Analysis
-
max time kernel
152s -
max time network
147s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system -
submitted
08-02-2024 22:10
Static task
static1
Behavioral task
behavioral1
Sample
f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60.apk
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral2
Sample
f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60.apk
Resource
android-x64-20231215-en
General
-
Target
f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60.apk
-
Size
1.5MB
-
MD5
5a36712612eb292e8630a5065450ce74
-
SHA1
d0523da40feab68ad37a223ec75dd92d45a914e2
-
SHA256
f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60
-
SHA512
bdc6177842395bfa3b646464e0cf09e97b86f4860943080cf3ef1bc62eef0c23f4cf1c410ab376e1f4509471220c05506cc777b8bf47a7d280beefb0e363b23a
-
SSDEEP
24576:clsDIZ2RLEQl7lhLbwi+EUswr6hVBKL0K1INKeFMxlhvJ:+Z4EybVrUCBQ0KmNKeSZh
Malware Config
Extracted
eventbot
http://pub.welcometothepub.com/gate_cb8a5aea1ab302f0_c
http://marta.martatovaglieri.it/gate_cb8a5aea1ab302f0_c
Signatures
-
EventBot
A new Android banking trojan started to appear in March 2020.
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
Processes:
com.e0eb62fe.b593a50f.a09cf785f41925004c25description ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.e0eb62fe.b593a50f.a09cf785f41925004c25 -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
Processes:
com.e0eb62fe.b593a50f.a09cf785f41925004c25description ioc process Framework service call android.content.pm.IPackageManager.getInstalledApplications com.e0eb62fe.b593a50f.a09cf785f41925004c25 -
Processes:
com.e0eb62fe.b593a50f.a09cf785f41925004c25pid process 4915 com.e0eb62fe.b593a50f.a09cf785f41925004c25 -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.e0eb62fe.b593a50f.a09cf785f41925004c25ioc pid process /data/user/0/com.e0eb62fe.b593a50f.a09cf785f41925004c25/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar 4915 com.e0eb62fe.b593a50f.a09cf785f41925004c25 -
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes:
com.e0eb62fe.b593a50f.a09cf785f41925004c25description ioc process Framework API call javax.crypto.Cipher.doFinal com.e0eb62fe.b593a50f.a09cf785f41925004c25
Processes
-
com.e0eb62fe.b593a50f.a09cf785f41925004c251⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.e0eb62fe.b593a50f.a09cf785f41925004c25/app_dex/f2d49596a51f0ed43a27f1f7f85117.jarFilesize
45KB
MD57afe184da95882f56495c9e303d3f7e1
SHA1d086f24e67e53c6e961ab18ed2c1c12e0c4dd29c
SHA256fa2d7d2265cf4bd7dedbea30f6809710c110810fad5bde516ff050619726e03f
SHA5129167eca6aff4288fd883bc46984b330fef542117b94817ec95bd109a2d1905ca10e3bc9ae2c11d2e353edefa26d4839ca4d28d199638b3ca48a14a01592bd4c9
-
/data/data/com.e0eb62fe.b593a50f.a09cf785f41925004c25/app_dex/oat/f2d49596a51f0ed43a27f1f7f85117.jar.cur.profFilesize
262B
MD56157312be85256d6d632cd68b089d5f8
SHA1600ceae219896d204ba85a3154905ff0ef9a6350
SHA256847b3ab6d1dd0d95b5701018a0e1b11c0adb0c0b31e5f230ed8ea845d7b162df
SHA5120dda15429901b56cd7849d089855badf2a401c597d9e3b9d7e5a72dbf2e3f18115403554f9c9d4ce533d77c4b4380f64f55e18f12d9b188a3da2c4f4a7e7962d
-
/data/user/0/com.e0eb62fe.b593a50f.a09cf785f41925004c25/app_dex/f2d49596a51f0ed43a27f1f7f85117.jarFilesize
107KB
MD52a7f3c76bc96e1be516bb973a67c15a6
SHA1178e6fbf065d70c07274fd7ca57261e30521eafc
SHA2565eb362d08c459dbccc2934786cd152a1625cc9279677c9e1e56b8d555eb23838
SHA512ea8b590ce9c6b552525509033b2693e20f5a5a258ae21efe5e2f578a5a5a133d8e69a355d25b5e33e777aeed43b8370844aeadf9bdcb2bb354bac8c9bbd0a7af