General
- Target JaffaCakes118_238ca22d5900a4d7493b38a509343e48
- Size 4.2MB
- Sample250720-yca7cstrx4
- SHA256 20c320a93226dc886b24f98d72950da646e63914308f701412ce1dc684559c56
Score
10/10
Malware Config
Targets
-
- Target JaffaCakes118_238ca22d5900a4d7493b38a509343e48
- Size 4.2MB
- SHA256 20c320a93226dc886b24f98d72950da646e63914308f701412ce1dc684559c56
Score10/10-
TeaBot
TeaBot is an android banker first seen in January 2021.
-
TeaBot payload
-
Teabot family
-
Removes its main activity from the application launcher
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Acquires the wake lock
-
Performs UI accessibility actions on behalf of the user
Application may abuse the accessibility service to prevent their removal.
-
Queries the mobile country code (MCC)
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Impair Defenses
1Prevent Application Removal
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1