Cleafy Labs identified a TeaBot campaign that used a malicious dropper app on the Google Play Store to dynamically download a dex file and a secondary APK, performing multiple checks and evasion steps before installing the banking trojan. The final TeaBot payload unpacks an asset into a dex, removes traces, requests Accessibility permissions, and includes code to target the Revolut app for account takeover. #TeaBot #GooglePlay
Keypoints
- Initial infection vector: a malicious “PDF Reader: File Manager” dropper app published on Google Play (over 100k downloads) that requests install and storage permissions.
- Dropper performs two HTTP GETs to retrieve “muchaspuchas” (loader strings) and “cortina” (a .dex) which is dynamically loaded at runtime.
- The downloaded dex performs evasion and targeting checks, including emulator detection and ISO-3166-1 mobile operator country checks for a specific list of countries.
- If checks pass, the dropper displays a fake update prompt to trick users into installing a second APK (1.apk) containing the TeaBot components.
- The APK unpacks an asset file (rvkcc1.on) into a dex, imports the malicious code, deletes the unpacked dex, and then requests Accessibility permissions to enable account takeover (ATO) fraud.
- This campaign used modular dex rotation (multiple modified dex files observed between Feb 9–19, 2024) to evade detection and update payloads dynamically.
- The latest TeaBot sample includes dedicated code to interact with the Revolut application via accessibility features to retrieve app and balance information.
MITRE Techniques
- [T1195] Supply Chain Compromise – Initial infection via a malicious Google Play dropper app distributing TeaBot. ‘Initial infection vector: a malicious “PDF Reader: File Manager” dropper app published on Google Play (over 100k downloads) that requests install and storage permissions.’
- [T1105] Ingress Tool Transfer – The dropper downloads loader strings and a dex, then loads it at runtime. ‘Dropper performs two HTTP GETs to retrieve “muchaspuchas” (loader strings) and “cortina” (a .dex) which is dynamically loaded at runtime.’
- [T1204] User Execution – Fake update prompt to trick user into installing a second APK. ‘If checks pass, the dropper displays a fake update prompt to trick users into installing a second APK (1.apk) containing the TeaBot components.’
- [T1027] Obfuscated/Compressed Files and Information – Dex rotation to evade detection and update payloads dynamically. ‘This campaign used modular dex rotation (multiple modified dex files observed between Feb 9–19, 2024) to evade detection and update payloads dynamically.’
- [T1497] Virtualization/Sandbox Evasion – Emulator detection and country checks. ‘The downloaded dex performs evasion and targeting checks, including emulator detection and ISO-3166-1 mobile operator country checks for a specific list of countries.’
- [T1565.001] Accessibility Features Abuse – Accessibility permissions for account takeover fraud. ‘The APK unpacks an asset file (rvkcc1.on) into a dex, imports the malicious code, deletes the unpacked dex, and then requests Accessibility permissions to enable account takeover (ATO) fraud.’
- [T1070.004] Indicator Removal on Host: File Deletion – Delete unpacked dex to cover tracks. ‘deletes the unpacked dex, and then requests Accessibility permissions to enable account takeover (ATO) fraud.’
- [T1036] Masquerading – Use of a legitimate-sounding app name to disguise the dropper. ‘Initial infection vector: a malicious “PDF Reader: File Manager” dropper app published on Google Play.’
Indicators of Compromise
- [MD5 hashes] Dropper/dex/APK – a325ba7810b0791d2c6c4757ae4fe074 (dropper), 6a108e97eb659eded211f25eb6649989 (cortina .dex), and 1 more hash
- [Package name] Malicious dropper – com.tragisoap.fileandpdfmanager
- [Domains] Dropper server – https://befukiv.]com (as listed in the source)
- [IP addresses] TeaBot C2 servers – 185.215.113.]31, 91.215.85.]55 (as listed in the source)
- [File names] Payload/asset – 1.apk (TeaBot APK), rvkcc1.on (asset unpacked into a dex)
Read more: https://www.cleafy.com/cleafy-labs/a-stealthy-threat-uncovered-teabot-on-google-play-store