teabot

General

Target
8feb5aef2953c68511777baf048319dbbbc83277ed8e5f296b39908c89ad8582.bin
Size 3.7MB
Sample240802-13ch8axcqh
SHA256 8feb5aef2953c68511777baf048319dbbbc83277ed8e5f296b39908c89ad8582
MD5 f5e2b917f92d441eb6c2acd358276377
SHA1 4dc6b173b762295c56273b9f1875935239d0a3aa
SHA512 0c233914896f93dec45dd443e1df5f14cdd9c4bfaa6a08ce1c49a05615ecca45f719da3a73ce56786ac7ad21ed8a9c901466f9d2426632ba7afd4b4bb8935a62
SSDEEP 49152:DZkAiPbKOyKBgaPLQi2EVp4t0Izje+leswmCfrSTq4T654HVy9paR0ZHhz/vFSvK:ABbPLgcs3FeeCjKfVyDRhsvyLhB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  8feb5aef2953c68511777baf048319dbbbc83277ed8e5f296b39908c89ad8582.bin
- Size 3.7MB
- SHA256 8feb5aef2953c68511777baf048319dbbbc83277ed8e5f296b39908c89ad8582
- MD5 f5e2b917f92d441eb6c2acd358276377
- SHA1 4dc6b173b762295c56273b9f1875935239d0a3aa
- SHA512 0c233914896f93dec45dd443e1df5f14cdd9c4bfaa6a08ce1c49a05615ecca45f719da3a73ce56786ac7ad21ed8a9c901466f9d2426632ba7afd4b4bb8935a62
- SSDEEP 49152:DZkAiPbKOyKBgaPLQi2EVp4t0Izje+leswmCfrSTq4T654HVy9paR0ZHhz/vFSvK:ABbPLgcs3FeeCjKfVyDRhsvyLhB
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

teabot banker collection credential_access discovery evasion infostealer persistence stealth trojan impact
- TeaBot
  TeaBot is an android banker first seen in January 2021.
  banker trojan infostealer teabot
- TeaBot payload
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries the mobile country code (MCC)
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1 behavioral2 behavioral3