sova | 4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a

Resubmissions

06-10-2022 16:34

221006-t3fgjshhe5 10

18-07-2022 09:59

220718-lz8pxscdaq 7

21-06-2022 09:18

220621-k9lsgacfep 8

Analysis

max time kernel
2921912s
max time network
175s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
06-10-2022 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a.apk
Size

5.2MB
MD5

e3281f0f5840038135e319419e3d5338
SHA1

56e7318683cb591051805d6018f619ca2937eda3
SHA256

4f9fb1830f47c3107b2c865a169fab46f02f6e3aeb9a3673877e639755af172a
SHA512

edc0673a0228432074165c3c52a1dcafa54164f71699f3ba10d47d4f92202137ada0b09ccd72f8b77d59f3e24f64bfe8342d6aeb53611eef9c4aa1ce5c5a1a90
SSDEEP

98304:vuRK4SpHgGnExGDtQuh9t2bJP5fkBMx2XEx3+N0jzMGoKShot/ujTc/:GzSpAhInQbNNOExOkMG3aotWX4

Score

10^/10

sova sova_v4 banker infostealer trojan

Malware Config

Signatures

SOVA_v4 payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	family_sova_v4

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Sova payload 1 IoCs

Processes:

resource	yara_rule
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	family_sova

Sova_v4
Android banker first seen in July 2021.
banker trojan infostealer sova_v4

Makes use of the framework's Accessibility service. 1 IoCs

Processes:

com.kkaxrzqsc.ckiradcii

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.kkaxrzqsc.ckiradcii

Acquires the wake lock. 1 IoCs

Processes:

com.kkaxrzqsc.ckiradcii

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.kkaxrzqsc.ckiradcii
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.

Processes:

com.kkaxrzqsc.ckiradcii

ioc pid process

/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g 4412 com.kkaxrzqsc.ckiradcii
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

35 icanhazip.com

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.kkaxrzqsc.ckiradcii

ioc	pid	process
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g	4412	com.kkaxrzqsc.ckiradcii

flow	ioc
35	icanhazip.com

com.kkaxrzqsc.ckiradcii
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:4412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/.com.google.Chrome.OynNiF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Cookies

Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Cookies-journal

Filesize
1KB

MD5
86deb376c6f9512d030b7236f44cda88

SHA1
59b2690e71c27ec97f5dddd7128447b7d00c1a4e

SHA256
a0e473f2cca2492964182b4963008fcba905b390b4f9a9090b9f230bccab9ac6

SHA512
d1c69272fde3837ffb3c573b5470ce7eca3c337ff574354cffdedd3df45b169b08b8515477640683cfc7dcdd4170b66fd2847779fb18ff7516bdb9ecaf3e0c73

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
ac670a3cddfe3cdb40c6c79c6012c8ef

SHA1
dd7a8560b0b24a2e35bdb4c8b1c75207bc4abda6

SHA256
db00f24ce898a55c87a8c2fd8ef01b6f38e2daf2a8f9031c5afacdf90d473a23

SHA512
b42b736cecc4f598dd5db5fd8d2646a61fdb7eb94e3fe480c329876ce1a67632085ff52e2ae9fd666f00c1d480628892dd8635942a9b73844d48c5e607408420

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
6f232e9dc0c432535dcb7d259e7b864d

SHA1
03b700a1d31caab240bedfd8c478a5b55b9361b7

SHA256
ec0aa603aa36a87c75dcc6db71c0701d091bf03ab7749061b1cb942316790257

SHA512
8335b459ea3ee0d8e887826c200ebb7783419b674b64b03b0781e9355334abf5db78b94466131a71abfec0f6d6f720f3b1c6b6652736a4bac89dfbb8b3a4ffe2

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/app_webview/webview_data.lock

