Analysis
-
max time kernel
179s -
max time network
190s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
07-08-2024 22:04
General
-
Target
0fe3e54629332bddca26815d8245979e57136ca5f630a7b2ae4f1a5df50a16c9.apk
-
Size
1.9MB
-
MD5
99830c5ec772173dd7195dc06bd5351a
-
SHA1
d4f68573893ac058c68c62295baba60035d7873d
-
SHA256
0fe3e54629332bddca26815d8245979e57136ca5f630a7b2ae4f1a5df50a16c9
-
SHA512
c95ed5487ca6c1391efb55b76f1fce4e00b94f7de9c2b206b31e23a2d63b004ebd4cb0ce7e9116ddb7356cab661f8f376166bcbe5f81639005de55676a340b5a
-
SSDEEP
49152:INYAAUjW03xR0afeNBgZjASHn+saRrkVujUpeMB:INY7x0hCafeNBgZE8n+fguaB
Malware Config
Extracted
eventbot
http://rob.jmitchelldayton.com/gate_cb8a5aea1ab302f0_c
http://rob.alanrmarble.com/gate_cb8a5aea1ab302f0_c
Signatures
-
EventBot
A new Android banking trojan started to appear in March 2020.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.adce6cc0a0f3.bc37fe15ed1c.ebf1522a47725be81⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Reads the contacts stored on the device.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests enabling of the accessibility settings.
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Input Injection
1Virtualization/Sandbox Evasion
2System Checks
2Credential Access
Clipboard Data
1Input Capture
2GUI Input Capture
1Keylogging
1Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5f3545425e3bc2dc6587396ae73616574
SHA1286229c5e5a07d9a0431157c9d4b60495a9b0062
SHA2561357c8b331312e5c92c42eec34150196b37b25d0c65e81d572d903f23c6c32b7
SHA51247cf62adb6b69a8695a2df0124b4184ad823a8f7325f713330ad204764260fa33d0a5018572065b1c86322656be815f18f4e49f6c3a3ff02df19fdba0551775b
-
Filesize
114KB
MD579ff5c973a584f499dfb92eae438d909
SHA1758bf115a2c121099d637ea23a2b4b3c27095fc5
SHA256d552a0579e59a660ec12a3595a11e9fa0a3dc71eb3c22f9cfb86cd0be033bfe1
SHA512c800e8b8720ffbf9e14e680faed7bd5afe1897dc4b8228d40414375c4e0929496295390f150dfaf86c3a8c90b34213c68b4590b20c17a2f1b127d8beb417e8ee
-
Filesize
263B
MD5ca8c0207a24fe4a97f634a84186257ea
SHA13837a7c7d858104d210d2ff2d16c333ee5e3ec3f
SHA2560d3592530a6e0e380e64ad30103347465c9d287b7f9d2aeb464f8a70a4774f1c
SHA5127cde1cb28e108a0a38371e580b0d56d7b6da658d9eff2693336641aab65b4a8bc15bef266d3e57244123baee0374194a9ba22e4c50dbecc09b929c94836ca983