{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/Gautam-CyberSec/Android-Malware-Analysis-Report/blob/5af85ede627d68764e7d0eed8c48d4ef548409f6/README.md"
  ],
  "category": "reconstruction-cases",
  "description_en": "The RTO eChalan report investigates an Android APK impersonating an Indian government eChallan service through manifest review, JADX decompilation and sandbox analysis. The author reports identifying a BankBot variant, a REQUEST_INSTALL_PACKAGES permission, a BIND_VPN_SERVICE entry and extensive obfuscation that limited decompilation.",
  "description_zh": "RTO eChalan 报告通过检查 AndroidManifest.xml、使用 JADX 反编译及沙箱分析，调查一个冒充印度政府交通罚单服务的 APK。作者报告将其识别为 BankBot 变种，并记录了 REQUEST_INSTALL_PACKAGES 权限、BIND_VPN_SERVICE 条目及妨碍反编译的大量混淆代码。",
  "entry_url": "https://awesomerea.org/resources/rto-echalan-android-analysis-case/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/rto-echalan-android-analysis-case/",
  "evidence_url": "https://github.com/Gautam-CyberSec/Android-Malware-Analysis-Report/blob/5af85ede627d68764e7d0eed8c48d4ef548409f6/Report/Report.md",
  "group": "cases",
  "id": "rto-echalan-android-analysis-case",
  "json_url": "https://awesomerea.org/resources/rto-echalan-android-analysis-case/record.json",
  "kind": "case-study",
  "markdown_url": "https://awesomerea.org/resources/rto-echalan-android-analysis-case/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/rto-echalan-android-analysis-case/index.md",
  "name": "RTO eChalan: investigating a BankBot Android APK",
  "name_zh": "RTO eChalan：调查 BankBot 安卓 APK",
  "record_type": "resource",
  "relationship": "independent-reconstruction",
  "requirement_facets": [
    "scope",
    "limits",
    "license"
  ],
  "requirements": [
    "The report covers one Android APK named RTO eChalan.apk.",
    "The author reports that approximately 96% of classes failed to load during decompilation.",
    "CC-BY-4.0 license."
  ],
  "requirements_zh": [
    "报告分析的是名为 RTO eChalan.apk 的单个安卓安装包。",
    "作者报告称约 96% 的类在反编译时无法加载。",
    "采用 CC-BY-4.0 许可证。"
  ],
  "targets": [
    "app"
  ],
  "url": "https://github.com/Gautam-CyberSec/Android-Malware-Analysis-Report",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}