• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – North Korean HIDDEN COBRA Using HOPLIGHT Trojan
March 25, 2020
Rewterz Threat Alert – Fake CoronaAntivirus Distributing BlackNET remote administration tool
March 26, 2020

Rewterz Threat Alert – Eventbot- A new Mobile Banking Trojan

March 25, 2020

Severity

High

Analysis Summary

A new mobile banking Trojan Eventbot is currently targeting financial applications in Europe. Eventbot uses a completely new code structure, which is completely different from the currently known banking Trojans. The Eventbot Trojan tricks users into installing it by impersonating normal application icons. After it runs, it will upgrade and update by impersonating, hiding its icon to protect itself. The Eventbot Trojan monitors the user’s mobile phone through the Accessibility Service function, with more than 50 malicious functions. After running, it will issue instructions through the server to control the user’s mobile phone, such as: get and upload the user’s mobile phone text message, get and upload the user’s mobile phone configuration information, get and upload the user’s mobile phone’s installed application, and perform user’s mobile phone browser Inject, launch the specified APP of the user’s mobile phone, delete the specified application, update malicious plug-ins and other malicious behaviors.

cd7368ed558d3d30a9445fcf28cea8fa.png
3da05e5c0fbc5b272f021d93d6e6b495.png

Issue instructions through the server

Currently it affects a dozen banking apps in Britain, Germany, Italy, Spain and other countries, affecting a total of 234 financial applications.

Impact

  • Information theft
  • Exposure of sensitive information
  • Financial loss

Indicators of Compromise

MD5

  • 7f5d728119951839b46895808107b281
  • 66ae6bb78ed76b252c2ea6ec8072b0e8
  • 8a563b6af3cf74c8cbb88b99e104d949
  • e1229d332ca43ac2b640084a0dae9bbe
  • 8793359481ab88914b5e60625f57277c
  • 36988753860cd9f919b9d2a94c0af0fc
  • b3f4746a6c21d030d2b73ff2ac3cec2f
  • 664118a72533d9a0d60e9caba439fe28
  • 7107ac3bccd8db274b21f0e494e3eccc
  • f73f66b15791a42dac86d0ced46d660f

SHA-256

  • 7b1ac3a8caa556c9208d4db62395cca2f8a53420e5d51a1537bc45622e41b63f
  • b57d2cef4419ca3dfac736825dc0e444e52d22bb517ca185d415f13af856d966
  • 64b9f19911c2e4318048f81f2b32da7cbab0ce818594b2d181b323e0300a68ea

URL

  • http[:]//ora[.]carlaarrabitoarchitetto[.]com/gate_cb8a5aea1ab302f0_c
  • http[:]//ora[.]studiolegalebasili[.]com/gate_cb8a5aea1ab302f0_c
  • http[:]//themoil[.]site/gate_cb8a5aea1ab302f0_c

Remediation

  • Block all threat indicators at your respective controls.
  • Always install legitimate/ recommended applications from playstore.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.