Analysis
-
max time kernel
149s -
max time network
150s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
25/03/2025, 06:33
General
-
Target
b74b65f68641feb46d22fddb595fff57cba53f5e3d4d780f4b1bf9b2682a9230.apk
-
Size
4.1MB
-
MD5
9b08148a0dcd6b574b36f7c2e888aa03
-
SHA1
ec32912daa82f71824a8e2697138af5b293c30fd
-
SHA256
b74b65f68641feb46d22fddb595fff57cba53f5e3d4d780f4b1bf9b2682a9230
-
SHA512
6ad17bd34c4ae6553a0e3ac322cfe69a939dcce0b8cd260a4aac511a5b656aca03fc5ac0b7bef44bdb0d6cde1ec08d0427c7f79f10f7f8a5325f99da988bb326
-
SSDEEP
98304:OYKVlkqj2J5HhgIvqklGQxNhBXKIPzSMd9sshhj:OYDnOI8QxsIPzSMh
Malware Config
Signatures
-
TeaBot
TeaBot is an android banker first seen in January 2021.
-
TeaBot payload 1 IoCs
-
Teabot family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
cake.ice.reform1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD57166707a8ec26a384a4fab90ada876e9
SHA1527b8b7f519ccc43c39989cf57f8ff6a1efbed73
SHA256dcf5355ec39d7dac9f22d1bc0ca31c49f3813f71b0024c1e85732612cece1009
SHA512dacd0d5472de05184a1072e40ec11ad88bd7d5c2526b9188ee42502bbbfb696a56999faee2c8435cd38684ab32c5a69c0f9a504c73a493a1d107e76397e40d07
-
Filesize
1.1MB
MD5b3cfdb9e29dd0bd84a253cdfdd20a681
SHA11c0400a531147e097c2a84faba310f2a8519276d
SHA256e0e9ad92cf446106d79f55848ad0920b7b6a1f01913a69989b21ca3c7db26ff6
SHA512a794f62531fd24213a76d58c555967604b0f810ec50b03754dc52af244d39f328d0c10fc455dbc4387cd4980d202ec4e6ef7946abe965da1f7f722f3814d9fa7
-
Filesize
1KB
MD5b15f4a5965bd32eff92f8de9e9dc331e
SHA1098673a1df1d0baca2e66506fa56d2907864b44a
SHA256399c35cba43a382934adcf07d802c56c84dbd91040c20c5d8e4442266d8a4330
SHA5122910bb449d38832065cbd68bc6d765ccfcda15ecadc1d6eaee7efd0bf7204784196f1ad6f37b7d29033e16a259885a7b967bf6997d7b75e524703536b93a783f