teabot | 8cb27f6fbcbcb106b713c1419e59a51e7b1462ea37e75afe033fe0cafbfbac5b

Analysis

max time kernel
3301241s
max time network
187s
platform
android_x64
resource
android-x64
submitted
08-09-2021 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cb27f6fbcbcb106b713c1419e59a51e7b1462ea37e75afe033fe0cafbfbac5b.apk
Size

3.7MB
MD5

b91b8f3244756b749e0719ec3236ce06
SHA1

94d7d1774057d819006cab451aa6b5812b69227f
SHA256

8cb27f6fbcbcb106b713c1419e59a51e7b1462ea37e75afe033fe0cafbfbac5b
SHA512

e7e91de22544ad2f20d0b48064d06a5ddf64ae2aaf92a7026e5b6af44dbf2a543c9042ed70791e3dd9ee66ddf5b8641cfcb5c7dc11c8e74fd2aa0343e8a440ea

Score

10^/10

teabot banker infostealer obfuscation trojan

Malware Config

Extracted

Family

teabot

http://138.201.211.36:84/api/

Signatures

TeaBot
TeaBot is an android banker first seen in January 2021.
banker trojan infostealer teabot

Loads dropped Dex/Jar 4 IoCs

Runs executable file dropped to the device during analysis.

Processes:

opinion.obvious.phrase

ioc	pid	process
/data/user/0/opinion.obvious.phrase/app_DynamicOptDex/FPAm.json	3592	opinion.obvious.phrase
/data/user/0/opinion.obvious.phrase/app_DynamicOptDex/FPAm.json	3592	opinion.obvious.phrase
/product/app/webview/webview.apk	3592	opinion.obvious.phrase
/product/app/webview/webview.apk	3592	opinion.obvious.phrase

Uses reflection 2 IoCs

obfuscation

Processes:

opinion.obvious.phrase

description	pid	process
Invokes method android.content.Context.bindServiceAsUser	3592	opinion.obvious.phrase
Invokes method android.content.Context.bindServiceAsUser	3592	opinion.obvious.phrase

opinion.obvious.phrase
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:3592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/opinion.obvious.phrase/app_DynamicOptDex/FPAm.json

MD5
80391872d7a084e2c8fd06f8be64cb83

SHA1
fc17a54c57b296e426bf1b32fca78a3b6dd2f7be

SHA256
b59f1f7f474479a043080dfaf5b945c2a6f263ea78dc359f25c28366728f2ef7

SHA512
5e1e32dfe4f32d0182bc3ef88cff1ee12cf64bc9bf8ff3a81e568775214263fdf96d401ac274fdcb3caff2f54e428e025dfac321571747dfcc436884c6d0a358

Download Submit
/data/user/0/opinion.obvious.phrase/app_DynamicOptDex/FPAm.json

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/opinion.obvious.phrase/app_DynamicOptDex/FPAm.json

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/opinion.obvious.phrase/app_DynamicOptDex/oat/FPAm.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/opinion.obvious.phrase/app_webview/GPUCache/index

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
/data/user/0/opinion.obvious.phrase/app_webview/GPUCache/index-dir/temp-index

MD5
3dc52f715904d0cbb3bdab8dc220cc06

SHA1
aa52dd5b6b990631a7fe0cfc2a1357876c22f2ff

SHA256
72399b01b2721cddda4317ceb570675bdf7dfe0adb83425c8268bf28e86bfaa0

SHA512
ea8a9a1a9dfbdf486465320e6646a2861085656288e680c1b4904580a05dfc2c557059a70f344a74b907a4f5526069b7a16def6cee634c5bd815a98528af6361

Download Submit
/data/user/0/opinion.obvious.phrase/app_webview/Web Data

MD5
dfea4f9a562d22c658ec695eca31ea04

SHA1
2e48be6baf86078d93f14fc38fe9f395c1c54261

SHA256
a01b4f35e09bbcdf9753512d4d3ac0b82c8e2f09e2176fa4a5c2523909795b2b

SHA512
8e0aab3c5f29a8737b4713b4a1622aa71b3574feabfb41a098f1326b80472c3fea053e759036c44df71aee1a8a1e9caf93f17a9eec88ab278062d7ed48907789

Download Submit
/data/user/0/opinion.obvious.phrase/app_webview/Web Data-journal

MD5
db4e9435e441c2370e90377f2d0cbcd4

SHA1
77e3a5d0efe2f44d7bdf771f80f2ed7d829d7c3e

SHA256
756134f1f7eb40a8d9d87e08a09afdafa2a68459971d406c2838fcb0af549074

SHA512
1c220063f3e931db81046ffd172d05b669585fcb248560e2d4b20d56b55105ae5d6622ca6a08ccd90b1dcd44225d3b8f534433b721a152b3cb2d106dd76c5037

