eventbot | 8931d7629dec8b3eff9ff12db1311e50394fa79c9c28472b702fb3f44848a620

Analysis

max time kernel
148s
max time network
157s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
08-02-2024 22:02

Target

8931d7629dec8b3eff9ff12db1311e50394fa79c9c28472b702fb3f44848a620.apk
Size

2.0MB
MD5

de1c74d6c6d4f8fcc442fc9ec46a0e71
SHA1

9f5aa16b21ac77be6e6caff0ef2b1b9b84497f23
SHA256

8931d7629dec8b3eff9ff12db1311e50394fa79c9c28472b702fb3f44848a620
SHA512

b90fa6ee40984af30b4d0acf2c22c565279e84866176fda4d9314554f24eba5d47f549f170c19bf4701d68dc06861abd09486e5ee831311eb3fc8c86f9eaab81
SSDEEP

49152:osaCh0nqaff87CpAZ7QAfYxl/Vok6UNKepVLT+/Xk:8Jqaff87Cp6QjlSk6uxU0

Score

10^/10

Family

eventbot

http://ora.blindsidefantasy.com/gate_cb8a5aea1ab302f0_c

http://rxc.rxcoordinator.com/gate_cb8a5aea1ab302f0_c

AES_key

RC4_key

EventBot
A new Android banking trojan started to appear in March 2020.
banker trojan infostealer overlay eventbot

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.example.eventbot

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.eventbot

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs
banker

Processes:

com.example.eventbot

description ioc process

Framework service call android.content.pm.IPackageManager.getInstalledApplications com.example.eventbot
Removes its main activity from the application launcher 2 IoCs
stealth trojan

Processes:

com.example.eventbot

pid process

4520 com.example.eventbot
4520 com.example.eventbot

description	ioc	process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.example.eventbot

pid	process
4520	com.example.eventbot
4520	com.example.eventbot

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.example.eventbot

ioc	pid	process
/data/user/0/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar	4520	com.example.eventbot
/data/user/0/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar	4520	com.example.eventbot

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
evasion

Processes:

com.example.eventbot

description ioc process

Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.example.eventbot
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

Processes:

com.example.eventbot

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.example.eventbot

description	ioc	process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.example.eventbot

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.example.eventbot

/data/user/0/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar
Filesize
59KB

MD5
41564c28885f23ca5f0fb932c09db25c

SHA1
885147009a28b36cfa8b07037dce071394b4c605

SHA256
dd492b91ae1168d98a57c8112f0143694d5dcc4b6167be28aea2c3278b95de97

SHA512
ac3d73878d1c22699368b74eec5ab838cc42939e3ae5079cfd2488e4d521efbd3c892e82ebc767c477d216b5231a77d13770fc493f4a0616ef32ca60c659d516

Download Submit
/data/user/0/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar
Filesize
137KB

MD5
841d33a7e38bb50d7211d3c8aa81c913

SHA1
9f64063368aecc4a3feba069a50b4ef97added6e

SHA256
133f40e9847d2ecafabae139be349b39397cda5e0982d3640fb1bd33eb992fb0

SHA512
754326e195be4ba3fc347abf16b30a1c521b23f404d0a08a8f3398c67946b1535a898e73babed031f32991416bb0de550bf00e02bdc3f47ae145034d6e3b716f

Download Submit