Analysis
-
max time kernel
144s -
max time network
151s -
platform
android-11_x64 -
resource
android-x64-arm64-20240910-en -
resource tags
-
submitted
25/03/2025, 06:46
General
-
Target
308854628ee791468c30ec49a0f48bf46a1ee9d615c3efa444506b43a0615e4d.apk
-
Size
3.7MB
-
MD5
90a2fd7bc45623939ac8e886cf37195a
-
SHA1
07954951921de3848a0da02ea019b0b55a124845
-
SHA256
308854628ee791468c30ec49a0f48bf46a1ee9d615c3efa444506b43a0615e4d
-
SHA512
567457082be6c24a1ae92418e18fb81d66936fdcc88ab6b9fe8d345fd47135c386374a0271f08914b7ad9b02a83c19f49099f1cfc481b94ac930b3d7b4296bcf
-
SSDEEP
98304:cbnNIQ3gphBl7dCCiDtooMaVtQjqtj9T6:cz6QwpbhiiaV6jqB92
Malware Config
Signatures
-
TeaBot
TeaBot is an android banker first seen in January 2021.
-
TeaBot payload 1 IoCs
-
Teabot family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock 1 IoCs
-
Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
unknown.tooth.grass1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5fd37c7e65515558058e815e0db44554f
SHA107181108a24d6b8205ef284c57adb54a4fe9e37a
SHA25687e44b3a768f85477025d06a0a3ce18bd22914ad8c018aff3197c33867f76a9e
SHA5122eaff58e33c42f0696f1dddf2ead0c278e656dd4ead43da5814338ea5df07824da09ce30bad317fb72aee4f095b30ea2fdc877e67efc3e97cf171876f07a7ab3
-
Filesize
1.3MB
MD5275bfe426cdfd60a632e6eb91e7d8d36
SHA1d2ac07eb4466080737a1773db5f1650913487773
SHA2569ea022d82ef18a9b84bd2125c9028f03565770b3ce87ba9d372af3f7e213272c
SHA512ef6856dc3ddb6a1c942fc89d107fe030313f9002b3aed8aaa65c7a23c94c2c01ec4caf52c471abbeb59c7ae376cf978b031ea610e42bc0a94fa78548cf1113f5
-
Filesize
1KB
MD576309f6b572c8e067dc971c4b6eeb9bc
SHA1074b6d46c9550397836257908e6647cfa68cd30a
SHA25663c985fb58e37f97e8ab5631fd67b4818f91b0b836d3c1e758057dfe8749d9dd
SHA512f8a9bab1449a886472fa6afa1b338b74bee17c216fc8aaa3e371a226d40e93012f370e44472581761a41ba1b0210a7f58d436c94aefcbc863d70581ddb9400c2