Analysis
- max time kernel
843132s - max time network
21s - platform
android_x64 - resource
android-x64 - submitted
29/09/2021, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
173a8591dcb43aa7e4b5d0dc5f9034d69aa78bc8827407d56047336614795cce.bin.apk
Resource
android-x64
android_x64
0 signatures
0 seconds
General
- Target 173a8591dcb43aa7e4b5d0dc5f9034d69aa78bc8827407d56047336614795cce.bin.apk
- Size 7.0MB
- Sample210929-tanbpafcc3
- SHA256 173a8591dcb43aa7e4b5d0dc5f9034d69aa78bc8827407d56047336614795cce
- MD5 76c81a68d7dcd0bf9d77a7bfbb06178e
- SHA1 811b4b899eb962baee4347d291eb1cb1e7a91e86
- SHA512 593cbc1663d1c122064b918ff6bf5e513e4925b69de074a35f7e7958a48a00146f3dbcce7499c0ada4448af93fb215288d15a64c621c9c92ddcb74eccb1820f7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Sova
Android banker first seen in July 2021.
- Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.esavzt.kkjsdzp.jjy/code_cache/secondary-dexes/base.apk.classes1.zip 3588 com.esavzt.kkjsdzp.jjy - Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.esavzt.kkjsdzp.jjy - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com 10 api.ipify.org - Uses reflection 19 IoCs
description pid Process Acesses field dalvik.system.BaseDexClassLoader.pathList 3588 com.esavzt.kkjsdzp.jjy Invokes method dalvik.system.DexPathList.makePathElements 3588 com.esavzt.kkjsdzp.jjy Acesses field dalvik.system.DexPathList.dexElements 3588 com.esavzt.kkjsdzp.jjy Acesses field dalvik.system.DexPathList.dexElements 3588 com.esavzt.kkjsdzp.jjy Invokes method android.app.ActivityThread.currentActivityThread 3588 com.esavzt.kkjsdzp.jjy Acesses field android.app.ActivityThread.mBoundApplication 3588 com.esavzt.kkjsdzp.jjy Acesses field android.app.ActivityThread$AppBindData.info 3588 com.esavzt.kkjsdzp.jjy Acesses field android.app.LoadedApk.mApplication 3588 com.esavzt.kkjsdzp.jjy Acesses field android.app.ActivityThread.mInitialApplication 3588 com.esavzt.kkjsdzp.jjy Acesses field android.app.ActivityThread.mAllApplications 3588 com.esavzt.kkjsdzp.jjy Acesses field android.app.LoadedApk.mApplicationInfo 3588 com.esavzt.kkjsdzp.jjy Acesses field android.app.ActivityThread$AppBindData.appInfo 3588 com.esavzt.kkjsdzp.jjy Invokes method android.app.LoadedApk.makeApplication 3588 com.esavzt.kkjsdzp.jjy Acesses field android.app.ActivityThread.mInitialApplication 3588 com.esavzt.kkjsdzp.jjy Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE 3588 com.esavzt.kkjsdzp.jjy Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3588 com.esavzt.kkjsdzp.jjy Acesses field javax.security.auth.x500.X500Principal.thisX500Name 3588 com.esavzt.kkjsdzp.jjy Invokes method android.os.Handler.createAsync 3588 com.esavzt.kkjsdzp.jjy Invokes method android.os.Handler.createAsync 3588 com.esavzt.kkjsdzp.jjy