Case study
RTO eChalan: investigating a BankBot Android APK
The RTO eChalan report investigates an Android APK impersonating an Indian government eChallan service through manifest review, JADX decompilation and sandbox analysis. The author reports identifying a BankBot variant, a REQUEST_INSTALL_PACKAGES permission, a BIND_VPN_SERVICE entry and extensive obfuscation that limited decompilation.
- Targets
- App
- Category
- Independent reconstruction cases
- Relationship
- Independent reconstruction project
- Sources reviewed
Requirements & limits
- Scope: The report covers one Android APK named RTO eChalan.apk.
- Limits: The author reports that approximately 96% of classes failed to load during decompilation.
- License: CC-BY-4.0 license.
About this entry
The description was reviewed against primary sources.
Primary sources
- Report/Report.md GitHub · Gautam-CyberSec/Android-Malware-Analysis-Report · Revision 5af85ed
- README.md GitHub · Gautam-CyberSec/Android-Malware-Analysis-Report · Revision 5af85ed
More in Apps
- AOL 7.0 Retro Server: reconstructing the P3 server session · Case study
- SteelSeries Overlay Hook: mapping and hooking the GameOverlay swapchain · Case study
- WeChat: recovering SQLCipher keys through CommonCrypto hooks · Case study
- Siriously: recovering macOS Writing Tools entry points · Case study
- tuya-mobile: a Python reconstruction of Tuya app signing and API calls · Case study
- ddg-tenor-bridge: replacing Gboard's Tenor search endpoint · Case study