Teabot[.]apk | Triage™

General

Target
Teabot.apk
Size 2.8MB
Sample260411-p4tcksbs2w
SHA256 4067054f202cc8e87557915783d4468b54985c5cc7b0b57df98ffbb106475196
MD5 4642c7a56039a82d8268282802c2fee9
SHA1 6210e111a2c5dfbdb5d2c04fda48f4ca3d08b630
SHA512 85cf3f0ec3e0073a7228a5e8f15d6ff707b7e031c3f65340ca1f9a25b039dcbeeca0d019572706df33f4bc37b8d5dbe994c883cfbd1a460c91231f34517b2d30
SSDEEP 49152:DwgcICrG/hqSniYtN25YhcKWaCE5nduTMF5/9sIjZgKlN0q/uLSnls:crG/QQiYtEYhcKDC0ndWMP/9s8ZgyNlS
TLSH
T1EED533D27285FAB0C5ABD337A1B49967F51D0AF98304F38322847AA53EFBC445B29D50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Teabot.apk

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
Teabot.apk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Teabot.apk

File Explorer

Teabot.apk

.apk 2.8MB

Teabot.apk

SHA256 4067054f202cc8e87557915783d4468b54985c5cc7b0b57df98ffbb106475196
MD5 4642c7a56039a82d8268282802c2fee9
SHA1 6210e111a2c5dfbdb5d2c04fda48f4ca3d08b630
SHA512 85cf3f0ec3e0073a7228a5e8f15d6ff707b7e031c3f65340ca1f9a25b039dcbeeca0d019572706df33f4bc37b8d5dbe994c883cfbd1a460c91231f34517b2d30
SSDEEP 49152:DwgcICrG/hqSniYtN25YhcKWaCE5nduTMF5/9sIjZgKlN0q/uLSnls:crG/QQiYtEYhcKDC0ndWMP/9s8ZgyNlS
TLSH
T1EED533D27285FAB0C5ABD337A1B49967F51D0AF98304F38322847AA53EFBC445B29D50
MD5 SHA1 SHA512 SSDEEP TLSH

