Teabot

TeaBot, also known as Anatsa, is a sophisticated Android banking Trojan that targets applications from over 650 financial institutions. It was first observed to use second-stage dropper applications that appear benign to users, deceiving them into installing the payload. TeaBot utilizes remote payloads retrieved from command-and-control (C2) servers to carry out further malicious activities. In addition, it employs various techniques to evade detection, including checking for virtual environments and emulators, as well as purposely corrupting the APK’s ZIP headers to hinder static analysis of the malware. In November 2023, researchers from ThreatFabric observed a resurgence of the TeaBot banking Trojan. This malware uses a method known as BadPack, common among Android-based banking Trojans like BianLian and Cerberus. Two fake Android applications were recently used to deploy TeaBot: a PDF reader app called ‘PDF Reader & File Manager’ and a QR code reader app called ‘QR Reader & File Manager.’ On the Google Play Store, the former’s front-end developer name appears as ‘TSARKA Watchfaces’ and the latter’s as ‘risovanui.’ Despite not being one of the most frequently used Android Trojans, TeaBot is considered one of the most sophisticated ones in the wild. It has been one of the most active banking malware families for Android in 2022, alongside other notorious families such as Flubot, Sharkbot, and Hydra. Measured by the number of banks targeted, TeaBot ranks among the top banking malware families, along with Hook and Godfather. Researchers from Zscaler ThreatLabz reported an uptick in malicious activity leveraging TeaBot on May 27, 2024.