teabot | 5544cd6ad91d3455a859fca7f7d4bef4880ade24417da7b7d902ed07fea56711

Analysis

max time kernel
1391631s
max time network
185s
platform
android_x64
resource
android-x64
submitted
17-08-2021 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5544cd6ad91d3455a859fca7f7d4bef4880ade24417da7b7d902ed07fea56711.apk
Size

4.3MB
MD5

e00185fca0e0337042c9c11db10343db
SHA1

af6a58827370bc4a61c409aa25163d7da9d0505e
SHA256

5544cd6ad91d3455a859fca7f7d4bef4880ade24417da7b7d902ed07fea56711
SHA512

97402181ef2e1eb2912066b8c6028600b0d5b5d2ffce762d07a79cabfedd1ff3096250d35442914fa35feb0574039cb8e1f2ee1a65cab342d13913cbc47248da

Score

10^/10

teabot banker infostealer obfuscation trojan

Malware Config

Extracted

Family

teabot

http://138.201.211.36:84/api/

Signatures

TeaBot
TeaBot is an android banker first seen in January 2021.
banker trojan infostealer teabot

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

syrup.purpose.pull

ioc	pid	process
/data/user/0/syrup.purpose.pull/app_DynamicOptDex/kGLUIuw.json	3606	syrup.purpose.pull
/data/user/0/syrup.purpose.pull/app_DynamicOptDex/kGLUIuw.json	3606	syrup.purpose.pull
/product/app/webview/webview.apk	3606	syrup.purpose.pull
/product/app/webview/webview.apk	3606	syrup.purpose.pull

Uses reflection 2 IoCs

obfuscation

Processes:

syrup.purpose.pull

description	pid	process
Invokes method android.content.Context.bindServiceAsUser	3606	syrup.purpose.pull
Invokes method android.content.Context.bindServiceAsUser	3606	syrup.purpose.pull

syrup.purpose.pull
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:3606

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/syrup.purpose.pull/app_DynamicOptDex/kGLUIuw.json

MD5
3f60c28a4e5146407a42cf88c8bc5e03

SHA1
8bb72373579dfec4be1fccb4d9be973aa224d85e

SHA256
09140c5948f9e991b2118973dfc9908a55469da977ef408dd11bcafabfca3cad

SHA512
0d81e98567b35625a52dd0db57811763b3b415b9f835fff64a35f7531401bd2d347f7c82c51dac54a558d910d8b0d92c417590dbc9f3b9f70c4b78995cdeb554

Download Submit
/data/user/0/syrup.purpose.pull/app_DynamicOptDex/kGLUIuw.json

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/syrup.purpose.pull/app_DynamicOptDex/kGLUIuw.json

MD5
2886c014b69e42873f33a722c1315de3

SHA1
2b56db78d63e1a067cc019ac5cb62b2f6b13fbad

SHA256
024bca4851277854d8a9107a60fff5257c43933fe49ae4f106cbceb5f8b59b84

SHA512
eb5a86cd84e064f0b30669707ffe62528071307b1740c09475b5db58ba0c4cf7597d9b3a1271ad0242db549bb398f663c5e28c353c471681791eae49d869dd2e

Download Submit
/data/user/0/syrup.purpose.pull/app_DynamicOptDex/oat/kGLUIuw.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/syrup.purpose.pull/app_webview/GPUCache/index

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
/data/user/0/syrup.purpose.pull/app_webview/GPUCache/index-dir/temp-index

MD5
249255c7eebd68e6d0d44c4a4571b5ed

SHA1
86a2b314055f34d9a111cb74f067351a3c5c84e1

SHA256
7c302a546996ab9ab41569c089b9ec2d58318059187309ddaae2a71a07e82483

SHA512
e99deca1cbb2c0b20a72298bde22b661b10414ca0a47cee185534eddcad9d86cbd202110b648cf03cc005742ceda91a5cc1aeb02058d4487c6521019f1b62e97

