Overview

overview

10

Static

static

6

7861f53361...5b.apk

android-9-x86

10

7861f53361...5b.apk

android-10-x64

10

7861f53361...5b.apk

android-11-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7861f533612ed5bc7d098075ad1f2fef1648ff02ae12fd8b41fd49b6ac73c15b.bin

  • Size

    4.0MB

  • Sample

    250401-1x2wxsw1bz

  • MD5

    76d27f47fb0131c470eb637c201db4ca

  • SHA1

    1ef9d327534df860865273109070bd420780b739

  • SHA256

    7861f533612ed5bc7d098075ad1f2fef1648ff02ae12fd8b41fd49b6ac73c15b

  • SHA512

    845d2a2856c975adfd6c032e9738b87f11d5b75e3996fdcf3941b450e9b5811341e6506525e49c0efba6da6c60c8d279e0a343af8e582566ae76e4b73d61b798

  • SSDEEP

    98304:arWdNHQOiAjPWpgl1oUVifo5b60jaMdZ6NqIfs5D:aSb3jepg3oUVao5bjlZ6N7fsN

Score
10/10
teabotandroidbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Targets

    • Target

      7861f533612ed5bc7d098075ad1f2fef1648ff02ae12fd8b41fd49b6ac73c15b.bin

    • Size

      4.0MB

    • MD5

      76d27f47fb0131c470eb637c201db4ca

    • SHA1

      1ef9d327534df860865273109070bd420780b739

    • SHA256

      7861f533612ed5bc7d098075ad1f2fef1648ff02ae12fd8b41fd49b6ac73c15b

    • SHA512

      845d2a2856c975adfd6c032e9738b87f11d5b75e3996fdcf3941b450e9b5811341e6506525e49c0efba6da6c60c8d279e0a343af8e582566ae76e4b73d61b798

    • SSDEEP

      98304:arWdNHQOiAjPWpgl1oUVifo5b60jaMdZ6NqIfs5D:aSb3jepg3oUVao5bjlZ6N7fsN

    Score
    10/10
    teabotbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencestealthtrojanimpact

    • TeaBot

      TeaBot is an android banker first seen in January 2021.

      bankertrojaninfostealerteabot

    • TeaBot payload

    • Teabot family

      teabot

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectiondefense_evasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Queries the mobile country code (MCC)

      discovery

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      defense_evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks