Source Code Analysis: Exobot

This report details a hands‑on analysis of the leaked Exobot v2 source code, an Android banking trojan offered as a malware‑as‑a‑service. It walks through the malware ecosystem (exo/loader/socks), backend and frontend server setup, SQL schemas and multi‑tenant customer/admin panels, and highlights capabilities including overlay credential theft, device admin abuse to disable security, and SOCKS proxying via infected devices — demonstrating a sophisticated, scalable platform that lowers the technical barrier for attackers.