Download Submit
/data/user/0/syrup.purpose.pull/app_webview/Web Data

MD5
dfea4f9a562d22c658ec695eca31ea04

SHA1
2e48be6baf86078d93f14fc38fe9f395c1c54261

SHA256
a01b4f35e09bbcdf9753512d4d3ac0b82c8e2f09e2176fa4a5c2523909795b2b

SHA512
8e0aab3c5f29a8737b4713b4a1622aa71b3574feabfb41a098f1326b80472c3fea053e759036c44df71aee1a8a1e9caf93f17a9eec88ab278062d7ed48907789

Download Submit
/data/user/0/syrup.purpose.pull/app_webview/Web Data-journal

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/syrup.purpose.pull/app_webview/metrics_guid

MD5
b438e76202f242008a130c730c14753f

SHA1
3378b703bca51e4869a8e6e2a9d775d49a5c1313

SHA256
5d13db71a7a9bfe22ee771cf5719df318566c0d1ed41147546b6af60ce319770

SHA512
e353cc53842f45f9a73dc790fd964d30241bdb9698701b19e5728ae730e5d1d6d5f024d50a194b7b7bb80b9514d194fc09a6528a21ab507b9a36f9729fda7900

Download Submit
/data/user/0/syrup.purpose.pull/app_webview/metrics_guid

MD5
b438e76202f242008a130c730c14753f

SHA1
3378b703bca51e4869a8e6e2a9d775d49a5c1313

SHA256
5d13db71a7a9bfe22ee771cf5719df318566c0d1ed41147546b6af60ce319770

SHA512
e353cc53842f45f9a73dc790fd964d30241bdb9698701b19e5728ae730e5d1d6d5f024d50a194b7b7bb80b9514d194fc09a6528a21ab507b9a36f9729fda7900

Download Submit
/data/user/0/syrup.purpose.pull/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/syrup.purpose.pull/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/syrup.purpose.pull/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/syrup.purpose.pull/cache/WebView/Crashpad/settings.dat

MD5
5e369f9d80cbfc7ee2fdad4845afa276

SHA1
c082524a08c99964d41ed66fa132f6b890707c87

SHA256
fff17e9b2b26cfbc91038e4a4ebdc2068874126db5dfbb723e51000c915a6b99

SHA512
1fad01c0fe1dea25e6011d25ed73b0f8da4bb79856b66f4cc1fb82790f4e68800f51ca11d0316eede67dce1bccc058aacc72e043465b65019d03b6a07e9e9378

Download Submit
/data/user/0/syrup.purpose.pull/cache/org.chromium.android_webview/Code Cache/js/index

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
/data/user/0/syrup.purpose.pull/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

MD5
59e8e8a92f1e7889eb1bf00ecebfbe32

SHA1
e00905d342684a0e831967847b46f6f57b06ba7b

SHA256
3a739587062e9a4bb1b77c80c0c89a1a1d6a989960cd8f6341e3b7a0e8702c68

SHA512
a592265a2412e87d5e9eb6179b28dc17f57f3ef2b8956758a87876205dd5540b3256ee723cee5e327738c2cc78c4899339a2dc0ed4a955b0d31d156fcc2faac8

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/WebViewChromiumPrefs.xml

MD5
1357a1d7af06755d561a7ed916373baf

SHA1
4a0a0d8b4b81bba92924dd7cf53a44d438312729

SHA256
647f3960ac648b24a8d9fa17f93f625437bd6f385636c56f10fefdd9cd447597

SHA512
61f15a595e21cb7cbf0b1a5268da72b39ce767e43195b4b1a607125e6e1d3237aa382cffbeb122bee9111f01a61ed4aebc2bef6fa646891f43154b01c32d05d4

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
7b45b018257e3d59f4bfca4de8b92181

