eventbot | 7b1ac3a8caa556c9208d4db62395cca2f8a53420e5d51a1537bc45622e41b63f

Analysis

max time kernel
33s
max time network
189s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
17-05-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7F5D728119951839B46895808107B281.apk
Size

1.9MB
MD5

7f5d728119951839b46895808107b281
SHA1

137219a5de551d2594899c3d208cdf9d1dbc43ab
SHA256

7b1ac3a8caa556c9208d4db62395cca2f8a53420e5d51a1537bc45622e41b63f
SHA512

20eb55e3fa949ec483bc7159ae0cfc7b7a6386771191f75e928be95607ba02aca40c03f5174981ae8911e7ebc057a84c64abbad6cb1cbf8ffd8c9d178ea8e7c8
SSDEEP

49152:T5GYWYc+DBlh8AJN7FA7Op6o4sY4sYe1hYIdh3GhUpeBw:VRDc+DhrpX3Y4szhr3aw

Score

10^/10

eventbot banker collection credential_access discovery evasion impact infostealer overlay stealth trojan

Malware Config

Extracted

Family

eventbot

http://ora.studiolegalebasili.com/gate_cb8a5aea1ab302f0_c

http://ora.carlaarrabitoarchitetto.com/gate_cb8a5aea1ab302f0_c

RC4_key

Signatures

EventBot
A new Android banking trojan started to appear in March 2020.
banker trojan infostealer overlay eventbot

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

Processes:

com.example.eventbot

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.example.eventbot

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.example.eventbot

pid process

5152 com.example.eventbot
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.example.eventbot

ioc pid process

/data/user/0/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar 5152 com.example.eventbot
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.example.eventbot

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.example.eventbot

pid	process
5152	com.example.eventbot

ioc	pid	process
/data/user/0/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar	5152	com.example.eventbot

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.example.eventbot

com.example.eventbot
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5152

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar

Filesize
46KB

MD5
38ca39254f9a46db520398546dcaf6e6

SHA1
b704089ecd20514ce6674e5c1c93cef5df4ecce9

SHA256
378dce8c0a1ea2ea03047f9eaf0c1b410056396f46732f2face099dd667dadcc

SHA512
cfc6972d5c6ceecccc3aa1bd786199b5ad14c0f6835b9a9072367a6d38575680b572483049f791101e96b41000b24b965a50cd18edb3da33709aa9e5818e482c

Download Submit
/data/user/0/com.example.eventbot/app_dex/f2d49596a51f0ed43a27f1f7f85117.jar

Filesize
99KB

MD5
4cfa48242962f332b1b3f94073210213

SHA1
f8672c1e699b460bcaf1a7f7dc9165a8af92284d

SHA256
e4f86dd8ce933d454d95b373fe0362b58704207517b1aa0663391819150de9d7

SHA512
965e6ba1ba3d748fd4b1e635e25248c5fa2fb0261e50d6a7e9fc84da0f1286ae01bdf134c301f6be58459854d23f8cd77c115ea80c6280dc96f0d7d4e31452bd

Download Submit