Resubmissions

06-10-2022 16:34

221006-t3fgjshhe5 10

18-07-2022 09:59

220718-lz8pxscdaq 7

21-06-2022 09:18

220621-k9lsgacfep 8

Analysis

  • max time kernel
    2921901s
  • max time network
    159s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    06-10-2022 16:34

General

  • Target

    4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk

  • Size

    5.2MB

  • MD5

    e3281f0f5840038135e319419e3d5338

  • SHA1

    56e7318683cb591051805d6018f619ca2937eda3

  • SHA256

    4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a

  • SHA512

    edc0673a0228432074165c3c52a1dcafa54164f71699f3ba10d47d4f92202137ada0b09ccd72f8b77d59f3e24f64bfe8342d6aeb53611eef9c4aa1ce5c5a1a90

  • SSDEEP

    98304:vuRK4SpHgGnExGDtQuh9t2bJP5fkBMx2XEx3+N0jzMGoKShot/ujTc/:GzSpAhInQbNNOExOkMG3aotWX4

Malware Config

Signatures

  • SOVA_v4 payload 2 IoCs
  • Sova

    Android banker first seen in July 2021.

  • Sova payload 2 IoCs
  • Sova_v4

    Android banker first seen in July 2021.

  • Makes use of the framework's Accessibility service. 1 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Removes a system notification. 1 IoCs

Processes

  • com.kkaxrzqsc.ckiradcii
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    PID:4140
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4191

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies

    Filesize

    64KB

    MD5

    cb7543c4df600f2af58097cce0e334ba

    SHA1

    83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

    SHA256

    64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

    SHA512

    ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies-journal

    Filesize

    1KB

    MD5

    d107d892cd6874710e5631962798e80c

    SHA1

    7c0023fce13b806105a48e4b41db7d8c1a6950d0

    SHA256

    64817280240e60939ee0df7d222c0fc970551c8ccbbaf566ee89b14112663515

    SHA512

    a533f545f41686cdef536424a33bcc46000e7c1f51d05afac467ad3f7b543264c65c4564c3747f0ea8b337c2e546f66d03bffd913e1e560548aeb9cb3742d6ab

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index

    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index-dir/temp-index

    Filesize

    48B

    MD5

    530b0354c112a29a6651e4ef3ea4b9dd

    SHA1

    66bd57962d58b6d2c6d295cf4f0eae072833334e

    SHA256

    54d3535e638617a5fea185c25bea251e5a01b85158e33cb8c68249bb9e1acf43

    SHA512

    a5ea05dc529cff558d0fab98a3f42c54f21edade977f81a5fde35e7376e85b921e07f62da1a0e92726f68bf14fb9ebc141c0a7dda266beda4f74e3833006b2ca

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data

    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data-journal

    Filesize

    1KB

    MD5

    0613ab43a48351892c4aee322ead947a

    SHA1

    a72f63a0b715e34c752374fa6bbf97c1e5d54e5d

    SHA256

    0956b3601dc61b3268a699d0cf96c642ecd3711a7e311b766a4c0055678a8472

    SHA512

    1fbf7971e790adb59091a648947cb31eb5d5b6fa062c5b5770a74c9f1bf69d967d4ac9c3fe7aec5a5fa773a54ccfb0539051e0b27f3f3b8d2870f4d56210fb45

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/metrics_guid

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/metrics_guid

    Filesize

    36B

    MD5

    db038906b50c137b384271c9d941b126

    SHA1

    544931bdcedbed8a6ed92db4f0e1bc5ea52430b9

    SHA256

    4738ec64dbf44a8109f5df4c01195d58e26abf72ce950f9230021a7e2775c908

    SHA512

    96e1407e7a6e9f6f6aad6db887cb617cbda30eb88a4858e43891b763da9611ebb79fe8a9208b32cd7dc5631ce28ed39880d8316366dbd97d4beba288720b054e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_seed_new

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_stamp

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/webview_data.lock

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/0f22922b0acd03ce_0

    Filesize

    161B

    MD5

    ff5105808e79933263490cb1bf02b395

    SHA1

    eed68760598b4b60ef98fe0f04da5bb22e4f52e2

    SHA256

    8c5523e078e1c3e8a19941686441f5671cdf00832671f0dafa9718b0ecb4759f

    SHA512

    48139db8edd482abe538ad1fa5bccf222628898a8b37bf4674f5e052719a339474a5cf1a4c24694288ef871d0230ef38e5cf826ab83f06b1a603cbccd01e21d2

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/35dd184c2cbc765e_0

    Filesize

    166B

    MD5

    d2c1228e9818f2bcac0b468e0a1c545c

    SHA1

    6324d2e41c329b8b656e3d1f0cb8de707e8730e6

    SHA256

    7145b9c74362b4e3c812f50a439617660251bb4cebc5a3e8afa383e1522ebda5

    SHA512

    fee4b2b4837aeda58afaf15bbecdb53822e0d3402606f82200057abc7f9d853f17824d6f902126e8528ec2da1820c2044e33a0f55b4f7b6ab8bd57d3b266a742

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/8bdb7e0fbf327347_0

    Filesize

    162B

    MD5

    128adcc9f6e973a25be3014a2d3b893e

    SHA1

    8bb94839f32e5133d27dd51452f21a518e664d9d

    SHA256

    cf7704b747f186a9d7649d92bc3c61f9b12407e6fd42c8ec3d33a10b869fc58b

    SHA512

    d5f935560f06a10d2400391f905891cc5b3a689e6994774515df9516eda6727f542745e88177794da9deb4665386fe2a8100d3689b91e9e938174af518b002cb

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index

    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

    Filesize

    72B

    MD5

    d33e74f85f895b7c3da04c171b8e3fd3

    SHA1

    518a6566f1d139ca146f5a29778090cea93afcb3

    SHA256

    32af7d0accd1acfdb3a8344322f1cbd1b89e52ab682c91cb116080423a0eb82c

    SHA512

    a65764e0ff0422fd399f2fc24d466f405f6890444de98d6c402fcce4c2f502c391b01cdeaf49ef2f421f5c8b4d04341149d2d1db1d96de5686d47ada258d7c18

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

    Filesize

    96B

    MD5

    3ff25596c2dbe262626e4b68a50a7c61

    SHA1

    eb56c917ea7e052b7ea6faf728d84ff184a53ff9

    SHA256

    8db3c5eb48579ddee1279c61a07a9d68ffe18a5fe4ba17b7e9eccc3343faa974

    SHA512

    526daa138eede0574f4b53d5f1f57cdd8d3d50c88b70d1088fe4650a01f4cf2119ccae0f31cab1f6956328061a100b792d41e885585edbd31da8f94c50e23a62

  • /data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

    Filesize

    72B

    MD5

    e86cfe71effa1e4bf373cb0088969e10

    SHA1

    8541ab30d239577c0a7aa553cb96f7d20711f26a

    SHA256

    4d9e5a2c97a428f718b7bc0bdf1c90cae0221808173e536b4c6eb3dcbeee76e8

    SHA512

    b3424961ed4bc296e9e816454d552133583c7c34b73af3a4421c182f23bce41eaa383af93fe11812b6ae03fc99aa4c3c4bacb0adf7b7d85816b0b9f2bbcb871c

  • /data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/WebViewChromiumPrefs.xml

    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

  • /data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/com.android.launcher3.prefs.xml

    Filesize

    128B

    MD5

    20837fd8daf2a2de8d6c4ccd8e90653a

    SHA1

    7ac08617bd4585151c239325aea243d9eca586f7

    SHA256

    e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

    SHA512

    a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

  • /data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/multidex.version.xml

    Filesize

    307B

    MD5

    4f2d6f6bd3eed41d54da6c15f81e3793

    SHA1

    1ffe7c45ef21558a97f8bbb33b36e630938125aa

    SHA256

    d05fd3617c6e36a7935c93864aa6f7b9ddde764bbb0beb9c8036252eb791b4d7

    SHA512

    de4e8c14da94da8b2938220ac5ef8d98ee50b55c59408c79744ebaf8674ec00eccd907476a9c42154c0bf3b7c6553fb7eeaf94c58b71f963bbc68a1b8fb5eaac

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g

    Filesize

    1.6MB

    MD5

    ecec695a6ef0032ff675328d9875ab44

    SHA1

    4f27095cf94144109425324c5ec7a6d0b998546d

    SHA256

    9fbeac09b30c4f3f07967a9300c0ee8cbab6b752517fd4fead661ad0c5aa22e2

    SHA512

    9e00c7fcec7560d64c86a13845d7080aabe2bf00e9a1e5cf83d6c0acd3dab85b6c481b54abc3bb133b45b7ab6109a1f570d881d17a40df2c0c534cff71a658ae

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g

    Filesize

    1.6MB

    MD5

    cb24a6c4d91a05002e4396d94936d9eb

    SHA1

    7391cd105430e2017d9bb22b4823ea400f34427b

    SHA256

    d9e95c193a3ffa0c2e621425c503031c18afa77f3e90cfccb9ed817458838888

    SHA512

    17923ca572625866d4aaef2ba57e7965638ab5a09d645f4660f0797a6dc6bf38199320e5d67f8d247e78fa30c0252abbf442baca539333d44a008e21a9b3de9a

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g.x86.flock

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/gUIHgfIk.yTyp

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.vdex

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • /data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/tmp-base.apk.I8Tuf8H8608213366852189726.t8g

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e