Overview

overview

10

Static

static

6

8feb5aef29...82.apk

android-9-x86

10

8feb5aef29...82.apk

android-10-x64

10

8feb5aef29...82.apk

android-11-x64

Analysis

  • max time kernel
    179s
  • max time network
    185s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    02/08/2024, 22:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8feb5aef2953c68511777baf048319dbbbc83277ed8e5f296b39908c89ad8582.apk

  • Size

    3.7MB

  • MD5

    f5e2b917f92d441eb6c2acd358276377

  • SHA1

    4dc6b173b762295c56273b9f1875935239d0a3aa

  • SHA256

    8feb5aef2953c68511777baf048319dbbbc83277ed8e5f296b39908c89ad8582

  • SHA512

    0c233914896f93dec45dd443e1df5f14cdd9c4bfaa6a08ce1c49a05615ecca45f719da3a73ce56786ac7ad21ed8a9c901466f9d2426632ba7afd4b4bb8935a62

  • SSDEEP

    49152:DZkAiPbKOyKBgaPLQi2EVp4t0Izje+leswmCfrSTq4T654HVy9paR0ZHhz/vFSvK:ABbPLgcs3FeeCjKfVyDRhsvyLhB

Score
10/10
teabotbankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Signatures

  • TeaBot

    TeaBot is an android banker first seen in January 2021.

    bankertrojaninfostealerteabot
  • TeaBot payload 2 IoCs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • cash.roast.must
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4247
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/cash.roast.must/app_DynamicOptDex/Hklu.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/cash.roast.must/app_DynamicOptDex/oat/x86/Hklu.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4273

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/cash.roast.must/app_DynamicOptDex/Hklu.json
    Filesize

    1.2MB

    MD5

    5b158bf19ea5d37ed8405c5454bec95b

    SHA1

    a7d896db4d4a650a20e765e537707f8b9e165016

    SHA256

    1c5b840d31d59a1180dba6cc58e97b554ceb53a90f8ee84d079cf7d7af436ed6

    SHA512

    435850b461299ed62fdcd6e860033e8022f36e74a9a4de09c665de8a15855363475728fb8108884370c45f36a3c600cec1fd0277ab5c8b602b20cd05847362e6

    Download Submit

  • /data/data/cash.roast.must/app_DynamicOptDex/Hklu.json
    Filesize

    1.2MB

    MD5

    0928029df7d6fe852f8cc666d6c4ec41

    SHA1

    cd1c73fcc9e49d1d3c98ba894e9cd1ba7d856565

    SHA256

    2bec5f2ee3e41369214c43d05be4ac1a2ead2bc2b6c91cef275ad3c709f95350

    SHA512

    362970dcd9438c673c918d00541f7870f5c7eb31379cb9faac87cd5e10b7c9abba4f8a36692683e7f23905f2773fec9258836f5814c333fc97c676dc91d6c80a

    Download Submit

  • /data/data/cash.roast.must/app_DynamicOptDex/oat/Hklu.json.cur.prof
    Filesize

    1KB

    MD5

    3ed6290bf333ea6fff485bed8167921b

    SHA1

    9a37dd262b6b23d62746bb86fa7c8a6ef4f6d27d

    SHA256

    5669182363aeaf6ccae9c8a1159605e15197fe03980872128e3c29f773b348a1

    SHA512

    455b4fe335008df555f7fd7b51d764f085e587ee19753fc20307902f9e89208d5acf7e33e978f99a1a8f4b7bfe9075a4d0797cbd82f26370c58eb45843b1030a

    Download Submit

  • /data/user/0/cash.roast.must/app_DynamicOptDex/Hklu.json
    Filesize

    1.2MB

    MD5

    82e8d50c53fb5ff760a5f59e788cebc7

    SHA1

    158e4b5caffcd64fba0d4403ba18b96367f1e19a

    SHA256

    ac25087be7544139a03b468e5e49ec241119f528f16d8555238100b485a10db0

    SHA512

    2b7e6043c9ad853049bed6b475fe73a315109ccfdc7154a210122e3c2809c9764890c5bd4a2e3ab82aa7a668909eff5605950d443b1881fd1ee58e0df03495c5

    Download Submit