Overview

overview

10

Static

static

6

dc9383a0fb...81.apk

android-10-x64

dc9383a0fb...81.apk

android-11-x64

dc9383a0fb...81.apk

android-13-x64

10

dc9383a0fb...81.apk

android-9-x86

Resubmissions

11/09/2024, 15:29

240911-sw191aycrc 10

30/05/2024, 22:25

240530-2cerbsbf8z 1

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240624-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240624-enlocale:en-usos:android-13-x64system
  • submitted
    11/09/2024, 15:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc9383a0fb77ca5f6d416dfe0945a6278741f928013f863b97ce159d09718a81.apk

  • Size

    2.3MB

  • MD5

    cb02f9e5a5671e3f13bc26d3017b8632

  • SHA1

    ec5d64e0387a9492aad66e60bf393728e7e91e80

  • SHA256

    dc9383a0fb77ca5f6d416dfe0945a6278741f928013f863b97ce159d09718a81

  • SHA512

    58bc9fc7940a214712bfb42ddfc66a83915b8a8cd056c1793b91d81fee26dce93da67f1a5d9b62994f0b02e9ed8bf249711c93aa6e835aa641fcd278dd05a339

  • SSDEEP

    49152:wN6L08xEmWoVuzsio0XOpWKG9v4tydxw9QMStBhyOXbDf9tKHxtg:nL0UEwVOsipXOYdv4tyPwRSt7TltKHxu

Score
10/10
teabotbankercollectioncredential_accessdiscoveryevasionimpactinfostealertrojan

Malware Config

Extracted

Family

teabot

C2

http://91.215.85.55:85/api/

http://193.107.109.44:85/api/

Signatures

  • TeaBot

    TeaBot is an android banker first seen in January 2021.

    bankertrojaninfostealerteabot
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 23 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    evasion
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.nfctnofxy.tmzcwkcjd
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Obtains sensitive information copied to the device clipboard
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Checks CPU information
    • Checks memory information
    PID:4352

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

1
T1628

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

Software Discovery

1
T1418

Security Software Discovery

1
T1418.001

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nfctnofxy.tmzcwkcjd/app_app_dex/xrmmglv.ghw
    Filesize

    725KB

    MD5

    3d30a08a66e640bf0f9c6a7890cc264b

    SHA1

    0644bb70559320178b49af8f7e096695d42cc833

    SHA256

    5a2c044b73615afb583fb4400c3b2a4984d141df3fa9f8412280f15849b8dd37

    SHA512

    156e84dd6ba8bd517de8c1360ae6331bff2a53fbc1beb109a0be48984647ccbd209168c2cf4fce7c8d8c1993365d1ee3a55f9a1c64c8e437257725d1c44548ac

    Download Submit