7b1ac3a8caa556c9208d4db6…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

EventBot. Android banking trojan whose C2 URLs sit as http(s) const-strings in the static initializer of the /example/eventbot/cfg config class. Indicators: http://ora.studiolegalebasili.com/gate_cb8a5aea1ab302f0_c, http://ora.carlaarrabitoarchitetto.com/gate_cb8a5aea1ab302f0_c.

Recovered configuration

package

com.example.eventbot

Identification

SHA-256: 7b1ac3a8caa556c9208d4db62395cca2f8a53420e5d51a1537bc45622e41b63f
MD5: 7f5d728119951839b46895808107b281

Observed

Families: EventBot
First seen: 2020-03-19

C2 configuration (2)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
ora.carlaarrabitoarchitetto.com/gate_cb8a5aea1ab302f0_c	domain	-	http	EventBot	2020-03-19
ora.studiolegalebasili.com/gate_cb8a5aea1ab302f0_c	domain	-	http	EventBot	2020-03-19

Signing certificate

Subject CN: Android
Issuer CN: Android
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About EventBot

Android banking trojan whose C2 URLs sit as http(s) const-strings in the static initializer of the /example/eventbot/cfg config class.