Analysis
-
max time kernel
150s -
max time network
152s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
08-02-2024 22:10
General
-
Target
f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60.apk
-
Size
1.5MB
-
MD5
5a36712612eb292e8630a5065450ce74
-
SHA1
d0523da40feab68ad37a223ec75dd92d45a914e2
-
SHA256
f900f93eb11648f815510895f6248f78411a89443c6e56918088aac366435a60
-
SHA512
bdc6177842395bfa3b646464e0cf09e97b86f4860943080cf3ef1bc62eef0c23f4cf1c410ab376e1f4509471220c05506cc777b8bf47a7d280beefb0e363b23a
-
SSDEEP
24576:clsDIZ2RLEQl7lhLbwi+EUswr6hVBKL0K1INKeFMxlhvJ:+Z4EybVrUCBQ0KmNKeSZh
Malware Config
Extracted
eventbot
http://pub.welcometothepub.com/gate_cb8a5aea1ab302f0_c
http://marta.martatovaglieri.it/gate_cb8a5aea1ab302f0_c
Signatures
-
EventBot
A new Android banking trojan started to appear in March 2020.
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes
-
com.e0eb62fe.b593a50f.a09cf785f41925004c251⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD57afe184da95882f56495c9e303d3f7e1
SHA1d086f24e67e53c6e961ab18ed2c1c12e0c4dd29c
SHA256fa2d7d2265cf4bd7dedbea30f6809710c110810fad5bde516ff050619726e03f
SHA5129167eca6aff4288fd883bc46984b330fef542117b94817ec95bd109a2d1905ca10e3bc9ae2c11d2e353edefa26d4839ca4d28d199638b3ca48a14a01592bd4c9
-
Filesize
107KB
MD52a7f3c76bc96e1be516bb973a67c15a6
SHA1178e6fbf065d70c07274fd7ca57261e30521eafc
SHA2565eb362d08c459dbccc2934786cd152a1625cc9279677c9e1e56b8d555eb23838
SHA512ea8b590ce9c6b552525509033b2693e20f5a5a258ae21efe5e2f578a5a5a133d8e69a355d25b5e33e777aeed43b8370844aeadf9bdcb2bb354bac8c9bbd0a7af
-
Filesize
261B
MD56595959847e949e2851c195ea3ac33aa
SHA1ac6414d85d1cbe91ab8360e46ce4daaff509562a
SHA256714ead911267c4174c6fe55bfd1be15ae474528913880e5a271bbc0f010fbc23
SHA5122516fe7ba3798abbee54e9e0c6e0f02d757b500632fcdf2d52a9343cd2ce3d6294c4321c49ecdd5e1d762889a744ccef9790d32536c92fb5411aec1824b5d1de