Analysis

  • max time kernel
    1962940s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    25/09/2022, 14:12

General

  • Target

    D65AE353CE5D975CEA85BB0FAB578590A90061173657BA2E1A0C1110D9B8EB91.apk

  • Size

    3.5MB

  • MD5

    d7678cf0d4bbaf4db0702b8e2412a74c

  • SHA1

    2eb5708467d480a6dd07fb1283366f729926976f

  • SHA256

    d65ae353ce5d975cea85bb0fab578590a90061173657ba2e1a0c1110d9b8eb91

  • SHA512

    0942560c8e506c909392c70dddd6ef03ca6aa364a1d608f36fa6c8e6b0c7f54cc3b04fc809bc095540401deaaccd510ba0648547e8195a2f9d0145c63e20e2d6

  • SSDEEP

    98304:wLzMSyy/g3dGxaMmSDk5GkL7WQ3aWTBDxP26O:GvykxaMTDML7xaWTbOB

Malware Config

Signatures

  • TeaBot

    TeaBot is an android banker first seen in January 2021.

  • TeaBot payload 2 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

Processes

  • donor.mutual.draft
    1⤵
    • Loads dropped Dex/Jar
    PID:4780

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/user/0/donor.mutual.draft/app_DynamicOptDex/aG.json

          Filesize

          1.2MB

          MD5

          b2862a37d82121fecce2bfea42981efd

          SHA1

          9061afad7ad4d5f62630f16dc236103eb9653180

          SHA256

          8ff37745e19b69fdb26b8773959bde07d29c4716cef67118659d13f70dfdbcb8

          SHA512

          6283bc0572b872df6bad4943cea313cc983579db420383e446877a1df058bd0a15d8c56c55ed34e16b43fd7bf4296c7409a7b6c17f9f1e7457e5d14ba4ba1f2b

        • /data/user/0/donor.mutual.draft/app_DynamicOptDex/aG.json

          Filesize

          1.2MB

          MD5

          2ac4863dcc3ad2b912c9215d77f945c8

          SHA1

          4c5920e22a1d3e4ab44851ab83ef24d87fbeb685

          SHA256

          90cd04ac7c93b9602b03b2a54b1d37e8e497924e0ffd12a5d7ae2e7eb64cdedb

          SHA512

          6a0f835798bcc842442b2e502e70787f2fe18994eab1e1fb11d5e8856e272d659e8e945f44364a77254025f73eec95712acb954d04081e92ddcc38f59ec1627d

        • /data/user/0/donor.mutual.draft/app_DynamicOptDex/aG.json

          Filesize

          1.2MB

          MD5

          2ac4863dcc3ad2b912c9215d77f945c8

          SHA1

          4c5920e22a1d3e4ab44851ab83ef24d87fbeb685

          SHA256

          90cd04ac7c93b9602b03b2a54b1d37e8e497924e0ffd12a5d7ae2e7eb64cdedb

          SHA512

          6a0f835798bcc842442b2e502e70787f2fe18994eab1e1fb11d5e8856e272d659e8e945f44364a77254025f73eec95712acb954d04081e92ddcc38f59ec1627d

        • /data/user/0/donor.mutual.draft/app_webview/GPUCache/index

          Filesize

          48B

          MD5

          6d7d499960179766cd4261d12dacc411

          SHA1

          e6f8553b0015e12b23cc551afe98763f3b1c9bed

          SHA256

          c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

          SHA512

          6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

        • /data/user/0/donor.mutual.draft/app_webview/GPUCache/index-dir/temp-index

          Filesize

          96B

          MD5

          6c0672ce2fe5d57297d517ecd9cd75ea

          SHA1

          4ac28f4f3867bdd3cccc9acfa88b0caf83dcd883

          SHA256

          133d7349f64b87cd87ed8fcac06e324802e453f4aeb93316447e5838b363215b

          SHA512

          d67d7b5c844d8e96f3cbec000bd3f9a4c2bfc0b9b2d95c5cb37c674ffde44a21099fcfd5f1d2b031bb54e96db4462a7ffb4f32ec572704d07069ee5a5a6f26b6

        • /data/user/0/donor.mutual.draft/app_webview/Web Data

          Filesize

          112KB

          MD5

          b663831f8cc130493476d94f2d7a5330

          SHA1

          043a1956ab8e40821d67043f8a9110a8eb36fb93

          SHA256

          c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

          SHA512

          e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

        • /data/user/0/donor.mutual.draft/app_webview/Web Data-journal

          Filesize

          1KB

          MD5

          9567e1a1a9ed1509408c514b7536f517

          SHA1

          aa270db945b449fd050f279df1de283fe268066e

          SHA256

          082b75f95d01ce98e347cd1de789d538026e7fa764d349a32ed247826325f7bf

          SHA512

          0e0fa0bedc8b0ac6b03ea55ffc4ed1a4268d720a3a6245c50905d52f5500a1b1439099946e0fde2e428abe0e00c36f4b978bbafbcdde53b1e61c35d330bd52c9

        • /data/user/0/donor.mutual.draft/app_webview/metrics_guid

          Filesize

          36B

          MD5

          889e97cc33195edf7ef86be468b0b7b2

          SHA1

          0ad83395c122a82e2e1f8daabd077c7d3a4bb654

          SHA256

          fd414f99d75bbf2ef5a10e01cb98a1bb64de0c98b77a17aafbd9a2966be1ed74

          SHA512

          24329698ee503a5af8b84d9f97c9b9843f2d8471fbe561154c96b569e8880517e98eb296fd9c0fba56f4585d416774c57e75bcd476965b707a078d72a63f88bb

        • /data/user/0/donor.mutual.draft/cache/WebView/Crashpad/settings.dat

          Filesize

          40B

          MD5

          c7dbf577cb2775f4682ab4f189a31115

          SHA1

          8775250bc0408966f4c05407a0d0cd5ba4176285

          SHA256

          e82055abd37a1c17c3ce5d55b624469980172863fd7904ff1c0271258dafe4d6

          SHA512

          9b4e121404796f23d32e015e1ec55bf3adb19b0e7d3b7c1cfa0e690dfe795bb4bc378323d083b1327894d4065b4be28d85bf740d5ff4fee6702f3ba3de1cfea8

        • /data/user/0/donor.mutual.draft/cache/org.chromium.android_webview/Code Cache/js/index

          Filesize

          48B

          MD5

          6d7d499960179766cd4261d12dacc411

          SHA1

          e6f8553b0015e12b23cc551afe98763f3b1c9bed

          SHA256

          c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

          SHA512

          6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

        • /data/user/0/donor.mutual.draft/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index

          Filesize

          96B

          MD5

          ccfd55aa6e860c7ff053d0b8076f9525

          SHA1

          2dfa0ca0c6c39d3abd478cbe5d0e1db2427f2a34

          SHA256

          41bdf26aa1671caf7a02cca544b7e9bf1684e162348f51a329d5083ff8bf99e6

          SHA512

          9191a6b12b8d407cfffb8aef1cf301ebe1bac7d76345608f2777f578645f945aeb9d4535174012d510778c28a755aa9e294a1a58d32fe0ab5ac49507e3294952

        • /data/user/0/donor.mutual.draft/shared_prefs/WebViewChromiumPrefs.xml

          Filesize

          127B

          MD5

          6ef709b8536878951e87c29a1518fc2b

          SHA1

          24376c70b00152501b3d98df61fa7db435339172

          SHA256

          10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

          SHA512

          96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9