Overview

overview

10

Static

static

7

4f9fb1830f...2a.apk

android-9-x86

10

4f9fb1830f...2a.apk

android-10-x64

10

4f9fb1830f...2a.apk

android-11-x64

10

Resubmissions

06/10/2022, 16:34

221006-t3fgjshhe510

18/07/2022, 09:59

220718-lz8pxscdaq7

21/06/2022, 09:18

220621-k9lsgacfep8

Sharing

Copy URL Twitter E-mail

General

  • Target
    4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a
  • Size 5.2MB
  • Sample221006-t3fgjshhe5
  • SHA256 4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sovasova_v4androidbankerevasioninfostealertrojan

Malware Config

Targets

    • Target
      4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a
    • Size 5.2MB
    • SHA256 4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    sovasova_v4bankerevasioninfostealertrojan

    • SOVA_v4 payload

    • Sova

      Android banker first seen in July 2021.

      bankertrojaninfostealersova

    • Sova payload

    • Sova_v4

      Android banker first seen in July 2021.

      bankertrojaninfostealersova_v4

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Removes a system notification.

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks