Overview

overview

10

Static

static

6

b88e7421bc...d3.apk

android-9-x86

10

b88e7421bc...d3.apk

android-10-x64

10

b88e7421bc...d3.apk

android-11-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    27/03/2025, 17:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b88e7421bc61f4ce20c0694418fc97c1e77cfd3f2053857f87cc47512a55c3d3.apk

  • Size

    4.3MB

  • MD5

    7823e56b4b1631ef52bbd5b95c186554

  • SHA1

    f47ee24af407de1019e8605ad8f111732305fa5e

  • SHA256

    b88e7421bc61f4ce20c0694418fc97c1e77cfd3f2053857f87cc47512a55c3d3

  • SHA512

    ceac5d17b69d0297a7a83873705c46486894de70d45e33e64cf5971be05ac0dd07bda996fe9627bcc001aad9b954703de8028d296ed5113ff73ba02cce16a48e

  • SSDEEP

    98304:7vNrfTch74luHqnwV6vNQV5EGArGY4fBl7ZbfUZIOp6Py5df:7vNrfghUluKnRvKV5bk0B1ZAPhf

Score
10/10
teabotbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Signatures

  • TeaBot

    TeaBot is an android banker first seen in January 2021.

    bankertrojaninfostealerteabot
  • TeaBot payload 2 IoCs
  • Teabot family
    teabot
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access
  • Acquires the wake lock 1 IoCs
  • Performs UI accessibility actions on behalf of the user 1 TTPs 7 IoCs

    Application may abuse the accessibility service to prevent their removal.

    evasion
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
    defense_evasion
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • angry.grant.doll
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4223
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/angry.grant.doll/app_DynamicOptDex/oat/x86/XPOZLH.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4248

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/angry.grant.doll/app_DynamicOptDex/XPOZLH.json
    Filesize

    1.2MB

    MD5

    9299a922d35a418fab1821203569c9b8

    SHA1

    15464cd438cf88b63a1fa244f2433c35578f02ff

    SHA256

    2e87ff9e0d7e79efbeb27e5f1f0041a81f2b1ba8359c4cacfeaba341cefbf48f

    SHA512

    ad942f3b3c3a287f87e79b193146ba5b8d8f036921906a536ab744933ae323a853870da55da6b4f0e0cf52bcce75da178455f50f624a38d5c8353c855cf62162

    Download Submit

  • /data/data/angry.grant.doll/app_DynamicOptDex/XPOZLH.json
    Filesize

    1.2MB

    MD5

    e568315f15f0f3af927ef6348c635820

    SHA1

    62a4a8fe65af1866b983c94bd57645880df2cd93

    SHA256

    b2d15b080782f826b9d131a6188575bbbe9011d4c99dec87b73d7d34f1de96c9

    SHA512

    d71afcae4cf2741cdb90b0ae04a034783db82e4052e0a84f6ed35efb340fc11c22186356ea13f3fc46c084e42f87bf348cb37644c0a00b4327ec52fd792deb0c

    Download Submit

  • /data/data/angry.grant.doll/app_DynamicOptDex/oat/XPOZLH.json.cur.prof
    Filesize

    1KB

    MD5

    866cf9be370d35aa1cea018e9b11704a

    SHA1

    645b01293140446b75ffdc49db0df7a6efb13a1a

    SHA256

    dba9b531f6569309e666bf4d90915acb0508a291a995744822f2c6e5434d9fb4

    SHA512

    a8a5ed1644b67f30e0e1e1b015f16e736b87e65f4e80a677656e7666bdbbc2209b853462e7bbfe23dea1f15d8ec23d65b5a87f7385df19973626943c0d121dee

    Download Submit

  • /data/user/0/angry.grant.doll/app_DynamicOptDex/XPOZLH.json
    Filesize

    1.2MB

    MD5

    f265547951bc636961eda1df41709303

    SHA1

    cb5f9a922fdf9da72168166f9d257d851a3b3509

    SHA256

    7d0f41d996f66fc225ab19914d5992ae3e5d675d9ab728acb1f55d56303b0959

    SHA512

    0550597d17a3078ac0813fd22bb94b43118a3c7894e2e945e9a3797ef38da97e5be547db6ac475cbee453f577499663a24711b604e993bcb7a09f759199f0d44

    Download Submit