Download Submit
/data/user/0/opinion.obvious.phrase/app_webview/metrics_guid

MD5
38af89f505857f2ba9ac99315236ed21

SHA1
a5d8faa2a49e379b039bc497334b8cdd4cf6e327

SHA256
581f7efd24de036d4e6db86b8214fbb540c12efca9dd0f995df0d1ed89a986f0

SHA512
6c04f727efaecd1b4f62df29eda5cbf278afa7cf7ff0c3fb51461912013fa33960cd37edac4cfa78e7244b29b68bfa0258fc61ec2891456af0046882d06d9d74

Download Submit
/data/user/0/opinion.obvious.phrase/app_webview/metrics_guid

MD5
38af89f505857f2ba9ac99315236ed21

SHA1
a5d8faa2a49e379b039bc497334b8cdd4cf6e327

SHA256
581f7efd24de036d4e6db86b8214fbb540c12efca9dd0f995df0d1ed89a986f0

SHA512
6c04f727efaecd1b4f62df29eda5cbf278afa7cf7ff0c3fb51461912013fa33960cd37edac4cfa78e7244b29b68bfa0258fc61ec2891456af0046882d06d9d74

Download Submit
/data/user/0/opinion.obvious.phrase/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/opinion.obvious.phrase/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/opinion.obvious.phrase/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/opinion.obvious.phrase/cache/WebView/Crashpad/settings.dat

MD5
636719723166b8d27b0df645a0bedfe1

SHA1
82fa457932deeacc5956d0103175f666686af1ba

SHA256
b1dda323904debbb3ae6e9cb17b4e3b7637d17be025cbec79499bbb2adececb4

SHA512
e48425116a0744383d8284e7eb1c4ec623c536cb7302525dd289600377e9c0fd83139ee8560d2a5614213796044b5a728b2545084d9bf68aca2e35a1b35aad80

Download Submit
/data/user/0/opinion.obvious.phrase/cache/org.chromium.android_webview/Code Cache/js/index

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
/data/user/0/opinion.obvious.phrase/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

MD5
e56866c686ffbf06b70a499ce24d104a

SHA1
aa8470fe49abe355b7a66fd225ccd54b2db10063

SHA256
c2ab4819a317edd40abb7cf22c15c4ef466951fbfde7b66acaacc3a5d3a4e89e

SHA512
6d16240d011f1e646d8ae294f8bb088fd204ffe146ae4fd22660e924563d0b59f2ad5ed08e40d374bb6d40fb364bd17594e5e8eb12a07cd71fddc95f2bb99e45

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/WebViewChromiumPrefs.xml

MD5
1357a1d7af06755d561a7ed916373baf

SHA1
4a0a0d8b4b81bba92924dd7cf53a44d438312729

SHA256
647f3960ac648b24a8d9fa17f93f625437bd6f385636c56f10fefdd9cd447597

SHA512
61f15a595e21cb7cbf0b1a5268da72b39ce767e43195b4b1a607125e6e1d3237aa382cffbeb122bee9111f01a61ed4aebc2bef6fa646891f43154b01c32d05d4

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
8e532add97f80abdacde37f8c2f489ad

SHA1
6e4a75f04bb5b932c67e1af0e6bcc1bc0ec43b19

SHA256
44ce5d683e666e726ed073a35e2a6278684ffe48c21df8d8ff09e5e15fb8f99f

SHA512
7ddea0f0cf739503e0cd35f5423ab740c72d31fa023885ae39811a4052b1f947d49e00bf3a935df449d4e80038ef6b5d8445e9dc32be66f3441a82b060105d1b

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
9795abd37c05725bfcf1438e48649f06

SHA1
83abea8d13b3abd16977ba20638ecb6b75e6a9fa

SHA256
44b5bee241e79a08f168b7cd1d1b7294ed3f8659efe80e9f074dcfbd1e935c71

SHA512
7b60428e5bc92ba205f1003a08dc194f6f95871b459d0aca46ede6736033022f090f8611f253cf97dca1f093c3569c4afaf6c59050f1971de6a14bbe0e6473f3

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
0cdd9c079a3fb02d93b478e64bcac872

SHA1
c0db1c38b48a9d16b5ae2bddb1ed2430671f3e36

SHA256
48ad6712f88e96fc8c8cbc81afa3e60ff4745ab328d93fc2dc22117eeed9a392

SHA512
2d50de11cffc47f807ca6dae85cd97c84a17b29f795bdd782e66f92ac0d97387011d931ec7409c2269885831e2e70b5c0b101669b4d186f888a88193102a5e1c

