Rewterz Threat Alert – Eventbot- A new Mobile Banking Trojan

Severity

High

Analysis Summary

A new mobile banking Trojan Eventbot is currently targeting financial applications in Europe. Eventbot uses a completely new code structure, which is completely different from the currently known banking Trojans. The Eventbot Trojan tricks users into installing it by impersonating normal application icons. After it runs, it will upgrade and update by impersonating, hiding its icon to protect itself. The Eventbot Trojan monitors the user’s mobile phone through the Accessibility Service function, with more than 50 malicious functions. After running, it will issue instructions through the server to control the user’s mobile phone, such as: get and upload the user’s mobile phone text message, get and upload the user’s mobile phone configuration information, get and upload the user’s mobile phone’s installed application, and perform user’s mobile phone browser Inject, launch the specified APP of the user’s mobile phone, delete the specified application, update malicious plug-ins and other malicious behaviors.

Issue instructions through the server

Currently it affects a dozen banking apps in Britain, Germany, Italy, Spain and other countries, affecting a total of 234 financial applications.

Impact

• Information theft
• Exposure of sensitive information
• Financial loss

Indicators of Compromise

MD5

• 7f5d728119951839b46895808107b281
• 66ae6bb78ed76b252c2ea6ec8072b0e8
• 8a563b6af3cf74c8cbb88b99e104d949
• e1229d332ca43ac2b640084a0dae9bbe
• 8793359481ab88914b5e60625f57277c
• 36988753860cd9f919b9d2a94c0af0fc
• b3f4746a6c21d030d2b73ff2ac3cec2f
• 664118a72533d9a0d60e9caba439fe28
• 7107ac3bccd8db274b21f0e494e3eccc
• f73f66b15791a42dac86d0ced46d660f

SHA-256

• 7b1ac3a8caa556c9208d4db62395cca2f8a53420e5d51a1537bc45622e41b63f
• b57d2cef4419ca3dfac736825dc0e444e52d22bb517ca185d415f13af856d966
• 64b9f19911c2e4318048f81f2b32da7cbab0ce818594b2d181b323e0300a68ea

URL

• http[:]//ora[.]carlaarrabitoarchitetto[.]com/gate_cb8a5aea1ab302f0_c
• http[:]//ora[.]studiolegalebasili[.]com/gate_cb8a5aea1ab302f0_c
• http[:]//themoil[.]site/gate_cb8a5aea1ab302f0_c

Remediation

• Block all threat indicators at your respective controls.
• Always install legitimate/ recommended applications from playstore.