Analysis
-
max time kernel
179s -
max time network
188s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
28/07/2024, 22:00
General
-
Target
56232948a56bdf7c6a69b1bdb2b636317ff84a150f69a6f86fddb1a4e56c3b6b.apk
-
Size
2.2MB
-
MD5
7a33c621d8316010100f1f415e5806e2
-
SHA1
f07735aa5c1185b14204d3ff93c40dc71c200c12
-
SHA256
56232948a56bdf7c6a69b1bdb2b636317ff84a150f69a6f86fddb1a4e56c3b6b
-
SHA512
c6f2872688f0a5af1f14eac2d4ab0dea065c5826a13486637122cc183b10886cd76b0655a7913488be1c6cff7942a243301bb67180d79705607719d36263eb6e
-
SSDEEP
49152:vuS+wu8apYaiI1g/0Y1trEpxCjfOdqcxOG+uR6TXY:6wudpNW/0Y1trEpxCjfOdFb6TXY
Malware Config
Extracted
teabot
http://91.215.85.55:85/api/
http://193.107.109.44:85/api/
Signatures
-
TeaBot
TeaBot is an android banker first seen in January 2021.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.mjpvpteu.emngawxh.pbnshqob.cejywlyf1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2System Network Configuration Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
317KB
MD568b18a60c070f0724be233f1919811d8
SHA16d1a3e8545c7215b33208f8100ddb9eea3f88513
SHA2563ba140f8763455654bcfc11ae568dcc9b48c3f9a4214b0898b1b6d103e111616
SHA5122099a1be75a99eb94959f4e10a8c2da399ef361178b8373ae6f37595ce1b2d4110ba92a05e181ce310e79cf7ddb445fc574d122728100034dfca7e0999ba7e93
-
Filesize
751KB
MD59f2305a18dd1ae908de42f1ae25ea759
SHA129251a37fe5fda87fe147f3546a65a27dbc8a6e7
SHA256077cb289f459687e1ba2598e121ade40a221be9f25168a3c22a5621eb2804fb0
SHA512e397177c1f966e2e2c5152d405264c9c645061002115ec1a9c34e7b2cb604e1c91a113ab5bbf52c64d24a49ff1fac1c314e5356aca7cc7785927235f5ec2e1e7