Analysis
-
max time kernel
149s -
max time network
152s -
platform
android-9_x86 -
resource
android-x86-arm-20240910-en -
resource tags
-
submitted
25/03/2025, 06:33
General
-
Target
b74b65f68641feb46d22fddb595fff57cba53f5e3d4d780f4b1bf9b2682a9230.apk
-
Size
4.1MB
-
MD5
9b08148a0dcd6b574b36f7c2e888aa03
-
SHA1
ec32912daa82f71824a8e2697138af5b293c30fd
-
SHA256
b74b65f68641feb46d22fddb595fff57cba53f5e3d4d780f4b1bf9b2682a9230
-
SHA512
6ad17bd34c4ae6553a0e3ac322cfe69a939dcce0b8cd260a4aac511a5b656aca03fc5ac0b7bef44bdb0d6cde1ec08d0427c7f79f10f7f8a5325f99da988bb326
-
SSDEEP
98304:OYKVlkqj2J5HhgIvqklGQxNhBXKIPzSMd9sshhj:OYDnOI8QxsIPzSMh
Malware Config
Signatures
-
TeaBot
TeaBot is an android banker first seen in January 2021.
-
TeaBot payload 1 IoCs
-
Teabot family
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
cake.ice.reform1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD57166707a8ec26a384a4fab90ada876e9
SHA1527b8b7f519ccc43c39989cf57f8ff6a1efbed73
SHA256dcf5355ec39d7dac9f22d1bc0ca31c49f3813f71b0024c1e85732612cece1009
SHA512dacd0d5472de05184a1072e40ec11ad88bd7d5c2526b9188ee42502bbbfb696a56999faee2c8435cd38684ab32c5a69c0f9a504c73a493a1d107e76397e40d07
-
Filesize
1.1MB
MD5b3cfdb9e29dd0bd84a253cdfdd20a681
SHA11c0400a531147e097c2a84faba310f2a8519276d
SHA256e0e9ad92cf446106d79f55848ad0920b7b6a1f01913a69989b21ca3c7db26ff6
SHA512a794f62531fd24213a76d58c555967604b0f810ec50b03754dc52af244d39f328d0c10fc455dbc4387cd4980d202ec4e6ef7946abe965da1f7f722f3814d9fa7
-
Filesize
1KB
MD5ec87d65798ca835e530bf754ac904d8f
SHA1085fb9c7fdd0cbe102668188ce1505cc630693ef
SHA2563529855baa53ce8810c6d9aa84c8fbaa7d93d2e6cee15371dcdf279a7c46c4e4
SHA512c37084993e802ca28459ba1947e0a5005cf883cb22201149edac25383637744fea46707c874e291b030c776a862ec23283cac13032fb4114803bd1bf5d5ef5a8