teabot | b74b65f68641feb46d22fddb595fff57cba53f5e3d4d780f4b1bf9b2682a9230

Analysis

max time kernel
1845091s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220310-en
submitted
16-06-2022 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b74b65f68641feb46d22fddb595fff57cba53f5e3d4d780f4b1bf9b2682a9230.apk
Size

4.1MB
MD5

9b08148a0dcd6b574b36f7c2e888aa03
SHA1

ec32912daa82f71824a8e2697138af5b293c30fd
SHA256

b74b65f68641feb46d22fddb595fff57cba53f5e3d4d780f4b1bf9b2682a9230
SHA512

6ad17bd34c4ae6553a0e3ac322cfe69a939dcce0b8cd260a4aac511a5b656aca03fc5ac0b7bef44bdb0d6cde1ec08d0427c7f79f10f7f8a5325f99da988bb326

Score

10^/10

teabot banker evasion infostealer trojan

Malware Config

Signatures

TeaBot
TeaBot is an android banker first seen in January 2021.
banker trojan infostealer teabot

TeaBot Payload 3 IoCs

resource	yara_rule
behavioral1/memory/5166-0.dex	family_teabot
behavioral1/memory/5256-0.dex	family_teabot
behavioral1/memory/5166-1.dex	family_teabot

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	cake.ice.reform
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	cake.ice.reform

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	cake.ice.reform

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/cake.ice.reform/app_DynamicOptDex/Ym.json	5166	cake.ice.reform
/data/user/0/cake.ice.reform/app_DynamicOptDex/Ym.json	5256	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/cake.ice.reform/app_DynamicOptDex/Ym.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/cake.ice.reform/app_DynamicOptDex/oat/x86/Ym.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/cake.ice.reform/app_DynamicOptDex/Ym.json	5166	cake.ice.reform

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	cake.ice.reform

cake.ice.reform
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:5166
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/cake.ice.reform/app_DynamicOptDex/Ym.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/cake.ice.reform/app_DynamicOptDex/oat/x86/Ym.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:5256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/cake.ice.reform/app_DynamicOptDex/Ym.json

Filesize
1.1MB

MD5
7166707a8ec26a384a4fab90ada876e9

SHA1
527b8b7f519ccc43c39989cf57f8ff6a1efbed73

SHA256
dcf5355ec39d7dac9f22d1bc0ca31c49f3813f71b0024c1e85732612cece1009

SHA512
dacd0d5472de05184a1072e40ec11ad88bd7d5c2526b9188ee42502bbbfb696a56999faee2c8435cd38684ab32c5a69c0f9a504c73a493a1d107e76397e40d07

Download Submit
/data/user/0/cake.ice.reform/app_DynamicOptDex/Ym.json

Filesize
1.1MB

MD5
b3cfdb9e29dd0bd84a253cdfdd20a681

SHA1
1c0400a531147e097c2a84faba310f2a8519276d

SHA256
e0e9ad92cf446106d79f55848ad0920b7b6a1f01913a69989b21ca3c7db26ff6

SHA512
a794f62531fd24213a76d58c555967604b0f810ec50b03754dc52af244d39f328d0c10fc455dbc4387cd4980d202ec4e6ef7946abe965da1f7f722f3814d9fa7

Download Submit
/data/user/0/cake.ice.reform/app_DynamicOptDex/Ym.json

Filesize
1.1MB

MD5
0184620e78a012958c92a7b6029361a9

SHA1
e3118a9a40805a16eddc0aa657ef5bea8966504e

SHA256
e33c4b06df069fc4f3e6283195e37c0c6ffdbfd64474d3a814b74cfee303814b

SHA512
95ec0476d04bf3c2e6f001348dc008f13a61c49b653becb5ca35936d5eac86ca4f439f25c085177d4190641076594df88c9b52e0be525b2eb4d004c8e41345e5

Download Submit
/data/user/0/cake.ice.reform/app_DynamicOptDex/Ym.json

Filesize
1.1MB

MD5
b3cfdb9e29dd0bd84a253cdfdd20a681

SHA1
1c0400a531147e097c2a84faba310f2a8519276d

SHA256
e0e9ad92cf446106d79f55848ad0920b7b6a1f01913a69989b21ca3c7db26ff6

SHA512
a794f62531fd24213a76d58c555967604b0f810ec50b03754dc52af244d39f328d0c10fc455dbc4387cd4980d202ec4e6ef7946abe965da1f7f722f3814d9fa7

Download Submit
/data/user/0/cake.ice.reform/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/cake.ice.reform/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
788b76c116ee309c0dee595c2caba81f

SHA1
adc401f114dc2ffb19573677369553383362a15b

SHA256
b4fc77fdb7383a1468d0475001e1b1f023eb8956cd29c72616c925e845c3b27c

SHA512
6a679ecb8db5ea1fd41cf2816391e990031b1a121ba1dff67cd4de7ec3b32d7226d6cb5bf7b8852478aa79fc2c90265cf078432330da5739dd4a22b6e33a0b47

Download Submit
/data/user/0/cake.ice.reform/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/cake.ice.reform/app_webview/Web Data-journal

Filesize
1KB

MD5
29ac154918e6d5ff69e76ecf459f07ef

SHA1
a7558e25924ba01fd9259d155b0c937e50988862

SHA256
bb021ddcf3763e91babe5a40cff1b4bc82f14a9d49ca2f4026dcc3a92766f737

SHA512
be166a9b6d61d055c96ff3dbe134c7a5aefb0c6a6ff22f2436fae0c30ceef58e4030b01184a0bc76ad8b195c776a013fabdf6978b5c7d637ea25653621506513

Download Submit
/data/user/0/cake.ice.reform/app_webview/metrics_guid

Filesize
36B

MD5
7e99ddc4a13b6d2551a4949ff0e00912

SHA1
4eb8f6201b169a4466add14f4065b9baf09bc483

SHA256
e191351610ff8e34c3eeb0f2d708ce678f3197b5614cb8c92bcee23eaf5776d0

SHA512
f8d8488aed0166ff4a359e7d4a6576623e8866691ebd2e7e6fc7d547f5fa26387abcfea694467a6ffdc992d93a9d3c42e8454574f646c1cc6d839286ffabfdd7

Download Submit
/data/user/0/cake.ice.reform/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit