sova | 4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a

Resubmissions

06-10-2022 16:34

221006-t3fgjshhe5 10

18-07-2022 09:59

220718-lz8pxscdaq 7

21-06-2022 09:18

220621-k9lsgacfep 8

Analysis

max time kernel
2921901s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
06-10-2022 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk
Size

5.2MB
MD5

e3281f0f5840038135e319419e3d5338
SHA1

56e7318683cb591051805d6018f619ca2937eda3
SHA256

4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a
SHA512

edc0673a0228432074165c3c52a1dcafa54164f71699f3ba10d47d4f92202137ada0b09ccd72f8b77d59f3e24f64bfe8342d6aeb53611eef9c4aa1ce5c5a1a90
SSDEEP

98304:vuRK4SpHgGnExGDtQuh9t2bJP5fkBMx2XEx3+N0jzMGoKShot/ujTc/:GzSpAhInQbNNOExOkMG3aotWX4

Score

10^/10

sova sova_v4 banker evasion infostealer trojan

Malware Config

Signatures

SOVA_v4 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4191-0.dex	family_sova_v4
behavioral1/memory/4140-0.dex	family_sova_v4

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Sova payload 2 IoCs

resource	yara_rule
behavioral1/memory/4191-0.dex	family_sova
behavioral1/memory/4140-0.dex	family_sova

Sova_v4
Android banker first seen in July 2021.
banker trojan infostealer sova_v4

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kkaxrzqsc.ckiradcii

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kkaxrzqsc.ckiradcii

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	4191	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	4140	com.kkaxrzqsc.ckiradcii

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	icanhazip.com
55	icanhazip.com
56	icanhazip.com

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.kkaxrzqsc.ckiradcii

com.kkaxrzqsc.ckiradcii
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4140
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/oat/x86/base.apk.I8Tuf8H1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4191

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Cookies-journal

Filesize
1KB

MD5
d107d892cd6874710e5631962798e80c

SHA1
7c0023fce13b806105a48e4b41db7d8c1a6950d0

SHA256
64817280240e60939ee0df7d222c0fc970551c8ccbbaf566ee89b14112663515

SHA512
a533f545f41686cdef536424a33bcc46000e7c1f51d05afac467ad3f7b543264c65c4564c3747f0ea8b337c2e546f66d03bffd913e1e560548aeb9cb3742d6ab

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
530b0354c112a29a6651e4ef3ea4b9dd

SHA1
66bd57962d58b6d2c6d295cf4f0eae072833334e

SHA256
54d3535e638617a5fea185c25bea251e5a01b85158e33cb8c68249bb9e1acf43

SHA512
a5ea05dc529cff558d0fab98a3f42c54f21edade977f81a5fde35e7376e85b921e07f62da1a0e92726f68bf14fb9ebc141c0a7dda266beda4f74e3833006b2ca

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Web Data-journal

Filesize
1KB

MD5
0613ab43a48351892c4aee322ead947a

SHA1
a72f63a0b715e34c752374fa6bbf97c1e5d54e5d

SHA256
0956b3601dc61b3268a699d0cf96c642ecd3711a7e311b766a4c0055678a8472

SHA512
1fbf7971e790adb59091a648947cb31eb5d5b6fa062c5b5770a74c9f1bf69d967d4ac9c3fe7aec5a5fa773a54ccfb0539051e0b27f3f3b8d2870f4d56210fb45

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/metrics_guid

Filesize
36B

MD5
db038906b50c137b384271c9d941b126

SHA1
544931bdcedbed8a6ed92db4f0e1bc5ea52430b9

SHA256
4738ec64dbf44a8109f5df4c01195d58e26abf72ce950f9230021a7e2775c908

SHA512
96e1407e7a6e9f6f6aad6db887cb617cbda30eb88a4858e43891b763da9611ebb79fe8a9208b32cd7dc5631ce28ed39880d8316366dbd97d4beba288720b054e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/0f22922b0acd03ce_0

Filesize
161B

MD5
ff5105808e79933263490cb1bf02b395

SHA1
eed68760598b4b60ef98fe0f04da5bb22e4f52e2

SHA256
8c5523e078e1c3e8a19941686441f5671cdf00832671f0dafa9718b0ecb4759f

SHA512
48139db8edd482abe538ad1fa5bccf222628898a8b37bf4674f5e052719a339474a5cf1a4c24694288ef871d0230ef38e5cf826ab83f06b1a603cbccd01e21d2

