eventbot | 456a30afdd95ffb47e3c1bd2901faba00bbf8d891247316e4c0b605157230787

Analysis

max time kernel
150s
max time network
149s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
08/02/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
456a30afdd95ffb47e3c1bd2901faba00bbf8d891247316e4c0b605157230787.apk
Size 1.5MB
Sample240208-1yllbsbe7s
SHA256 456a30afdd95ffb47e3c1bd2901faba00bbf8d891247316e4c0b605157230787
MD5 f06296f6994761b944578ae560cd01bd
SHA1 9c47dd853370f8906dc881bcbb42da636a019d34
SHA512 8c4f5d202a913e0eacf44819dde567af2200991369bc09fa67cadb68b75c2a835f88577a979f15e1b08a042af17c62a4bd09455278a68805f76b1e9366af5718
SSDEEP 24576:RO19CIfcbV5NzZnRBWmtz5IAlyIKzaBDh4zLEavNKeNMqE/+5:ROlfcJnzZnRBWmJ55owh4PEavNKeaP/8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

eventbot banker evasion infostealer overlay stealth trojan

Malware Config

Extracted

Family

eventbot

http://ora.blindsidefantasy.com/gate_cb8a5aea1ab302f0_c
http://rxc.rxcoordinator.com/gate_cb8a5aea1ab302f0_c

AES_key

RC4_key

Signatures

EventBot
A new Android banking trojan started to appear in March 2020.
banker trojan infostealer overlay eventbot

Makes use of the framework's Accessibility service 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4610	com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar	4610	com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203
/data/user/0/com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar	4610	com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203

com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203
1⤵
- Makes use of the framework's Accessibility service
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4610

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

f2d49596a51f0ed43a27f1f7f85117.jar

Path /data/user/0/com.a3f9a22cac6428ba.ac838c1c2aa02a78d5.b2d28c353aa91a3203/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar
Size 107KB
SHA256 5eb362d08c459dbccc2934786cd152a1625cc9279677c9e1e56b8d555eb23838
MD5 2a7f3c76bc96e1be516bb973a67c15a6
SHA1 178e6fbf065d70c07274fd7ca57261e30521eafc
SHA512 ea8b590ce9c6b552525509033b2693e20f5a5a258ae21efe5e2f578a5a5a133d8e69a355d25b5e33e777aeed43b8370844aeadf9bdcb2bb354bac8c9bbd0a7af
SSDEEP 3072:1x+ednAM47d0OathEmJaJERwSe4l42fB0JShCs/fyEN:1xnnAM4h0OathEmJaJ9Se4l42fB0U1fR
MD5 SHA1 SHA512 SSDEEP

Download