Malware

EventBot

EventBot is an Android banking trojan focused on financial fraud and credential theft. It is known for impersonating legitimate mobile applications through the use of trusted-looking icons, then abusing Android accessibility features and overlay-style prompts to harvest sensitive information from victims. The malware can display popups over running applications, capture user input such as the device screen PIN through accessibility abuse, and intercept SMS messages, enabling theft of one-time passcodes and other authentication data commonly used in banking workflows.

On infected devices, EventBot performs host profiling and reconnaissance by collecting installed application lists, device network information, and system details including operating system version, device vendor, and active screen-lock type. It communicates with command-and-control infrastructure over HTTP, allowing operators to manage infections and receive stolen data. EventBot also establishes persistence by registering for Android boot events so it can automatically start after device reboot.

EventBot is widely tracked as part of the Android mobile banking malware ecosystem and is frequently discussed alongside other financially motivated Android banking trojans such as Exobot, Cerberus, Alien, BlackRock, and TeaBot. Its combination of accessibility abuse, SMS interception, deceptive application presentation, and application-aware targeting makes it a notable example of modern Android banking malware aimed at account takeover and financial theft.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

3 techniques

T1546Event Triggered ExecutionEvidence1

A malicious application could create an application overlay window on top of a running legitimate application.

T1546.008Accessibility FeaturesEvidence1

TeaBot, during its first communications with the C2, sends the list of installed apps to verify if the infected devices had one or more targeted apps already installed. When TeaBot found one of them, it downloads the specific payload to perform overlay attacks and starts tracking all the activity performed by the user on the targeted app.

T1547Boot or Logon Autostart ExecutionEvidence1

EventBot registers for the BOOT_COMPLETED intent to auto-start after the device boots. Pegasus for Android listens for the BOOT_COMPLETED broadcast intent in order to maintain persistence and activate its functionality at device boot time.

Privilege Escalation

3 techniques

T1546Event Triggered ExecutionEvidence1

A malicious application could create an application overlay window on top of a running legitimate application.

T1546.008Accessibility FeaturesEvidence1

T1547Boot or Logon Autostart ExecutionEvidence1

Stealth

1 technique

T1036MasqueradingEvidence1

Agent Smith can impersonate any popular application on an infected device, and the core malware disguises itself as a legitimate Google application.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.

ACTIVITY FEED

Recent activity

19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

19 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Input Prompt, Technique T1411 - Mobile | MITRE ATT&CK®

Android banking trojan that displays phishing popups over active applications to capture sensitive data.

mitre attack websiteNews

Oct 21, 2021

Application Discovery, Technique T1418 - Mobile | MITRE ATT&CK®

Mobile banking trojan that collects installed application lists from infected devices.

mitre attack websiteNews

Oct 21, 2021

Input Capture, Technique T1417 - Mobile | MITRE ATT&CK®

Mobile banking trojan that abuses Android accessibility services to capture sensitive user input such as PINs.

mitre attack websiteNews

Oct 21, 2021

Broadcast Receivers, Technique T1402 - Mobile | MITRE ATT&CK®

Android banking trojan that persists by auto-starting after device boot via broadcast intent registration.

+15 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

EventBot