SHA1
8610802043edc3fed66888b8a0a50b67d5587578

SHA256
1dfcd6ea1af92647abfd4d1336317323c7230d2409fd88ef323c40278f758a99

SHA512
b83d2c2c2b06ef07649b197fe2d8bbac83c0f901917b1e9e2840efe02d9247581b240b7ddbd68e0e637dbd017d49d174e483e6baaeb4529d6471c4ecc1eb3645

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
75041365673b67d069ea5e72824eb6d4

SHA1
9dcf363ef322ed7b62aa0fa533d69750c60cdba5

SHA256
f3d1308539ce09c3f7159bf630f4bf15dd7fa01ac9e30853b513b87763a16689

SHA512
4e8b61504a9defee73c592141b9e3c430fb08eb26230936e7beead4ea8d1da3a787fdcb9d937be3bd0e1f0823944ea0cb23fb506e467219a64a526bd87c5b412

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
a7386bbd7240550d614a4999386ced4c

SHA1
858966f585c629fd34a38a1e75306a263a7e6c68

SHA256
c059af20f944d838320da58e1cd4da1db0c1a5333d7339f39e7fdc9f7f5da9d4

SHA512
4867a6db63bed413d80f0df16265314adac7a86eed607ab88c0233e558901b20fa6fb928f264d4c58da1b11c44553898880ed53408dc80c68061aa9220f81dbb

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
a0122f56ba8281dc58b7bc6507ed6b7a

SHA1
db7aca403f23316752aa67353861427fd8d5d8d8

SHA256
4faa0083ae7bfe544d0cd63d6499813cbce73449d0bea835e83221a31c43d1d2

SHA512
be8b5169ef6a614176c730954985f6ccc23c424ebea0c5b1e5e6a1d6dc42a2549feb60995675c78347df09c41e04c9cb9d5426c5c80173d0a4b9ab35f3baeadf

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
52ba59d761ae79658c311f3a526e1a82

SHA1
70e73b3969a7072ab05c5e855bd2e5b243f902a3

SHA256
7d4f4df6316ee5af249c571f29bcfc2ba90dd3bccf572dcc074f239a798d3cf4

SHA512
c36ea40cf3fa94738db6abbfa98d79a6c56733d195cffe5cac8f40e8378f94869b95e981b1465a053e8af29d742e5083a66f358b6175fdc83488820b1f816e97

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
9795abd37c05725bfcf1438e48649f06

SHA1
83abea8d13b3abd16977ba20638ecb6b75e6a9fa

SHA256
44b5bee241e79a08f168b7cd1d1b7294ed3f8659efe80e9f074dcfbd1e935c71

SHA512
7b60428e5bc92ba205f1003a08dc194f6f95871b459d0aca46ede6736033022f090f8611f253cf97dca1f093c3569c4afaf6c59050f1971de6a14bbe0e6473f3

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
a26bcd1675d13c7422839bcf6aae875b

SHA1
f9d36fe70b0ea40665734b0a45f1bacff26b5ef8

SHA256
d34d37083200219349e710aed699dacd700274ff1ba500555101ff90c8be4d16

SHA512
2654d937e569e7664dfbd50339bae9e282e814fe0c75f9ca01075ef3e648e045a8935d4055e5b3714348915a3dc1c3f3f7c909e7f475c5bca129d7972dadb187

Download Submit
/data/user/0/syrup.purpose.pull/shared_prefs/config.xml

MD5
da7e2e1076c5561c4fc855af749b0441

SHA1
827def43052b16448396ca9f251fb74abb21d01e

SHA256
87d2a604d42d5ec3c8d2e481d98ae894891373a553d37414d7c763f102e34e3a

SHA512
881c4877af9b23e5c33cea3993425743e54713187d1f6a7ac430286de48a982eae842e2098f97daf260be05aeb93701265f735fc2a749eed4bcf924d60f20692

Download Submit
/product/app/webview/webview.apk

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/product/app/webview/webview.apk

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit