eventbot | 8931d7629dec8b3eff9ff12db1311e50394fa79c9c28472b702fb3f44848a620

Analysis

max time kernel
152s
max time network
161s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
08/02/2024, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8931d7629dec8b3eff9ff12db1311e50394fa79c9c28472b702fb3f44848a620.apk
Size 2.0MB
Sample240208-1x7geabe51
SHA256 8931d7629dec8b3eff9ff12db1311e50394fa79c9c28472b702fb3f44848a620
MD5 de1c74d6c6d4f8fcc442fc9ec46a0e71
SHA1 9f5aa16b21ac77be6e6caff0ef2b1b9b84497f23
SHA512 b90fa6ee40984af30b4d0acf2c22c565279e84866176fda4d9314554f24eba5d47f549f170c19bf4701d68dc06861abd09486e5ee831311eb3fc8c86f9eaab81
SSDEEP 49152:osaCh0nqaff87CpAZ7QAfYxl/Vok6UNKepVLT+/Xk:8Jqaff87Cp6QjlSk6uxU0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

eventbot banker infostealer overlay stealth trojan

Malware Config

Extracted

Family

eventbot

http://ora.blindsidefantasy.com/gate_cb8a5aea1ab302f0_c
http://rxc.rxcoordinator.com/gate_cb8a5aea1ab302f0_c

AES_key

RC4_key

Signatures

EventBot
A new Android banking trojan started to appear in March 2020.
banker trojan infostealer overlay eventbot

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.eventbot

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.example.eventbot

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
5074	com.example.eventbot

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar	5074	com.example.eventbot

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.example.eventbot

com.example.eventbot
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5074

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

f2d49596a51f0ed43a27f1f7f85117.jar

Path /data/data/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar
Size 59KB
SHA256 dd492b91ae1168d98a57c8112f0143694d5dcc4b6167be28aea2c3278b95de97
MD5 41564c28885f23ca5f0fb932c09db25c
SHA1 885147009a28b36cfa8b07037dce071394b4c605
SHA512 ac3d73878d1c22699368b74eec5ab838cc42939e3ae5079cfd2488e4d521efbd3c892e82ebc767c477d216b5231a77d13770fc493f4a0616ef32ca60c659d516
SSDEEP 768:ATL9oOQJeTavaOuUlAZIvsDMRP90ck/yqWRiYjcMuloukDBybGa9My/WGM0q8vkz:AvUJOG9BR+3TCiYjypRbGa9Myt1/R0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f2d49596a51f0ed43a27f1f7f85117.jar.cur.prof

Path /data/data/com.example.eventbot/app_dex/oat/f2d49596a51f0ed43a27f1f7f85117.jar.cur.prof
Size 259B
SHA256 183270dbb1149e8f01301cf2f23dd2a0edadff0d4f99d8e5d5553af0ad33a4d2
MD5 b36ac415d142e469d0a5889ba914f542
SHA1 525add81ea4249923758de3ff6a2977ae0469370
SHA512 7f1b9be7911c9e08839817c550067bb657231aad637f317a4e03025e0da092eca1998b2c2dc09ff23912a5bbede1bf48a06e687a30922561bfd63f143f44d8f6
MD5 SHA1 SHA512