Overview

overview

10

Static

static

10

DDABE5999D...32.apk

android-9-x86

10

DDABE5999D...32.apk

android-10-x64

10

DDABE5999D...32.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DDABE5999DBC9FFBC8B804A7EA6BB61415BC88E346B2D2C0D53BFFF9DCC88D32.apk

  • Size

    4.0MB

  • Sample

    220925-rhvdvsgcaj

  • MD5

    23e49cc28a5feeed4b9e362aa43e158a

  • SHA1

    dede2bbf3c768f425f8aa33e4cc84b54d2c420de

  • SHA256

    ddabe5999dbc9ffbc8b804a7ea6bb61415bc88e346b2d2c0d53bfff9dcc88d32

  • SHA512

    cd823991e244861ab11d9157406e2a8fc10d0818670524766a1b26090848b2ad269aa3e9e305bcb79672c609486818a2eb4c63258835aa5e0c845696aa70c678

  • SSDEEP

    98304:znWe8B4SyAR3u9E48GT3WC9ricWgyqTG+IicpcpYUBvBON:T829GmE4T59ricWgDTGjn/UBvU

Score
10/10
jokerteabotandroidbankerevasioninfostealertrojan

Malware Config

Extracted

Family

joker

C2

http://meglivesdk.oss-cn-hangzhou.aliyuncs.com

Extracted

Family

teabot

C2

http://51.38.166.153:80/api/

Targets

    • Target

      DDABE5999DBC9FFBC8B804A7EA6BB61415BC88E346B2D2C0D53BFFF9DCC88D32.apk

    • Size

      4.0MB

    • MD5

      23e49cc28a5feeed4b9e362aa43e158a

    • SHA1

      dede2bbf3c768f425f8aa33e4cc84b54d2c420de

    • SHA256

      ddabe5999dbc9ffbc8b804a7ea6bb61415bc88e346b2d2c0d53bfff9dcc88d32

    • SHA512

      cd823991e244861ab11d9157406e2a8fc10d0818670524766a1b26090848b2ad269aa3e9e305bcb79672c609486818a2eb4c63258835aa5e0c845696aa70c678

    • SSDEEP

      98304:znWe8B4SyAR3u9E48GT3WC9ricWgyqTG+IicpcpYUBvBON:T829GmE4T59ricWgDTGjn/UBvU

    Score
    10/10
    teabotbankerevasioninfostealertrojan

    • TeaBot

      TeaBot is an android banker first seen in January 2021.

      bankertrojaninfostealerteabot

    • Makes use of the framework's Accessibility service.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

      banker

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks