Resubmissions
06-10-2022 16:34
221006-t3fgjshhe5 1018-07-2022 09:59
220718-lz8pxscdaq 721-06-2022 09:18
220621-k9lsgacfep 8Analysis
-
max time kernel
2921901s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
06-10-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk
Resource
android-x64-arm64-20220823-en
General
-
Target
4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk
-
Size
5.2MB
-
MD5
e3281f0f5840038135e319419e3d5338
-
SHA1
56e7318683cb591051805d6018f619ca2937eda3
-
SHA256
4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a
-
SHA512
edc0673a0228432074165c3c52a1dcafa54164f71699f3ba10d47d4f92202137ada0b09ccd72f8b77d59f3e24f64bfe8342d6aeb53611eef9c4aa1ce5c5a1a90
-
SSDEEP
98304:vuRK4SpHgGnExGDtQuh9t2bJP5fkBMx2XEx3+N0jzMGoKShot/ujTc/:GzSpAhInQbNNOExOkMG3aotWX4
Malware Config
Signatures
-
SOVA_v4 payload 2 IoCs
Processes:
resource yara_rule /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g family_sova_v4 /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g family_sova_v4 -
Sova
Android banker first seen in July 2021.
-
Sova payload 2 IoCs
Processes:
resource yara_rule /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g family_sova /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g family_sova -
Sova_v4
Android banker first seen in July 2021.
-
Makes use of the framework's Accessibility service. 1 IoCs
Processes:
com.kkaxrzqsc.ckiradciidescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.kkaxrzqsc.ckiradcii -
Acquires the wake lock. 1 IoCs
Processes:
com.kkaxrzqsc.ckiradciidescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.kkaxrzqsc.ckiradcii -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=&com.kkaxrzqsc.ckiradciiioc pid process /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g 4191 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g 4140 com.kkaxrzqsc.ckiradcii -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 icanhazip.com 55 icanhazip.com 56 icanhazip.com -
Removes a system notification. 1 IoCs
Processes:
com.kkaxrzqsc.ckiradciidescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.kkaxrzqsc.ckiradcii
Processes
-
com.kkaxrzqsc.ckiradcii1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4140 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4191
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5cb7543c4df600f2af58097cce0e334ba
SHA183cc92f38c27fdb4fa519b1ce2f37912f24af1f0
SHA25664c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233
SHA512ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980
-
Filesize
1KB
MD5d107d892cd6874710e5631962798e80c
SHA17c0023fce13b806105a48e4b41db7d8c1a6950d0
SHA25664817280240e60939ee0df7d222c0fc970551c8ccbbaf566ee89b14112663515
SHA512a533f545f41686cdef536424a33bcc46000e7c1f51d05afac467ad3f7b543264c65c4564c3747f0ea8b337c2e546f66d03bffd913e1e560548aeb9cb3742d6ab
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD5530b0354c112a29a6651e4ef3ea4b9dd
SHA166bd57962d58b6d2c6d295cf4f0eae072833334e
SHA25654d3535e638617a5fea185c25bea251e5a01b85158e33cb8c68249bb9e1acf43
SHA512a5ea05dc529cff558d0fab98a3f42c54f21edade977f81a5fde35e7376e85b921e07f62da1a0e92726f68bf14fb9ebc141c0a7dda266beda4f74e3833006b2ca
-
Filesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
Filesize
1KB
MD50613ab43a48351892c4aee322ead947a
SHA1a72f63a0b715e34c752374fa6bbf97c1e5d54e5d
SHA2560956b3601dc61b3268a699d0cf96c642ecd3711a7e311b766a4c0055678a8472
SHA5121fbf7971e790adb59091a648947cb31eb5d5b6fa062c5b5770a74c9f1bf69d967d4ac9c3fe7aec5a5fa773a54ccfb0539051e0b27f3f3b8d2870f4d56210fb45
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
