Extracted

• • Target
    88fd72ac0cdab37c74ce14901c5daf214bd54f64e0e68093526a0076df4e042f
  • Size 13.6MB
  • SHA256 88fd72ac0cdab37c74ce14901c5daf214bd54f64e0e68093526a0076df4e042f
  • MD5 b11c1a6879076cb9f82ac16599669fd2
  • SHA1 2306f4c193975b9e0f9cf2781c46970b2049beec
  • SHA512 0e6d9d741b12f2a10a08343cbb14e1b76f0cfcc426134d63d5f48d33d0bf5f4050ece5f25d27453a0d42c327e0be0ef36633601633de56ac01b39b85004d0978
  • SSDEEP 98304:6RSVkpoStV/z6moOp1PYlSx4DRSoyy6Ust9QDn:6sVfStV/z6moyPLx49fy6oGn
  • TLSH
    T155E65A1DECC0EF72E5550D3B4409E6B1F2670D66CDEB8BA11307EF3D648A20AA766D06
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionteabotimpactinfostealertrojan

  • Family: TeaBot

    TeaBot is an android banker first seen in January 2021.

    bankertrojaninfostealerteabot

  • TeaBot payload

  • Checks Android system properties for emulator presence.

    defense_evasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Checks the application is allowed to request package installs through the package installer

    Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

    defense_evasion

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3