Add Quark malware analysis report for EventBot

[pulorsok]

EventBot Malware Family Analysis Report

This report analyses the EventBot malware family using Quark's rule classification. EventBot is an Android banking trojan and information stealer, first documented by Cybereason in March 2020, that abuses Android's accessibility service to harvest data from more than 200 banking, money-transfer and cryptocurrency-wallet applications, and reads incoming SMS to defeat two-factor authentication. This run did not generate a new rule for EventBot: the family's distinctive bytecode patterns (installed-app enumeration, SMS broadcast interception, and SMS-body exfiltration over HTTP) are already covered by Quark's existing rule set. Check here for the rule set details.

Quark's rule classification flagged 3 of 3 EventBot samples as high-risk in this experiment (detection rate 100%). Benign-cohort false-positive rate was not measured here. See tested APKs below.

Identified Well-Known Threats

This section uses MITRE ATT&CK Mobile as its reference taxonomy, anchored to the S0478 EventBot software entry. Of the 14 techniques documented for the family, Quark's static bytecode analysis surfaces the 3 listed below; see the coverage-gap notes at the end of this section for why the other 11 are not demonstrated here.

MITRE Technique	Real-world manifestation in EventBot
T1418 Software Discovery	Enumerating installed applications and persisting the inventory to shared preferences, so the operator can pick which banking apps to target
T1624.001 Broadcast Receivers	Registering an SMS broadcast receiver that fires on every incoming message and hands the intent to a parser
T1636.004 SMS Messages	Reading the SMS body out of the received intent and shipping it to the C2 over HTTP, defeating SMS-based two-factor authentication

All cluster representatives below were extracted from sample 05782e267bd62de78a3db22b1a83ddd3c72cbef95f5a5bc9defdd42a4f5786ec.apk, chosen as the representative sample whose detected behaviors most fully cover the documented profile of EventBot. The other 2 family samples were used to compute the detection-rate figure above.

Each section below corresponds to one technique from the table above. Within each section we first quote the MITRE definition, then walk through the call sequence and list the underlying rules.

1. T1418 Software Discovery

T1418 Software Discovery — attack.mitre.org

MITRE definition (T1418): Adversaries may attempt to get a listing of applications that are installed on a device.

Lcom/example/eventbot/func;regOnWeb — the routine that registers the freshly infected device with the operator's web panel — calls the helper Lcom/example/eventbot/func;getAllApps, which enumerates every installed application and writes the resulting list into shared preferences. The inventory is then included in the registration payload, letting the operator decide which of EventBot's 200-plus targeted banking apps are worth attacking on this device.

Behaviors detected by Quark:

• Get installed applications and put the list in shared preferences (Update setup.py to latest click version #170)
• Enumerate installed applications (Error on GitHub actions Windows VM #264)

2. T1624.001 Broadcast Receivers

T1624.001 Broadcast Receivers — attack.mitre.org

MITRE definition (T1624.001): Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an SMS message, device boot completion, or other device activities.

This section covers the trigger mechanism. Lcom/example/eventbot/func;doSMS is the broadcast-receiver entry point: it inspects the incoming intent's action to confirm an SMS-received broadcast, then dispatches to Lcom/example/eventbot/func;parseSMS. Because the receiver is bound to a system event rather than to app lifecycle, it runs whenever a message arrives, giving EventBot execution without the user opening the app.

Behaviors detected by Quark:

• Monitor the general action to be performed (fixs logo for being intercepted #25)
• Monitor incoming SMS message (Fix pytest.xml #234)
• Read SMS message from Intents (Version not update #260)

3. T1636.004 SMS Messages

T1636.004 SMS Messages — attack.mitre.org

MITRE definition (T1636.004): Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS provides no standard API to access SMS messages.

This section covers what the receiver collects, once triggered by the mechanism in the previous section. Lcom/example/eventbot/func;parseSMS extracts the message body from the intent and passes it to EventBot's HTTP sender, which posts it to the C2. This is the step that defeats SMS-based two-factor authentication: one-time codes are read and exfiltrated before or alongside the victim seeing them.

Behaviors detected by Quark:

• Monitor the general action to be performed (fixs logo for being intercepted #25)
• Get SMS message body and send it through http (Creation of option to print Report based on Label Rules #165)
• Monitor incoming SMS message (Fix pytest.xml #234)
• Read SMS message from Intents (Version not update #260)

Coverage-gap notes

The 11 MITRE techniques documented for EventBot that this report does NOT demonstrate, grouped by the reason Quark could not confirm them on these samples:

The rule's two APIs are both present, but no single method calls both (4) — Quark confirms a rule only when one method reaches both of its APIs, so it can trace the value from the first call into the second. For each technique below a rule exists and its APIs are present in the samples (Quark's stage 2 passes), but EventBot splits the work across separate small helpers, so stage 3 never finds a method holding both.

Technique	Rule that partially matched	Where it stopped
T1426 System Information Discovery	#33 Query the IMEI number, #38 Query the phone number	Both APIs present; no shared calling method
T1422 System Network Configuration Discovery	#59 Query the SIM card status	Both APIs present; no shared calling method
T1422.001 Internet Connection Discovery	#34 Query the current data network type	Both APIs present; no shared calling method
T1513 Screen Capture	screen-capture rules, matched in all three samples	Rules fired, but no method held enough of the chain to anchor a call sequence

Behavior confirmed, but every candidate representative sat in bundled library code (2) — the evidence exists and passed validation, but the methods holding it belong to third-party code, so attributing the behavior to EventBot would be wrong.

Technique	What was found	Why it was dropped
T1407 Download New Code at Runtime	Dynamic class loading plus method reflection, in the obfuscated sample	That sample's class names are ProGuard-minified, so its parents cannot be separated from shaded library code
T1437.001 Web Protocols	HTTP POST carrying the SMS body and sender address	The representative parent landed in the bundled HTTP stack. The underlying evidence still appears in this report — rule #165 is cited under T1636.004 above

No rule in the current pool targets the technique (2)

• T1521.001 Symmetric Cryptography and T1406 Obfuscated Files or Information — the rule pool currently contains no rule describing symmetric-encryption or payload-obfuscation behavior, so neither technique was exercised at all.

The samples do not exhibit the behavior (3) — these are honest non-detections rather than tooling limits. Cybereason documented EventBot as still under active development when discovered, and the capabilities below are absent from the builds in this cohort.

Technique	What the samples actually do	What the technique requires
T1417.001 Keylogging	Accessibility UI inspection — getRootInActiveWindow, reading node text and content descriptions	An input-capture primitive; reading the view tree is not the same as recording keystrokes
T1417.002 GUI Input Capture	Passive dimension queries (navigation-bar and status-bar heights)	An overlay window or input interception
T1655.001 Match Legitimate Name or Location	Hiding the launcher icon	Evidence of impersonating a specific legitimate app by name, icon or package; icon hiding alone is generic

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	05782E267BD62DE78A3DB22B1A83DDD3C72CBEF95F5A5BC9DEFDD42A4F5786EC
2	1A8C17AD1A790554278B055BDB946D4597BA9AF6BE3611EE6311B90C7F7848C5
3	E6E736DF1923C47F6624DAB18BF6A341995B5E756395256AA0B3F4C43594481A

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.29%. Comparing base (5facb9d) to head (1a7fac0).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #961   +/-   ##
=======================================
  Coverage   80.29%   80.29%           
=======================================
  Files          82       82           
  Lines        7192     7192           
=======================================
  Hits         5775     5775           
  Misses       1417     1417           

Flag	Coverage Δ
unittests	80.29% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[haeter525]

LGTM. Thanks.