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
383c486fb63b7371e862488903293488

SHA1
4849c4f66d5cea9b3bef93dc76c02b03741acd40

SHA256
7ea2f5dd38412eeb8fb10042e639b636fbb80efcce55a00973bd3d86ab768e37

SHA512
a04af445f3f3ed0d4d384d53d9c34544802a4d5acdfaf7209800d2335a81227952fcb939adbcd6eeb745cebe493c14f179d0e6cf53df458b08b4ec1b55416f9e

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
7dbefc74d1d21e99543a2e9dce2f426c

SHA1
0323f60ec13394477eb6bbd2340d681b55a268b4

SHA256
6ff9a3e3f0957fcd833beb431d0860d8f37dfd29a6d541fb9eb3b6ce42d9608e

SHA512
4d61bd344325a119194fb705d07ba54f32c45bb63aaca6cd5b1839b0be087db95f8c559fcdf827a4725640d561f882403de40d760f506205aadfb129ac1e929f

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
97c63e14c22dc02c2f2f6b11a8857586

SHA1
3a3d5431a20a976bd15aec06265b46253d3cc643

SHA256
b618f0aceb2622bae9be422dd0d460677a60e3b50d5494a989aa68c76bbaa5d2

SHA512
95c51391058989f36cd0862537c5c4791bdb023514dfac9390ef2655ac31e2ad2198283652f59fb7e56818a68e7201ee45c2756939329853cd2800e8b915f299

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
4b83fb8242b7fb33dd1962dcfc0fdd52

SHA1
39637059e565bf25708adb640857d208dfe7c8ff

SHA256
902fe2311215cc7c94211a082d59c5c3bb857909119030ea32ad152418c74efd

SHA512
6536c8c34486677cdb401bb3d14c42e8a0d9df825de6726b50f2d8c112946a912f3fb70603508ffd4efe7d1c5f53b47f610b008a3625f4615d7fe9a38096e2e8

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
52dfc5bcd354839ca174ea3c4be0b5d5

SHA1
12f2f91a03447a3abcbd03ad03cbd07ddf430437

SHA256
ad54e5070a239fa1953486db3275ccb1cbb46fa13bceb4bd788f6d9321dec54f

SHA512
9d3d74d5faabb614dc3fad63a0ffe339d77d97740cd2773ca25c88787064017bfb0da22f8ef33a6276a667717702beda8f335bff99c4ee6b30e76ee76ed24634

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
62e9753612c41ab2ff747e5bc5039fd1

SHA1
0caf64f042e47c940330dd3c0d4ed7f32327433f

SHA256
81075cab601b9b9666e6f1fb7d27587ef439227b0955c073a0463c82734148b7

SHA512
02a4afe144d56d207b26dab02d2834259a09ca7afc22ec7badb6465ae8aff644cd7d0818483c18f7bd680211e09df27f5e7b61bbec231dfd8bb0da14ee9d52d7

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
a26bcd1675d13c7422839bcf6aae875b

SHA1
f9d36fe70b0ea40665734b0a45f1bacff26b5ef8

SHA256
d34d37083200219349e710aed699dacd700274ff1ba500555101ff90c8be4d16

SHA512
2654d937e569e7664dfbd50339bae9e282e814fe0c75f9ca01075ef3e648e045a8935d4055e5b3714348915a3dc1c3f3f7c909e7f475c5bca129d7972dadb187

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
c157c41576d92a7b2878d71e97273ac3

SHA1
059710b88434cf722de99a12fd645ecf37b78bc0

SHA256
68c0650630437116696a09ed64779904d138fa1a01698a080aafeb4bcbfa4116

SHA512
1f7e3a4633c1f4936dffa40cd58189bf07e551374ae0bd82effbbcc0871ff3a69e3647722ba144a62d730fba1cc841beba5b38538145f6b185afb107c7ae55e5

Download Submit
/data/user/0/opinion.obvious.phrase/shared_prefs/config.xml

MD5
da7e2e1076c5561c4fc855af749b0441

SHA1
827def43052b16448396ca9f251fb74abb21d01e

SHA256
87d2a604d42d5ec3c8d2e481d98ae894891373a553d37414d7c763f102e34e3a

SHA512
881c4877af9b23e5c33cea3993425743e54713187d1f6a7ac430286de48a982eae842e2098f97daf260be05aeb93701265f735fc2a749eed4bcf924d60f20692

Download Submit
/product/app/webview/webview.apk

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/product/app/webview/webview.apk

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit