Analysis
-
max time kernel
149s -
max time network
149s -
platform
android-10_x64 -
resource
android-x64-20240910-en -
resource tags
-
submitted
25/03/2025, 06:46
General
-
Target
308854628ee791468c30ec49a0f48bf46a1ee9d615c3efa444506b43a0615e4d.apk
-
Size
3.7MB
-
MD5
90a2fd7bc45623939ac8e886cf37195a
-
SHA1
07954951921de3848a0da02ea019b0b55a124845
-
SHA256
308854628ee791468c30ec49a0f48bf46a1ee9d615c3efa444506b43a0615e4d
-
SHA512
567457082be6c24a1ae92418e18fb81d66936fdcc88ab6b9fe8d345fd47135c386374a0271f08914b7ad9b02a83c19f49099f1cfc481b94ac930b3d7b4296bcf
-
SSDEEP
98304:cbnNIQ3gphBl7dCCiDtooMaVtQjqtj9T6:cz6QwpbhiiaV6jqB92
Malware Config
Signatures
-
TeaBot
TeaBot is an android banker first seen in January 2021.
-
TeaBot payload 1 IoCs
-
Teabot family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
unknown.tooth.grass1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5fd37c7e65515558058e815e0db44554f
SHA107181108a24d6b8205ef284c57adb54a4fe9e37a
SHA25687e44b3a768f85477025d06a0a3ce18bd22914ad8c018aff3197c33867f76a9e
SHA5122eaff58e33c42f0696f1dddf2ead0c278e656dd4ead43da5814338ea5df07824da09ce30bad317fb72aee4f095b30ea2fdc877e67efc3e97cf171876f07a7ab3
-
Filesize
1.3MB
MD5275bfe426cdfd60a632e6eb91e7d8d36
SHA1d2ac07eb4466080737a1773db5f1650913487773
SHA2569ea022d82ef18a9b84bd2125c9028f03565770b3ce87ba9d372af3f7e213272c
SHA512ef6856dc3ddb6a1c942fc89d107fe030313f9002b3aed8aaa65c7a23c94c2c01ec4caf52c471abbeb59c7ae376cf978b031ea610e42bc0a94fa78548cf1113f5
-
Filesize
1KB
MD5834262a58f43c5e7b5f31752de9f933e
SHA1bf2ebe06645545f0c4201bd80544940c58b10ad3
SHA256608a52582d9e015f177a97bd74484d2e88c1a0422aea0e249df80842ce96babe
SHA512d48c1e2f5aca15644f67872a163725dbebc6922bdc0992c60abd4829f3f5c58adb92df05f519a4225c43c8858dc5f397ed2cd566145a71d5e5e945afa5dc0acd