android

Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

281b5eb562757962894637a0186c5e172cc4af7f

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

Chains

Jan 1, 0001

trust.royal.vibrant

month.inmate.setup.FMmHqPhFjIiFpSpZqZa

month.inmate.setup.YYgLyEsCgInLsLjPxOpXjGxAkTuQoFhRuScLe

month.inmate.setup.DJfXgLyDxFyXzCfUdRkLhAiKkDqXkNuFnYmByJoKtUdKs

month.inmate.setup.util.FkaANaoAwiNapL3

month.inmate.setup.FWtOlCfOjYdKzEkQrTkKwPx

month.inmate.setup.TIrLoItFg

month.inmate.setup.FkaANaoAwiNapL4

month.inmate.setup.WMpXqLuTnMzDpXaEyYaRcEjGkCuNhUsRlSmWfNzZb

month.inmate.setup.TZqNlQbAiIjTqGmPfEqLuBnLeSoIgXuZhJlCy

month.inmate.setup.FkaANaoAwiNapL5

month.inmate.setup.GTqWxChWxLzRxIaSdMqThRzIsGyMtFkQdXc

month.inmate.setup.FkaANaoAwiNapL6

month.inmate.setup.PIqDiNsObTiMyOlUdErIaRhUjLzLrNiZp

month.inmate.setup.util.FkaANaoAwiNapL7

month.inmate.setup.RUtEiOqDsWsGcCiLuQyKtMkYdJoNgQjQkXmAyYyOmAfAjNsCuZd

month.inmate.setup.util.FkaANaoAwiNapL8

month.inmate.setup.CUgBoAu

month.inmate.setup.OFiHoGwHfHxGtRhId

month.inmate.setup.FkaANaoAwiNapL9

android.intent.action.MAIN

month.inmate.setup.AGyEhNjBiBbSl

month.inmate.setup.inject.FkaANaoAwiNapL10

month.inmate.setup.QGpXkPzYd

month.inmate.setup.FkaANaoAwiNapL11

month.inmate.setup.GZqQfPuMzLqJdWlFlSkYzWxKlOyZhHkTpSuMkFbUt

month.inmate.setup.util.FkaANaoAwiNapL12

month.inmate.setup.UNsOgOmMtJjHy

month.inmate.setup.FkaANaoAwiNapL13

android.intent.action.SEND android.intent.action.SENDTO

month.inmate.setup.MUiImWbTzEw

month.inmate.setup.JApEuZwSqEl

month.inmate.setup.SQyYeNaTxGiZhTpCiLoJbMrBoQgEjKwLf

month.inmate.setup.JNtSaIgAq

com.google.android.gms.common.api.GoogleApiActivity

month.inmate.setup.BFxFdBqTzEcDsHbIxWpBeHzDuYzLoUhPnEySzZhFtEr

month.inmate.setup.KLjZsCyTkJyYoTpJxShRfLqZlHhCdAqQqXxEr

month.inmate.setup.GAnZcFzXuTgUfKiWtDiUaZcOsAaQjDmGwCnOoUqUj

Android Permissions

Teabot.apk

Permissions

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_MMS

android.permission.SEND_SMS

android.permission.SET_WALLPAPER_HINTS

android.permission.READ_SMS

android.permission.REQUEST_DELETE_PACKAGES

android.permission.GET_PACKAGE_SIZE

android.permission.USE_BIOMETRIC

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.QUERY_ALL_PACKAGES

android.permission.RECEIVE_SMS

android.permission.WRITE_SMS

android.permission.USE_FULL_SCREEN_INTENT

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Teabot.apk

File Signature issue

month.inmate.setup.FMmHqPhFjIiFpSpZqZa

month.inmate.setup.YYgLyEsCgInLsLjPxOpXjGxAkTuQoFhRuScLe

month.inmate.setup.DJfXgLyDxFyXzCfUdRkLhAiKkDqXkNuFnYmByJoKtUdKs

month.inmate.setup.util.FkaANaoAwiNapL3

month.inmate.setup.FWtOlCfOjYdKzEkQrTkKwPx

month.inmate.setup.TIrLoItFg

month.inmate.setup.FkaANaoAwiNapL4

month.inmate.setup.WMpXqLuTnMzDpXaEyYaRcEjGkCuNhUsRlSmWfNzZb

month.inmate.setup.TZqNlQbAiIjTqGmPfEqLuBnLeSoIgXuZhJlCy

month.inmate.setup.FkaANaoAwiNapL5

month.inmate.setup.GTqWxChWxLzRxIaSdMqThRzIsGyMtFkQdXc

month.inmate.setup.FkaANaoAwiNapL6

month.inmate.setup.PIqDiNsObTiMyOlUdErIaRhUjLzLrNiZp

month.inmate.setup.util.FkaANaoAwiNapL7

month.inmate.setup.RUtEiOqDsWsGcCiLuQyKtMkYdJoNgQjQkXmAyYyOmAfAjNsCuZd

month.inmate.setup.util.FkaANaoAwiNapL8

month.inmate.setup.CUgBoAu

month.inmate.setup.OFiHoGwHfHxGtRhId

month.inmate.setup.FkaANaoAwiNapL9

month.inmate.setup.AGyEhNjBiBbSl

month.inmate.setup.inject.FkaANaoAwiNapL10

month.inmate.setup.QGpXkPzYd

month.inmate.setup.FkaANaoAwiNapL11

month.inmate.setup.GZqQfPuMzLqJdWlFlSkYzWxKlOyZhHkTpSuMkFbUt

month.inmate.setup.util.FkaANaoAwiNapL12

month.inmate.setup.UNsOgOmMtJjHy

month.inmate.setup.FkaANaoAwiNapL13

month.inmate.setup.MUiImWbTzEw

month.inmate.setup.JApEuZwSqEl

month.inmate.setup.SQyYeNaTxGiZhTpCiLoJbMrBoQgEjKwLf

month.inmate.setup.JNtSaIgAq

com.google.android.gms.common.api.GoogleApiActivity

month.inmate.setup.BFxFdBqTzEcDsHbIxWpBeHzDuYzLoUhPnEySzZhFtEr

month.inmate.setup.KLjZsCyTkJyYoTpJxShRfLqZlHhCdAqQqXxEr

month.inmate.setup.GAnZcFzXuTgUfKiWtDiUaZcOsAaQjDmGwCnOoUqUj

month.inmate.setup.FkaANaoAwiNapL0

month.inmate.setup.FkaANaoAwiNapL1

month.inmate.setup.FkaANaoAwiNapL2

month.inmate.setup.receiver.FkaANaoAwiNapL14

month.inmate.setup.receiver.FkaANaoAwiNapL15

month.inmate.setup.FkaANaoAwiNapL16

Android Permissions

Teabot.apk