teabot | b88e7421bc61f4ce20c0694418fc97c1e77cfd3f2053857f87cc47512a55c3d3

Resubmissions

18/04/2024, 09:49

240418-ltf3qahe97

26/01/2024, 19:01

240126-xph73accg310

Analysis

max time kernel
152s
max time network
155s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
26/01/2024, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7823e56b4b1631ef52bbd5b95c186554.apk
Size 4.3MB
Sample240126-xph73accg3
SHA256 b88e7421bc61f4ce20c0694418fc97c1e77cfd3f2053857f87cc47512a55c3d3
MD5 7823e56b4b1631ef52bbd5b95c186554
SHA1 f47ee24af407de1019e8605ad8f111732305fa5e
SHA512 ceac5d17b69d0297a7a83873705c46486894de70d45e33e64cf5971be05ac0dd07bda996fe9627bcc001aad9b954703de8028d296ed5113ff73ba02cce16a48e
SSDEEP 98304:7vNrfTch74luHqnwV6vNQV5EGArGY4fBl7ZbfUZIOp6Py5df:7vNrfghUluKnRvKV5bk0B1ZAPhf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

teabot banker infostealer trojan

Malware Config

Signatures

TeaBot
TeaBot is an android banker first seen in January 2021.
banker trojan infostealer teabot

TeaBot payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-2.dat	family_teabot

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	angry.grant.doll
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	angry.grant.doll

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json	4997	angry.grant.doll
/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json	4997	angry.grant.doll

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	angry.grant.doll

angry.grant.doll
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:4997

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

XPOZLH.json

Path /data/data/angry.grant.doll/app_DynamicOptDex/XPOZLH.json
Size 1.2MB
SHA256 2e87ff9e0d7e79efbeb27e5f1f0041a81f2b1ba8359c4cacfeaba341cefbf48f
MD5 9299a922d35a418fab1821203569c9b8
SHA1 15464cd438cf88b63a1fa244f2433c35578f02ff
SHA512 ad942f3b3c3a287f87e79b193146ba5b8d8f036921906a536ab744933ae323a853870da55da6b4f0e0cf52bcce75da178455f50f624a38d5c8353c855cf62162
SSDEEP 24576:bSTnQvvs5jQAbu05z7GoqX8/w4dD3fujayUma/gUH+5WZ:bSsM5jQYf5z7yXcTG+Ieh
MD5 SHA1 SHA512 SSDEEP

Submit Download

XPOZLH.json

Path /data/data/angry.grant.doll/app_DynamicOptDex/XPOZLH.json
Size 1.2MB
SHA256 b2d15b080782f826b9d131a6188575bbbe9011d4c99dec87b73d7d34f1de96c9
MD5 e568315f15f0f3af927ef6348c635820
SHA1 62a4a8fe65af1866b983c94bd57645880df2cd93
SHA512 d71afcae4cf2741cdb90b0ae04a034783db82e4052e0a84f6ed35efb340fc11c22186356ea13f3fc46c084e42f87bf348cb37644c0a00b4327ec52fd792deb0c
SSDEEP 12288:BvvH69gZ/Z56BeQFi4G/1sVf/FSasxgru+5KVhyfLwyivxx9nEO1ZklrsBjZim:BHbZ/ZA3i4G/1sVfNSnCN5a2DYnnDjh
MD5 SHA1 SHA512 SSDEEP

Submit Download

XPOZLH.json.cur.prof

Path /data/data/angry.grant.doll/app_DynamicOptDex/oat/XPOZLH.json.cur.prof
Size 1KB
SHA256 c4faaa0a49d79f101db1221a58cad5bab4e89c76df800995de388b29e142ebf2
MD5 7083c8382f14d3a74fdb62f2d1f7041f
SHA1 f232071e378daabcdf527e0a4d412135a33a9d27
SHA512 6b1ab7f38f999c9e08c10553db4f6e1934fee7f6a4f7eb7f7b76a2649611699c40f37b3c7c37917864bf1200690bf28c5c379f1de9890f1f033df147cd65cf1d
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads