/app_DynamicOptDex/GhON.json	3608	shrimp.paddle.merit
/data/user/0/shrimp.paddle.merit/app_DynamicOptDex/GhON.json	3608	shrimp.paddle.merit

Uses reflection 28 IoCs

obfuscation

Processes:

shrimp.paddle.merit

description	pid	process
Invokes method java.lang.Object.getClass	3608	shrimp.paddle.merit
Invokes method android.content.res.AssetManager.addAssetPath	3608	shrimp.paddle.merit
Invokes method android.app.ContextImpl.getAssets	3608	shrimp.paddle.merit
Invokes method java.lang.Object.getClass	3608	shrimp.paddle.merit
Invokes method android.content.res.AssetManager.open	3608	shrimp.paddle.merit
Invokes method java.io.FilterInputStream.read	3608	shrimp.paddle.merit
Invokes method java.io.FilterInputStream.read	3608	shrimp.paddle.merit
Invokes method java.io.BufferedInputStream.read	3608	shrimp.paddle.merit
Invokes method java.lang.Object.getClass	3608	shrimp.paddle.merit
Invokes method java.io.BufferedInputStream.close	3608	shrimp.paddle.merit
Invokes method java.lang.Object.getClass	3608	shrimp.paddle.merit
Invokes method java.lang.String.getBytes	3608	shrimp.paddle.merit
Invokes method java.lang.Object.getClass	3608	shrimp.paddle.merit
Invokes method java.io.FileOutputStream.write	3608	shrimp.paddle.merit
Invokes method java.lang.Object.getClass	3608	shrimp.paddle.merit
Invokes method java.io.BufferedInputStream.close	3608	shrimp.paddle.merit
Invokes method java.lang.Object.getClass	3608	shrimp.paddle.merit
Invokes method java.io.FilterOutputStream.close	3608	shrimp.paddle.merit
Invokes method android.app.ActivityThread.currentActivityThread	3608	shrimp.paddle.merit
Acesses field android.app.ActivityThread.mPackages	3608	shrimp.paddle.merit
Invokes method java.lang.reflect.Field.get	3608	shrimp.paddle.merit
Invokes method java.lang.Object.getClass	3608	shrimp.paddle.merit
Invokes method java.lang.ref.Reference.get	3608	shrimp.paddle.merit
Invokes method java.lang.ref.Reference.get	3608	shrimp.paddle.merit
Acesses field android.app.LoadedApk.mClassLoader	3608	shrimp.paddle.merit
Invokes method java.lang.reflect.Field.get	3608	shrimp.paddle.merit
Acesses field android.app.LoadedApk.mClassLoader	3608	shrimp.paddle.merit
Invokes method android.os.SystemProperties.get	3608	shrimp.paddle.merit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads