Overview

overview

10

Static

static

6

f900f93eb1...60.apk

android-9-x86

10

f900f93eb1...60.apk

android-10-x64

10

f900f93eb1...60.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60.bin

  • Size

    1.5MB

  • Sample

    240208-13ctzsbg3y

  • MD5

    5a36712612eb292e8630a5065450ce74

  • SHA1

    d0523da40feab68ad37a223ec75dd92d45a914e2

  • SHA256

    f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60

  • SHA512

    bdc6177842395bfa3b646464e0cf09e97b86f4860943080cf3ef1bc62eef0c23f4cf1c410ab376e1f4509471220c05506cc777b8bf47a7d280beefb0e363b23a

  • SSDEEP

    24576:clsDIZ2RLEQl7lhLbwi+EUswr6hVBKL0K1INKeFMxlhvJ:+Z4EybVrUCBQ0KmNKeSZh

Score
10/10
eventbotandroidbankerevasioninfostealeroverlaystealthtrojan

Malware Config

Extracted

Family

eventbot

C2

http://pub.welcometothepub.com/gate_cb8a5aea1ab302f0_c

http://marta.martatovaglieri.it/gate_cb8a5aea1ab302f0_c
AES_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key
RC4_key

Targets

    • Target

      f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60.bin

    • Size

      1.5MB

    • MD5

      5a36712612eb292e8630a5065450ce74

    • SHA1

      d0523da40feab68ad37a223ec75dd92d45a914e2

    • SHA256

      f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60

    • SHA512

      bdc6177842395bfa3b646464e0cf09e97b86f4860943080cf3ef1bc62eef0c23f4cf1c410ab376e1f4509471220c05506cc777b8bf47a7d280beefb0e363b23a

    • SSDEEP

      24576:clsDIZ2RLEQl7lhLbwi+EUswr6hVBKL0K1INKeFMxlhvJ:+Z4EybVrUCBQ0KmNKeSZh

    Score
    10/10
    eventbotbankerevasioninfostealeroverlaystealthtrojan

    • EventBot

      A new Android banking trojan started to appear in March 2020.

      bankertrojaninfostealeroverlayeventbot

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

      banker

    • Removes its main activity from the application launcher

      stealthtrojan

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Acquires the wake lock

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks