# RTO eChalan: investigating a BankBot Android APK

> The RTO eChalan report investigates an Android APK impersonating an Indian government eChallan service through manifest review, JADX decompilation and sandbox analysis. The author reports identifying a BankBot variant, a REQUEST_INSTALL_PACKAGES permission, a BIND_VPN_SERVICE entry and extensive obfuscation that limited decompilation.

- Type: Case study
- Targets: App
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/Gautam-CyberSec/Android-Malware-Analysis-Report>
- Primary source: <https://github.com/Gautam-CyberSec/Android-Malware-Analysis-Report/blob/5af85ede627d68764e7d0eed8c48d4ef548409f6/Report/Report.md>
- Catalog page: <https://awesomerea.org/resources/rto-echalan-android-analysis-case/>
- Record JSON: <https://awesomerea.org/resources/rto-echalan-android-analysis-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/rto-echalan-android-analysis-case/index.md)

## Requirements & limits

- **Scope:** The report covers one Android APK named RTO eChalan.apk.
- **Limits:** The author reports that approximately 96% of classes failed to load during decompilation.
- **License:** CC-BY-4.0 license.

## Primary sources

1. <https://github.com/Gautam-CyberSec/Android-Malware-Analysis-Report/blob/5af85ede627d68764e7d0eed8c48d4ef548409f6/Report/Report.md>
2. <https://github.com/Gautam-CyberSec/Android-Malware-Analysis-Report/blob/5af85ede627d68764e7d0eed8c48d4ef548409f6/README.md>

## More in Apps

- [AOL 7.0 Retro Server: reconstructing the P3 server session](https://awesomerea.org/resources/aol7-retro-server-case/index.md) · Case study
- [SteelSeries Overlay Hook: mapping and hooking the GameOverlay swapchain](https://awesomerea.org/resources/steelseries-overlay-hook-case/index.md) · Case study
- [WeChat: recovering SQLCipher keys through CommonCrypto hooks](https://awesomerea.org/resources/wechat-4-1-10-macos-key-case/index.md) · Case study
- [Siriously: recovering macOS Writing Tools entry points](https://awesomerea.org/resources/siriously-writing-tools-case/index.md) · Case study
- [tuya-mobile: a Python reconstruction of Tuya app signing and API calls](https://awesomerea.org/resources/tuya-mobile-security-layer-case/index.md) · Case study
- [ddg-tenor-bridge: replacing Gboard's Tenor search endpoint](https://awesomerea.org/resources/ddg-tenor-bridge-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.