Teabot

TeaBot, also known as Anatsa, is a sophisticated malware that has been impacting Android devices. It first emerged as a significant threat in 2022 when it was identified as one of the most active banking malware families alongside Flubot, Sharkbot, and Hydra. TeaBot, along with other notable banking Trojans like BianLian, Cerberus, and Hook, uses a technique called BadPack to infect Android devices without being detected. This method involves utilizing second-stage dropper applications that appear benign to users, thereby tricking them into installing the malicious payload. Unit 42 researchers have observed that many Android banking Trojans, including TeaBot, are increasingly using this stealthy approach. This trend has contributed to the surge in prevalence of Android banking Trojans in recent years. In addition to its stealthy infiltration methods, TeaBot employs various techniques to evade detection such as checking for virtual environments and emulators, and purposely corrupting the APK’s ZIP headers to hinder static analysis of the malware. Furthermore, TeaBot utilizes remote payloads retrieved from command-and-control (C2) servers to carry out further malicious activities. Zscaler ThreatLabz has recently identified two fake Android applications used to deploy TeaBot: a PDF reader app named 'PDF Reader & File Manager' and a QR code reader app named 'QR Reader & File Manager'. On the Google Play Store, these apps are listed under the developer names 'TSARKA Watchfaces' and 'risovanui', respectively. Despite not being the most prevalent Trojan, TeaBot's sophisticated evasion techniques and effective use of seemingly harmless applications make it one of the most potent threats in the wild.