Overview

overview

10

Static

static

7

1a8c17ad1a...c5.apk

android_x86

7

1a8c17ad1a...c5.apk

android_x64

10

1a8c17ad1a...c5.apk

android_x64

10

Analysis

  • max time kernel
    3616440s
  • max time network
    48s
  • platform
    android_x64
  • resource
    android-x64-arm64
  • submitted
    08-02-2022 00:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1a8c17ad1a790554278b055bdb946d4597ba9af6be3611ee6311b90c7f7848c5.apk

  • Size

    1.9MB

  • MD5

    7107ac3bccd8db274b21f0e494e3eccc

  • SHA1

    cae09a665075ce3f36347ffbb2ab3143d8183f67

  • SHA256

    1a8c17ad1a790554278b055bdb946d4597ba9af6be3611ee6311b90c7f7848c5

  • SHA512

    473fd5e2334d4433ac3a27d395b4952c576e140d956cf16d1ca49e712bd47fec908962179f8ec4cf3ebdeb4e8d3f0432e0a37101967e6601e6ea5b0565002b2e

Score
10/10
eventbotbankerinfostealeroverlayransomwaretrojan

Malware Config

Extracted

Family

eventbot

C2

http://ora.studiolegalebasili.com/gate_cb8a5aea1ab302f0_c

http://ora.carlaarrabitoarchitetto.com/gate_cb8a5aea1ab302f0_c
RC4_key
RC4_key
RC4_key

Signatures

  • EventBot

    A new Android banking trojan started to appear in March 2020.

    bankertrojaninfostealeroverlayeventbot
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.example.eventbot
    1⤵
    • Loads dropped Dex/Jar
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:5542

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.example.eventbot/app_dex/aaf8516625d397c5e9c69625f3b5523.jar
    MD5

    4cfa48242962f332b1b3f94073210213

    SHA1

    f8672c1e699b460bcaf1a7f7dc9165a8af92284d

    SHA256

    e4f86dd8ce933d454d95b373fe0362b58704207517b1aa0663391819150de9d7

    SHA512

    965e6ba1ba3d748fd4b1e635e25248c5fa2fb0261e50d6a7e9fc84da0f1286ae01bdf134c301f6be58459854d23f8cd77c115ea80c6280dc96f0d7d4e31452bd

    Download Submit
  • /data/user/0/com.example.eventbot/app_dex/aaf8516625d397c5e9c69625f3b5523.jar
    MD5

    4cfa48242962f332b1b3f94073210213

    SHA1

    f8672c1e699b460bcaf1a7f7dc9165a8af92284d

    SHA256

    e4f86dd8ce933d454d95b373fe0362b58704207517b1aa0663391819150de9d7

    SHA512

    965e6ba1ba3d748fd4b1e635e25248c5fa2fb0261e50d6a7e9fc84da0f1286ae01bdf134c301f6be58459854d23f8cd77c115ea80c6280dc96f0d7d4e31452bd

    Download Submit