teabot | 13e34ee48550c03e90008bace2279b3206333905c9b3de05756551c83674ce70

Resubmissions

27-01-2023 07:24

230127-h8ld7she43 10

25-04-2022 13:47

220425-q3kjqaccd4 8

23-04-2022 16:23

220423-tvtdfadcc3 10

22-04-2022 08:33

220422-kfyj6sgbam 10

Analysis

max time kernel
4062154s
max time network
165s
platform
android_x64
resource
android-x64-20220823-en
resource tags

androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
submitted
27-01-2023 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47bb7f855cdf116c62499240089fa1b7a69585e8b7f639e192b9d038da4094cd.apk
Size

3.2MB
MD5

bf2ddaf430243461a8eab4aa1ed1e80d
SHA1

29c497dc416d903917e92ae347371b15009eaee1
SHA256

47bb7f855cdf116c62499240089fa1b7a69585e8b7f639e192b9d038da4094cd
SHA512

b50735a2d58e19038f56baf62704b4d7af726e812758ea7c43b4c5155828b93ea5d9284ec89ba8ce9704e4b8945bb832970fd7601bbdcd039972bdac78ab4739
SSDEEP

98304:ylxgweICNV+mN24ElmQjE9LBcGDIXAOthoV:ylxgBImV+mCmQjMLBarrc

Score

10^/10

teabot banker infostealer trojan

Malware Config

Extracted

Family

teabot

http://51.38.166.153:80/api/

Signatures

TeaBot
TeaBot is an android banker first seen in January 2021.
banker trojan infostealer teabot
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.nnawozvvi.pamwhbawm

ioc pid process

/data/user/0/com.nnawozvvi.pamwhbawm/8jIIkIkopq/gkttjgFgiakjHfF/base.apk.gp8ghaf1.hth 4770 com.nnawozvvi.pamwhbawm

ioc	pid	process
/data/user/0/com.nnawozvvi.pamwhbawm/8jIIkIkopq/gkttjgFgiakjHfF/base.apk.gp8ghaf1.hth	4770	com.nnawozvvi.pamwhbawm

com.nnawozvvi.pamwhbawm
1⤵
- Loads dropped Dex/Jar
PID:4770

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.nnawozvvi.pamwhbawm/8jIIkIkopq/gkttjgFgiakjHfF/8whgwyuo.jwtf
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/8jIIkIkopq/gkttjgFgiakjHfF/base.apk.gp8ghaf1.hth
Filesize
622KB

MD5
35d61c7bf56572647255879d8226dafd

SHA1
27a1c7549d3d98793886f315600889d421696403

SHA256
b17570a35cee1028853df373c565da61fb1dff751f755001e8545093084464f3

SHA512
d88765b16177c83bc426af6959ed7ea5c58bb77b49ad9505a6f4c0e106ac4c5a43ba4cdde4ca0fefc9ca39c492f7a1e7a0442f3953b2fc1d97f1951e19387519

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/8jIIkIkopq/gkttjgFgiakjHfF/tmp-base.apk.gp8ghaf4615566739611512402.hth
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/.com.google.Chrome.5dRjDU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/GPUCache/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/GPUCache/index-dir/temp-index
Filesize
96B

MD5
6c15d4e73f4a3146b2b638b0f029fa29

SHA1
a1339bd12e7bc3850e768cd3e40715ee92c7c570

SHA256
3a53d09aeacc1be0892941c84b709a93eb1ee856ab4f66f9282e0e84679f052c

SHA512
74bbb8cee55d074c0f0aee3c8072fd9d4fba5d46813511884a32eea6bf27be1f7aaee48fb8cc94154f64eda38a4830a774bb34ad34cfff4681b91cb1b6d20e54

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/Web Data
Filesize
112KB

MD5
b663831f8cc130493476d94f2d7a5330

SHA1
043a1956ab8e40821d67043f8a9110a8eb36fb93

SHA256
c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7

SHA512
e8ee923192cdf16318febdc23362f3eeaf5c914b923f80cd3a91a2e83e94bced54460d4ef1e54accc26a7d54b89e2e10c00097e60002cf6427298dc5f18fed16

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/Web Data-journal
Filesize
1KB

MD5
1d25242bcb58d42dc4ecd996c906d7cc

SHA1
6427468d01a3d4336073deb5af4eaf317e069284

SHA256
351193116156bdafe5350b3a9a93e0d58915595b080cd747a274ae905388661a

SHA512
efda3424e1d0d2ee29246f2f4314e0fefaf6ffcda0522132dc3e061cb05e40001dbbfdcdcaf1905b2d67b5179a655ed3db2ba56fe84fad347c8b58ee4de51f96

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/metrics_guid
Filesize
36B

MD5
6e733e291282cdd1418bef0d381c3699

SHA1
ebc68e6a83a80b89001ea813f5a5bf878fa37f23

SHA256
78f01b6a636615791c95104697d6deacb79f006c1388f14d222dac10fec29031

SHA512
f2cc7daba1bfdfef33a77780e91a40ba1c02adc29d443763725ad4176e53e08bc380b9a62f0875436986c8f174f22931ff0a0f55eaa8d56b17aa780639505320

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/cache/WebView/Crashpad/settings.dat
Filesize
40B

MD5
c4402d6afc0b647debc08f92559a6444

SHA1
d26671d8e47f7f00789d92102b471c70374ae8be

SHA256
a67805eda040425f0d22605891d062354faa3c11a1d278005544273ecaebe9a5

SHA512
5cb24128888975c68f312677f85feededae0da12012b07cc50349475bb4faeac4cbf4ec92282e88d04553248047767fa0b7ff390799b837d1987b1bdf33e2dbe

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/cache/org.chromium.android_webview/Code Cache/js/index
Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
Filesize
96B

MD5
fe8b62536550db5d48ff00ebbbcb8b7c

SHA1
778c77fb0eb2b21f52a6698e8b50743c80063124

SHA256
4934cb8dc13f3cbdec11fd0a837746e4a17b4603c2425d749fb300a38397c193

SHA512
00f96c56fae989145f8765298333433d7c09775cb34baf075c792437daab807a72939a9d46302d3b586d785057f4da60c9e4437c6208fd709fb93ef4607afda2

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
6ef709b8536878951e87c29a1518fc2b

SHA1
24376c70b00152501b3d98df61fa7db435339172

SHA256
10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6

SHA512
96547eff6779251a5c4941e812ec56ed273e9270265005723e1f2864688b04f3b852a90145fba4ea0ddf1e02b39d99e33d28f761b07a04d46e0e4257d8909ff9

Download Submit
/data/user/0/com.nnawozvvi.pamwhbawm/shared_prefs/multidex.version.xml
Filesize
307B

MD5
b894b3475fc31f434ec0e9d57f9237a3

SHA1
832a10915b36c86137ab0182801ec1099a52c435

SHA256
adcce95e0c8194187ea9aef584ebd203d9d836ca426886cc257f14c066e4bc39

SHA512
8c50099d6e49a7aece16d7b30acf15643ed935ab1b6884b8e85e2a6257ad9e86b781bc53a6b406b539cb25f55d7a0eb7c38a4f0a5825fcf4f4a03f6a79fdead7

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads