Analysis
-
max time kernel
1962940s -
max time network
155s -
platform
android_x64 -
resource
android-x64-20220823-en -
resource tags
androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system -
submitted
25/09/2022, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
D65AE353CE5D975CEA85BB0FAB578590A90061173657BA2E1A0C1110D9B8EB91.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
D65AE353CE5D975CEA85BB0FAB578590A90061173657BA2E1A0C1110D9B8EB91.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
D65AE353CE5D975CEA85BB0FAB578590A90061173657BA2E1A0C1110D9B8EB91.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
D65AE353CE5D975CEA85BB0FAB578590A90061173657BA2E1A0C1110D9B8EB91.apk
-
Size
3.5MB
-
MD5
d7678cf0d4bbaf4db0702b8e2412a74c
-
SHA1
2eb5708467d480a6dd07fb1283366f729926976f
-
SHA256
d65ae353ce5d975cea85bb0fab578590a90061173657ba2e1a0c1110d9b8eb91
-
SHA512
0942560c8e506c909392c70dddd6ef03ca6aa364a1d608f36fa6c8e6b0c7f54cc3b04fc809bc095540401deaaccd510ba0648547e8195a2f9d0145c63e20e2d6
-
SSDEEP
98304:wLzMSyy/g3dGxaMmSDk5GkL7WQ3aWTBDxP26O:GvykxaMTDML7xaWTbOB
Malware Config
Signatures
-
TeaBot
TeaBot is an android banker first seen in January 2021.
-
TeaBot payload 2 IoCs
resource yara_rule behavioral2/memory/4780-0.dex family_teabot behavioral2/memory/4780-1.dex family_teabot -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/donor.mutual.draft/app_DynamicOptDex/aG.json 4780 donor.mutual.draft /data/user/0/donor.mutual.draft/app_DynamicOptDex/aG.json 4780 donor.mutual.draft
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5b2862a37d82121fecce2bfea42981efd
SHA19061afad7ad4d5f62630f16dc236103eb9653180
SHA2568ff37745e19b69fdb26b8773959bde07d29c4716cef67118659d13f70dfdbcb8
SHA5126283bc0572b872df6bad4943cea313cc983579db420383e446877a1df058bd0a15d8c56c55ed34e16b43fd7bf4296c7409a7b6c17f9f1e7457e5d14ba4ba1f2b
-
Filesize
1.2MB
MD52ac4863dcc3ad2b912c9215d77f945c8
SHA14c5920e22a1d3e4ab44851ab83ef24d87fbeb685
SHA25690cd04ac7c93b9602b03b2a54b1d37e8e497924e0ffd12a5d7ae2e7eb64cdedb
SHA5126a0f835798bcc842442b2e502e70787f2fe18994eab1e1fb11d5e8856e272d659e8e945f44364a77254025f73eec95712acb954d04081e92ddcc38f59ec1627d
-
Filesize
1.2MB
MD52ac4863dcc3ad2b912c9215d77f945c8
SHA14c5920e22a1d3e4ab44851ab83ef24d87fbeb685
SHA25690cd04ac7c93b9602b03b2a54b1d37e8e497924e0ffd12a5d7ae2e7eb64cdedb
SHA5126a0f835798bcc842442b2e502e70787f2fe18994eab1e1fb11d5e8856e272d659e8e945f44364a77254025f73eec95712acb954d04081e92ddcc38f59ec1627d
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
96B
MD56c0672ce2fe5d57297d517ecd9cd75ea
SHA14ac28f4f3867bdd3cccc9acfa88b0caf83dcd883
SHA256133d7349f64b87cd87ed8fcac06e324802e453f4aeb93316447e5838b363215b
SHA512d67d7b5c844d8e96f3cbec000bd3f9a4c2bfc0b9b2d95c5cb37c674ffde44a21099fcfd5f1d2b031bb54e96db4462a7ffb4f32ec572704d07069ee5a5a6f26b6
-
Filesize
112KB
MD5b663831f8cc130493476d94f2d7a5330
SHA1043a1956ab8e40821d67043f8a9110a8eb36fb93
SHA256c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
SHA512e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16
-
Filesize
1KB
MD59567e1a1a9ed1509408c514b7536f517
SHA1aa270db945b449fd050f279df1de283fe268066e
SHA256082b75f95d01ce98e347cd1de789d538026e7fa764d349a32ed247826325f7bf
SHA5120e0fa0bedc8b0ac6b03ea55ffc4ed1a4268d720a3a6245c50905d52f5500a1b1439099946e0fde2e428abe0e00c36f4b978bbafbcdde53b1e61c35d330bd52c9
-
Filesize
36B
MD5889e97cc33195edf7ef86be468b0b7b2
SHA10ad83395c122a82e2e1f8daabd077c7d3a4bb654
SHA256fd414f99d75bbf2ef5a10e01cb98a1bb64de0c98b77a17aafbd9a2966be1ed74
SHA51224329698ee503a5af8b84d9f97c9b9843f2d8471fbe561154c96b569e8880517e98eb296fd9c0fba56f4585d416774c57e75bcd476965b707a078d72a63f88bb
-
Filesize
40B
MD5c7dbf577cb2775f4682ab4f189a31115
SHA18775250bc0408966f4c05407a0d0cd5ba4176285
SHA256e82055abd37a1c17c3ce5d55b624469980172863fd7904ff1c0271258dafe4d6
SHA5129b4e121404796f23d32e015e1ec55bf3adb19b0e7d3b7c1cfa0e690dfe795bb4bc378323d083b1327894d4065b4be28d85bf740d5ff4fee6702f3ba3de1cfea8
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
/data/user/0/donor.mutual.draft/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
Filesize96B
MD5ccfd55aa6e860c7ff053d0b8076f9525
SHA12dfa0ca0c6c39d3abd478cbe5d0e1db2427f2a34
SHA25641bdf26aa1671caf7a02cca544b7e9bf1684e162348f51a329d5083ff8bf99e6
SHA5129191a6b12b8d407cfffb8aef1cf301ebe1bac7d76345608f2777f578645f945aeb9d4535174012d510778c28a755aa9e294a1a58d32fe0ab5ac49507e3294952
-
Filesize
127B
MD56ef709b8536878951e87c29a1518fc2b
SHA124376c70b00152501b3d98df61fa7db435339172
SHA25610b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
SHA51296547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9