teabot | b88e7421bc61f4ce20c0694418fc97c1e77cfd3f2053857f87cc47512a55c3d3

Resubmissions

26-01-2024 19:01

240126-xph73accg3 10

Analysis

max time kernel
148s
max time network
155s
platform
android_x86
resource
android-x86-arm-20231215-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20231215-enlocale:en-usos:android-9-x86system
submitted
26-01-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7823e56b4b1631ef52bbd5b95c186554.apk
Size

4.3MB
MD5

7823e56b4b1631ef52bbd5b95c186554
SHA1

f47ee24af407de1019e8605ad8f111732305fa5e
SHA256

b88e7421bc61f4ce20c0694418fc97c1e77cfd3f2053857f87cc47512a55c3d3
SHA512

ceac5d17b69d0297a7a83873705c46486894de70d45e33e64cf5971be05ac0dd07bda996fe9627bcc001aad9b954703de8028d296ed5113ff73ba02cce16a48e
SSDEEP

98304:7vNrfTch74luHqnwV6vNQV5EGArGY4fBl7ZbfUZIOp6Py5df:7vNrfghUluKnRvKV5bk0B1ZAPhf

Score

10^/10

teabot banker evasion infostealer stealth trojan

Malware Config

Signatures

TeaBot
TeaBot is an android banker first seen in January 2021.
banker trojan infostealer teabot

TeaBot payload 2 IoCs

Processes:

resource	yara_rule
/data/data/angry.grant.doll/app_DynamicOptDex/XPOZLH.json	family_teabot
/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json	family_teabot

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

angry.grant.doll

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	angry.grant.doll
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	angry.grant.doll

Removes its main activity from the application launcher 1 IoCs
stealth trojan

Processes:

angry.grant.doll

pid process

4242 angry.grant.doll

pid	process
4242	angry.grant.doll

Loads dropped Dex/Jar 3 IoCs

Runs executable file dropped to the device during analysis.

Processes:

angry.grant.doll/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/angry.grant.doll/app_DynamicOptDex/oat/x86/XPOZLH.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json	4242	angry.grant.doll
/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json	4269	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/angry.grant.doll/app_DynamicOptDex/oat/x86/XPOZLH.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json	4242	angry.grant.doll

Acquires the wake lock 1 IoCs

Processes:

angry.grant.doll

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock angry.grant.doll
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

angry.grant.doll

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS angry.grant.doll

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	angry.grant.doll

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	angry.grant.doll

angry.grant.doll
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4242

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/angry.grant.doll/app_DynamicOptDex/oat/x86/XPOZLH.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4269

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/angry.grant.doll/app_DynamicOptDex/XPOZLH.json
Filesize
1.2MB

MD5
9299a922d35a418fab1821203569c9b8

SHA1
15464cd438cf88b63a1fa244f2433c35578f02ff

SHA256
2e87ff9e0d7e79efbeb27e5f1f0041a81f2b1ba8359c4cacfeaba341cefbf48f

SHA512
ad942f3b3c3a287f87e79b193146ba5b8d8f036921906a536ab744933ae323a853870da55da6b4f0e0cf52bcce75da178455f50f624a38d5c8353c855cf62162

Download Submit
/data/data/angry.grant.doll/app_DynamicOptDex/XPOZLH.json
Filesize
1.2MB

MD5
e568315f15f0f3af927ef6348c635820

SHA1
62a4a8fe65af1866b983c94bd57645880df2cd93

SHA256
b2d15b080782f826b9d131a6188575bbbe9011d4c99dec87b73d7d34f1de96c9

SHA512
d71afcae4cf2741cdb90b0ae04a034783db82e4052e0a84f6ed35efb340fc11c22186356ea13f3fc46c084e42f87bf348cb37644c0a00b4327ec52fd792deb0c

Download Submit
/data/data/angry.grant.doll/app_DynamicOptDex/oat/XPOZLH.json.cur.prof
Filesize
1KB

MD5
29bab5834504b9e862c5084c92fd6be5

SHA1
f30832286588c12a093c8f31ea9986c40b9ae6d5

SHA256
73b49035c00e311190a6faf4a689402988206f023631b8baa616af41be97ff07

SHA512
cab40d10e8d8ad6a3affb25b77a9446f46127aac58e92636de3f03a5683945211af1cc3ffbbd82f3a4d73d0f097d8a6a0c90d263d20005fa4ee39ce181398f8e

Download Submit
/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json
Filesize
1.2MB

MD5
f265547951bc636961eda1df41709303

SHA1
cb5f9a922fdf9da72168166f9d257d851a3b3509

SHA256
7d0f41d996f66fc225ab19914d5992ae3e5d675d9ab728acb1f55d56303b0959

SHA512
0550597d17a3078ac0813fd22bb94b43118a3c7894e2e945e9a3797ef38da97e5be547db6ac475cbee453f577499663a24711b604e993bcb7a09f759199f0d44

Download Submit