Analysis
-
max time kernel
149s -
max time network
159s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
08-02-2024 22:09
General
-
Target
35912d55de4afa5fad6a00b052c528ea1b9ff0e4a5e0709860c64544474423de.apk
-
Size
2.0MB
-
MD5
3d61adc35b5d166265a679a93825fda2
-
SHA1
480b016bab64cb8610559e485195f9476c37c56a
-
SHA256
35912d55de4afa5fad6a00b052c528ea1b9ff0e4a5e0709860c64544474423de
-
SHA512
514f949d8969cdd6fe7356944cb90f13b9f950d49691381e000670f1892c009c9bd74de79a92a66db3bebc4647765f2abfc1d4966f1ca15aab4b1a7509d39970
-
SSDEEP
49152:aB5aEfff1ZbAOS6V/kxtRNkr2LxPaQQFNKehF5LTdr1:ukEfff1ZbyGMx2r2LIQQbFNn
Malware Config
Extracted
eventbot
http://ora.blindsidefantasy.com/gate_cb8a5aea1ab302f0_c
http://rxc.rxcoordinator.com/gate_cb8a5aea1ab302f0_c
Signatures
-
EventBot
A new Android banking trojan started to appear in March 2020.
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Removes its main activity from the application launcher 2 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.example.eventbot1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD541564c28885f23ca5f0fb932c09db25c
SHA1885147009a28b36cfa8b07037dce071394b4c605
SHA256dd492b91ae1168d98a57c8112f0143694d5dcc4b6167be28aea2c3278b95de97
SHA512ac3d73878d1c22699368b74eec5ab838cc42939e3ae5079cfd2488e4d521efbd3c892e82ebc767c477d216b5231a77d13770fc493f4a0616ef32ca60c659d516
-
Filesize
137KB
MD5841d33a7e38bb50d7211d3c8aa81c913
SHA19f64063368aecc4a3feba069a50b4ef97added6e
SHA256133f40e9847d2ecafabae139be349b39397cda5e0982d3640fb1bd33eb992fb0
SHA512754326e195be4ba3fc347abf16b30a1c521b23f404d0a08a8f3398c67946b1535a898e73babed031f32991416bb0de550bf00e02bdc3f47ae145034d6e3b716f
-
Filesize
260B
MD59e7b55004dc64b045eaad4cd1eb85fa8
SHA1a6714f9a3bc60bb2db2c6af9cb0e38998d4ffa8e
SHA2569f003be1bd79d94069e718b4649acf5a3ad495cd4efb3d6b069bafc7ea36375d
SHA512a5e2a5387160a5f3544bdb72129251ab7564e775972f27bb9ecc0c461ec1e6096382fa066dd777692ce224c3e206d12da7b814201c582bc057822be56a836c4d