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/35dd184c2cbc765e_0

Filesize
166B

MD5
d2c1228e9818f2bcac0b468e0a1c545c

SHA1
6324d2e41c329b8b656e3d1f0cb8de707e8730e6

SHA256
7145b9c74362b4e3c812f50a439617660251bb4cebc5a3e8afa383e1522ebda5

SHA512
fee4b2b4837aeda58afaf15bbecdb53822e0d3402606f82200057abc7f9d853f17824d6f902126e8528ec2da1820c2044e33a0f55b4f7b6ab8bd57d3b266a742

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/8bdb7e0fbf327347_0

Filesize
162B

MD5
128adcc9f6e973a25be3014a2d3b893e

SHA1
8bb94839f32e5133d27dd51452f21a518e664d9d

SHA256
cf7704b747f186a9d7649d92bc3c61f9b12407e6fd42c8ec3d33a10b869fc58b

SHA512
d5f935560f06a10d2400391f905891cc5b3a689e6994774515df9516eda6727f542745e88177794da9deb4665386fe2a8100d3689b91e9e938174af518b002cb

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
d33e74f85f895b7c3da04c171b8e3fd3

SHA1
518a6566f1d139ca146f5a29778090cea93afcb3

SHA256
32af7d0accd1acfdb3a8344322f1cbd1b89e52ab682c91cb116080423a0eb82c

SHA512
a65764e0ff0422fd399f2fc24d466f405f6890444de98d6c402fcce4c2f502c391b01cdeaf49ef2f421f5c8b4d04341149d2d1db1d96de5686d47ada258d7c18

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
96B

MD5
3ff25596c2dbe262626e4b68a50a7c61

SHA1
eb56c917ea7e052b7ea6faf728d84ff184a53ff9

SHA256
8db3c5eb48579ddee1279c61a07a9d68ffe18a5fe4ba17b7e9eccc3343faa974

SHA512
526daa138eede0574f4b53d5f1f57cdd8d3d50c88b70d1088fe4650a01f4cf2119ccae0f31cab1f6956328061a100b792d41e885585edbd31da8f94c50e23a62

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
e86cfe71effa1e4bf373cb0088969e10

SHA1
8541ab30d239577c0a7aa553cb96f7d20711f26a

SHA256
4d9e5a2c97a428f718b7bc0bdf1c90cae0221808173e536b4c6eb3dcbeee76e8

SHA512
b3424961ed4bc296e9e816454d552133583c7c34b73af3a4421c182f23bce41eaa383af93fe11812b6ae03fc99aa4c3c4bacb0adf7b7d85816b0b9f2bbcb871c

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/com.android.launcher3.prefs.xml

Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/multidex.version.xml

Filesize
307B

MD5
4f2d6f6bd3eed41d54da6c15f81e3793

SHA1
1ffe7c45ef21558a97f8bbb33b36e630938125aa

SHA256
d05fd3617c6e36a7935c93864aa6f7b9ddde764bbb0beb9c8036252eb791b4d7

SHA512
de4e8c14da94da8b2938220ac5ef8d98ee50b55c59408c79744ebaf8674ec00eccd907476a9c42154c0bf3b7c6553fb7eeaf94c58b71f963bbc68a1b8fb5eaac

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g

Filesize
1.6MB

MD5
ecec695a6ef0032ff675328d9875ab44

SHA1
4f27095cf94144109425324c5ec7a6d0b998546d

SHA256
9fbeac09b30c4f3f07967a9300c0ee8cbab6b752517fd4fead661ad0c5aa22e2

SHA512
9e00c7fcec7560d64c86a13845d7080aabe2bf00e9a1e5cf83d6c0acd3dab85b6c481b54abc3bb133b45b7ab6109a1f570d881d17a40df2c0c534cff71a658ae

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g

Filesize
1.6MB

MD5
cb24a6c4d91a05002e4396d94936d9eb

SHA1
7391cd105430e2017d9bb22b4823ea400f34427b

SHA256
d9e95c193a3ffa0c2e621425c503031c18afa77f3e90cfccb9ed817458838888

SHA512
17923ca572625866d4aaef2ba57e7965638ab5a09d645f4660f0797a6dc6bf38199320e5d67f8d247e78fa30c0252abbf442baca539333d44a008e21a9b3de9a

Download Submit