General
-
Target
b117a9d504cf9b434fdd839e4cf70d4e1c5373c8443216644b2f2dc9f31c072a.bin
-
Size
1.5MB
-
Sample
240208-1ynqpabe7v
-
MD5
2fb11bb5e194b47eb2f2d09f6ffe0c39
-
SHA1
199d3ac8d452b121cbc41288f3d38111e32b9f4a
-
SHA256
b117a9d504cf9b434fdd839e4cf70d4e1c5373c8443216644b2f2dc9f31c072a
-
SHA512
6e0162dc347f201afc40607d70b3bf1761bc4d87ab3248fa232de1b8506a39979fb389699b54a71c29400a294b3cc142c8e0258ddb2f226b4dcd6ada29e1ceeb
-
SSDEEP
24576:m9ZlALcct8ScdIXaaabbSjcCDndGHfgOENKe4MxIljk+:gZlMccY8naHSnG/gOENKeHil4+
Malware Config
Extracted
eventbot
http://pub.welcometothepub.com/gate_cb8a5aea1ab302f0_c
http://marta.martatovaglieri.it/gate_cb8a5aea1ab302f0_c
Targets
-
-
Target
b117a9d504cf9b434fdd839e4cf70d4e1c5373c8443216644b2f2dc9f31c072a.bin
-
Size
1.5MB
-
MD5
2fb11bb5e194b47eb2f2d09f6ffe0c39
-
SHA1
199d3ac8d452b121cbc41288f3d38111e32b9f4a
-
SHA256
b117a9d504cf9b434fdd839e4cf70d4e1c5373c8443216644b2f2dc9f31c072a
-
SHA512
6e0162dc347f201afc40607d70b3bf1761bc4d87ab3248fa232de1b8506a39979fb389699b54a71c29400a294b3cc142c8e0258ddb2f226b4dcd6ada29e1ceeb
-
SSDEEP
24576:m9ZlALcct8ScdIXaaabbSjcCDndGHfgOENKe4MxIljk+:gZlMccY8naHSnG/gOENKeHil4+
Score10/10-
EventBot
A new Android banking trojan started to appear in March 2020.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Removes its main activity from the application launcher
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-