Overview

overview

10

Static

static

7

8856AC19F1...67.apk

android-9-x86

10

8856AC19F1...67.apk

android-10-x64

10

8856AC19F1...67.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8856AC19F179461C4008249C342C8DADBD17118F80F43CE0229DDB1CDA33BD67.apk

  • Size

    3.2MB

  • Sample

    220925-rhbazsgbhq

  • MD5

    67edbd8e6de9f4355b2657416d382e94

  • SHA1

    dfc40fe8a1985c0c9aff42ee4a05831e992efe9f

  • SHA256

    8856ac19f179461c4008249c342c8dadbd17118f80f43ce0229ddb1cda33bd67

  • SHA512

    60fdf36d041d0b137bcc4bc69e94b6259db0fdddb5f0808cca6670c70076576efa5d6a63b6cbfc0ee19033849dfc19c700f9328ad7ddeac86318c3d96941c3fa

  • SSDEEP

    98304:XncQpaxkUhdGd56gzm6JIOvv9/XCjGfg/IDxIP:XnzpaxkUhIZgOvv0ogcu

Score
10/10
teabotandroidbankerevasioninfostealertrojan

Malware Config

Extracted

Family

teabot

C2

http://51.38.166.153:80/api/

Targets

    • Target

      8856AC19F179461C4008249C342C8DADBD17118F80F43CE0229DDB1CDA33BD67.apk

    • Size

      3.2MB

    • MD5

      67edbd8e6de9f4355b2657416d382e94

    • SHA1

      dfc40fe8a1985c0c9aff42ee4a05831e992efe9f

    • SHA256

      8856ac19f179461c4008249c342c8dadbd17118f80f43ce0229ddb1cda33bd67

    • SHA512

      60fdf36d041d0b137bcc4bc69e94b6259db0fdddb5f0808cca6670c70076576efa5d6a63b6cbfc0ee19033849dfc19c700f9328ad7ddeac86318c3d96941c3fa

    • SSDEEP

      98304:XncQpaxkUhdGd56gzm6JIOvv9/XCjGfg/IDxIP:XnzpaxkUhIZgOvv0ogcu

    Score
    10/10
    teabotbankerevasioninfostealertrojan

    • TeaBot

      TeaBot is an android banker first seen in January 2021.

      bankertrojaninfostealerteabot

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks