Overview

overview

10

Static

static

6

b88e7421bc...d3.apk

android-9-x86

10

b88e7421bc...d3.apk

android-10-x64

10

b88e7421bc...d3.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f21bfd850f3ee651f35a0a763bf7e39777a0cb456d46c7d1715f80551ae515fa.zip

  • Size

    4.2MB

  • Sample

    250327-wdwhksxqw8

  • MD5

    c7d488cc8afcefefc13e82f04948fbb2

  • SHA1

    c22a3eb202a4a05a2a80a5ed52068ffe05b84abb

  • SHA256

    f21bfd850f3ee651f35a0a763bf7e39777a0cb456d46c7d1715f80551ae515fa

  • SHA512

    77ede7c37304e857c367e1dc9bf31d9d889b8f6d3930fd31406fd2bef723733f7724272d728ec543ed13b313f3dc6f97290eff3a145d8a2b31b86528cbb5e5cc

  • SSDEEP

    98304:+U/1hkJSyotSKA6i6Z/B/FWcLs+H+889BTytuN0WZKQX0pBt3jT0yYFm:+a1hkNo7zZ/B9WcHe889TN7ZK5X1Mm

Score
10/10
teabotandroidbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Targets

    • Target

      b88e7421bc61f4ce20c0694418fc97c1e77cfd3f2053857f87cc47512a55c3d3.apk

    • Size

      4.3MB

    • MD5

      7823e56b4b1631ef52bbd5b95c186554

    • SHA1

      f47ee24af407de1019e8605ad8f111732305fa5e

    • SHA256

      b88e7421bc61f4ce20c0694418fc97c1e77cfd3f2053857f87cc47512a55c3d3

    • SHA512

      ceac5d17b69d0297a7a83873705c46486894de70d45e33e64cf5971be05ac0dd07bda996fe9627bcc001aad9b954703de8028d296ed5113ff73ba02cce16a48e

    • SSDEEP

      98304:7vNrfTch74luHqnwV6vNQV5EGArGY4fBl7ZbfUZIOp6Py5df:7vNrfghUluKnRvKV5bk0B1ZAPhf

    Score
    10/10
    teabotbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencestealthtrojanimpact

    • TeaBot

      TeaBot is an android banker first seen in January 2021.

      bankertrojaninfostealerteabot

    • TeaBot payload

    • Teabot family

      teabot

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectiondefense_evasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Queries the mobile country code (MCC)

      discovery

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      defense_evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks