Teabot

the malware authors are believed to have paid to appear in Google Ads served within other legitimate applications and games

Reports suggest that hackers have used the Google Play store to distribute the “dropper applications”.

With the help of Scam Alert, we've seen how this malicious SMS now informs users of potential problems with parcel delivery and tells users that Flash player needs an update, that they have a missed voice mail or that some Android component needs upgrading.

Such an SMS comprises an information (e.g. missed call) and a link to follow.

They have an arsenal of other commands available, including sending an SMS with content provided by the command and control (CnC).

The app itself presents a fake UI saying that an update is required, and users are instructed to allow the Android app to install third-party packages.

Once the victims install and open the app through the Google Play store, the app gives a pop-up message that an update must be installed. When victims click on install, the application downloads the dropper and installs another application on the victim’s device.

Teabot’s attack chain clearly states that attackers have been working on the sideloading and evasive techniques which start from the initial dropper application to the hosting of the malicious payload.

this malicious apk decrypts the malicious payload file called kbu.json from the app’s assets folder to an executable dex format named ‘kbu.odex’ and loads the decrypted file

During the installation, it also asks for Accessibility services permission to get necessary privileges.

During the installation, it also asks for Accessibility services permission to get necessary privileges.

The apps were programmed to download an "update" followed by prompting users to grant them Accessibility Service privileges and permissions to install apps from unknown third-party sources.

A full detailed report on how threat Actors used strong obfuscation techniques to evade antivirus software was published by Cleafy.

In August 2021, they matched a voicemail theme by resembling messages that network carriers send on missed calls. This changed in September 2021 when SMS texts started to abuse the DHL brand.

This malware also terminates the predefined list of apps process(es)... that list includes a few popular security products... in order to remain undetected.

this malicious apk decrypts the malicious payload file called kbu.json from the app’s assets folder to an executable dex format named ‘kbu.odex’ and loads the decrypted file

When the user starts the Android app, it also starts a background service that checks the country code of the current registered operator... If the country starts with a 'U' or is unavailable, the app skips executing the malicious code.

The malicious code within the app has a minimal footprint, as the authors were careful about not triggering security heuristics.

Teabot’s attack chain clearly states that attackers have been working on the sideloading and evasive techniques which start from the initial dropper application to the hosting of the malicious payload.

this malicious apk decrypts the malicious payload file called kbu.json from the app’s assets folder to an executable dex format named ‘kbu.odex’ and loads the decrypted file

This permission is acquired to view and control the screen on the victim’s device which is used for obtaining login credentials, 2FA codes, and to read SMS.

Abusing the Android Accessibility Service, this Trojan acts as a keylogger to steal all the victim’s information on the device.

the malware C2 sends the specific payload(s) to the victim device to perform an overlay attack and track all the activity related to the identified targeted application(s).

Retrieve window content Used to retrieve sensitive information such as login credentials, SMS, 2FA codes from authentication apps, etc.

When the user starts the Android app, it also starts a background service that checks the country code of the current registered operator... If the country starts with a 'U' or is unavailable, the app skips executing the malicious code.

Teabot enumerates all the installed applications on the victim’s device and then sends the list of installed apps from the victim’s device to the C2 server during its first communication.

This permission is acquired to view and control the screen on the victim’s device which is used for obtaining login credentials, 2FA codes, and to read SMS.

Abusing the Android Accessibility Service, this Trojan acts as a keylogger to steal all the victim’s information on the device.

the malware C2 sends the specific payload(s) to the victim device to perform an overlay attack and track all the activity related to the identified targeted application(s).

Other features of the trojan included Remote access capabilities and screen capturing via request-on-demand services.

The PTI team has de-anonymized the C&C server and discovered that Toddler has already infected more than 7,632 devices at the time of this report.

By analyzing TeaBot network communications, it was possible to group them into the following three main types: [C2-URL]/api/botupdate ... [C2-URL]/api/getkeyloggers ... [C2-URL]/api/getbotinjects

A message instructs the target to download a third-party application by clicking a download button. As of September 2021, these downloads are either Flubot or in some cases Teabot.

Other features of the trojan included Remote access capabilities and screen capturing via request-on-demand services.

All the communications between C2 and the malware remain encrypted using an XOR key

Some of the malicious features include Key logging, Disabling Google Play Protect...