Analysis
-
max time kernel
144s -
max time network
150s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
25/03/2025, 06:33
General
-
Target
b74b65f68641feb46d22fddb595fff57cba53f5e3d4d780f4b1bf9b2682a9230.apk
-
Size
4.1MB
-
MD5
9b08148a0dcd6b574b36f7c2e888aa03
-
SHA1
ec32912daa82f71824a8e2697138af5b293c30fd
-
SHA256
b74b65f68641feb46d22fddb595fff57cba53f5e3d4d780f4b1bf9b2682a9230
-
SHA512
6ad17bd34c4ae6553a0e3ac322cfe69a939dcce0b8cd260a4aac511a5b656aca03fc5ac0b7bef44bdb0d6cde1ec08d0427c7f79f10f7f8a5325f99da988bb326
-
SSDEEP
98304:OYKVlkqj2J5HhgIvqklGQxNhBXKIPzSMd9sshhj:OYDnOI8QxsIPzSMh
Malware Config
Signatures
-
TeaBot
TeaBot is an android banker first seen in January 2021.
-
TeaBot payload 1 IoCs
-
Teabot family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
cake.ice.reform1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD57166707a8ec26a384a4fab90ada876e9
SHA1527b8b7f519ccc43c39989cf57f8ff6a1efbed73
SHA256dcf5355ec39d7dac9f22d1bc0ca31c49f3813f71b0024c1e85732612cece1009
SHA512dacd0d5472de05184a1072e40ec11ad88bd7d5c2526b9188ee42502bbbfb696a56999faee2c8435cd38684ab32c5a69c0f9a504c73a493a1d107e76397e40d07
-
Filesize
1.1MB
MD5b3cfdb9e29dd0bd84a253cdfdd20a681
SHA11c0400a531147e097c2a84faba310f2a8519276d
SHA256e0e9ad92cf446106d79f55848ad0920b7b6a1f01913a69989b21ca3c7db26ff6
SHA512a794f62531fd24213a76d58c555967604b0f810ec50b03754dc52af244d39f328d0c10fc455dbc4387cd4980d202ec4e6ef7946abe965da1f7f722f3814d9fa7
-
Filesize
1003B
MD5fbdd44960206e26e9c4b9a67c97e2bfd
SHA1325f21febfe39a86b02250fefee79141120c1fd1
SHA256ad8a22e99b3ac490b3ff08ea37e3cf697e5eb465f195a6d9120684ff5ca2b4f9
SHA51290915572a5d392df1ec5d99743f76c2c69adf4280695114e49ef33140de3d74fddc77f54e569ad6020602ca13dded2abd6288ad2e3b10ce3e02f626355ca072b