36B
MD5db038906b50c137b384271c9d941b126
SHA1544931bdcedbed8a6ed92db4f0e1bc5ea52430b9
SHA2564738ec64dbf44a8109f5df4c01195d58e26abf72ce950f9230021a7e2775c908
SHA51296e1407e7a6e9f6f6aad6db887cb617cbda30eb88a4858e43891b763da9611ebb79fe8a9208b32cd7dc5631ce28ed39880d8316366dbd97d4beba288720b054e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
161B
MD5ff5105808e79933263490cb1bf02b395
SHA1eed68760598b4b60ef98fe0f04da5bb22e4f52e2
SHA2568c5523e078e1c3e8a19941686441f5671cdf00832671f0dafa9718b0ecb4759f
SHA51248139db8edd482abe538ad1fa5bccf222628898a8b37bf4674f5e052719a339474a5cf1a4c24694288ef871d0230ef38e5cf826ab83f06b1a603cbccd01e21d2
-
Filesize
166B
MD5d2c1228e9818f2bcac0b468e0a1c545c
SHA16324d2e41c329b8b656e3d1f0cb8de707e8730e6
SHA2567145b9c74362b4e3c812f50a439617660251bb4cebc5a3e8afa383e1522ebda5
SHA512fee4b2b4837aeda58afaf15bbecdb53822e0d3402606f82200057abc7f9d853f17824d6f902126e8528ec2da1820c2044e33a0f55b4f7b6ab8bd57d3b266a742
-
Filesize
162B
MD5128adcc9f6e973a25be3014a2d3b893e
SHA18bb94839f32e5133d27dd51452f21a518e664d9d
SHA256cf7704b747f186a9d7649d92bc3c61f9b12407e6fd42c8ec3d33a10b869fc58b
SHA512d5f935560f06a10d2400391f905891cc5b3a689e6994774515df9516eda6727f542745e88177794da9deb4665386fe2a8100d3689b91e9e938174af518b002cb
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
72B
MD5d33e74f85f895b7c3da04c171b8e3fd3
SHA1518a6566f1d139ca146f5a29778090cea93afcb3
SHA25632af7d0accd1acfdb3a8344322f1cbd1b89e52ab682c91cb116080423a0eb82c
SHA512a65764e0ff0422fd399f2fc24d466f405f6890444de98d6c402fcce4c2f502c391b01cdeaf49ef2f421f5c8b4d04341149d2d1db1d96de5686d47ada258d7c18
-
Filesize
96B
MD53ff25596c2dbe262626e4b68a50a7c61
SHA1eb56c917ea7e052b7ea6faf728d84ff184a53ff9
SHA2568db3c5eb48579ddee1279c61a07a9d68ffe18a5fe4ba17b7e9eccc3343faa974
SHA512526daa138eede0574f4b53d5f1f57cdd8d3d50c88b70d1088fe4650a01f4cf2119ccae0f31cab1f6956328061a100b792d41e885585edbd31da8f94c50e23a62
-
Filesize
72B
MD5e86cfe71effa1e4bf373cb0088969e10
SHA18541ab30d239577c0a7aa553cb96f7d20711f26a
SHA2564d9e5a2c97a428f718b7bc0bdf1c90cae0221808173e536b4c6eb3dcbeee76e8
SHA512b3424961ed4bc296e9e816454d552133583c7c34b73af3a4421c182f23bce41eaa383af93fe11812b6ae03fc99aa4c3c4bacb0adf7b7d85816b0b9f2bbcb871c
-
Filesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48
-
Filesize
128B
MD520837fd8daf2a2de8d6c4ccd8e90653a
SHA17ac08617bd4585151c239325aea243d9eca586f7
SHA256e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec
SHA512a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a
-
Filesize
307B
MD54f2d6f6bd3eed41d54da6c15f81e3793
SHA11ffe7c45ef21558a97f8bbb33b36e630938125aa
SHA256d05fd3617c6e36a7935c93864aa6f7b9ddde764bbb0beb9c8036252eb791b4d7
SHA512de4e8c14da94da8b2938220ac5ef8d98ee50b55c59408c79744ebaf8674ec00eccd907476a9c42154c0bf3b7c6553fb7eeaf94c58b71f963bbc68a1b8fb5eaac
-
Filesize
1.6MB
MD5ecec695a6ef0032ff675328d9875ab44
SHA14f27095cf94144109425324c5ec7a6d0b998546d
SHA2569fbeac09b30c4f3f07967a9300c0ee8cbab6b752517fd4fead661ad0c5aa22e2
SHA5129e00c7fcec7560d64c86a13845d7080aabe2bf00e9a1e5cf83d6c0acd3dab85b6c481b54abc3bb133b45b7ab6109a1f570d881d17a40df2c0c534cff71a658ae
-
Filesize
1.6MB
MD5cb24a6c4d91a05002e4396d94936d9eb
SHA17391cd105430e2017d9bb22b4823ea400f34427b
SHA256d9e95c193a3ffa0c2e621425c503031c18afa77f3e90cfccb9ed817458838888
SHA51217923ca572625866d4aaef2ba57e7965638ab5a09d645f4660f0797a6dc6bf38199320e5d67f8d247e78fa30c0252abbf442baca539333d44a008e21a9b3de9a
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/tmp-base.apk.I8Tuf8H8608213366852189726.t8g
MD5d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e