Filesize
29B

MD5
6e466b69d9d1fde048b7ec489e3e42ea

SHA1
78e0004e3cbfd854334fe6f549c361520c6bb93b

SHA256
8ed24d51979bba126b4bf63c3ed17c4fd3bd55e5ef9082f31e546b70694bc6ac

SHA512
f129a39f0ba5daf917794f01ca5536bdcb097acafdbfc431be21e8dec5161fa171a14700e26d32ff84d3522315cfbd6ea7ae6e43c4421bcd74d8751fb5ab75b2

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
54cd805549ddecb0db5114f7b52b538f

SHA1
b11993e403d3fe60fa79b6c587e52321ae6770d1

SHA256
f7b28243c3ba32b2d156d2344871920ae7d8a8e44bbb63546940d380aa23296a

SHA512
3394cad0986ce7cd91c407a6e98a7d65482ee94299f99468d5a3dead618619395679f993285b9f3abd8adc41e1c9c375e050ffe31f96cd390886791f87455311

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/5d8891fdc2085160_0

Filesize
348B

MD5
0a02d2494c7989c57d07b0c2d607290d

SHA1
dcdf9fdfd707a1c20105d72cb764f11aa7e92336

SHA256
e61333c683a26add0038e9b63c90b33dbf6a9a3c2361620654e1e1e8210b98a7

SHA512
361d9416374c658bcfa3f2ea5ec54e9e5df45d01b37f8df098abbf6c997df2fcb4923df8f592830b1bd66f41649468010059950173f28b7b8c2e1aac41f0f322

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
d33ea0d11b5262e283e5dd6dcb6faf6d

SHA1
dcb4eb9c8ee8e56540be502b8ee5cdbd6c722cce

SHA256
1bedd5928dfe7b120ef114dc4ccbe756a08588123aa21508d35286845c822245

SHA512
8094ae6dd7b89fef775bf1bad50bb9bc8abd1d88a7f7352dd13c3ae33f9b74d043418e4cfc2d6d719e710e169e377a6dac14008940071a68489a3c7faf1e533c

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
1099768411e90f0ac6914bb8996a46d6

SHA1
81b24e138d060f19461547c6d3edc6d95c1ee64f

SHA256
14782dd154a393c4a6d73b2abe4ed1d40a96b6a843994035d18672be39e6331d

SHA512
466c9c5d3f8c70be0b107fba3cdd01fc377add4f658fe48cb02080c1632cec35ec7d8348242a78a01667b5ab10966da9e74fb2d5b2eb2275cc23a31b82a8b239

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/a7661f01494f94da_0

Filesize
346B

MD5
5b0337166b1b7c295563a41c6d06a332

SHA1
f5e6bd8a0bbaacf8208d47dc7190605f6c1a01fe

SHA256
5b063f651667628d1cc9593e8f60a7f16f4d3d0e8bd88cd2cdb4dc5f11a6cf26

SHA512
34221dff9ecaa008e909602f4f13844f3140964cf4660f16843860a2c940216dc312589961b4fdaa3f9ff12754876f0ba970310c5c320d703495da58fe289b21

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/d3b32b0863aae7ac_0

Filesize
356B

MD5
9b5050ce8c354f5dc68ca08ba4f493fd

SHA1
ed431da9b69dabe8e1c59a150f305896dd6ccce5

SHA256
82c196a9f72b3ec40e635efee25dfb9484eef197edc3fc644d334e8cc0a361e0

SHA512
b09fc0736c859fcf029a652db1c0dc3c286bc08c300973677985ad8c91ee632adcfbc66073b72de8197fcfe35c42bc08bac7e9f49ef3598a6b6af510894fa924

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
144B

MD5
b26bf21fd34804425293bb0cf811d6f6

SHA1
be79388ca1ec26a9f3b8e57b0861e85d9b6151f5

SHA256
e5c102a35d464a2d46248a7e0f92e7abe6489810c73e39ec40bdeb9c3c9af029

SHA512
cce2effba98826e8bf8644210cfb59956aa1e11c2f850550865d6ff3262cdae081afe0791d0e74adbbca4f3964de49e5beaff0a553fb06409bbfe45ca0cab992

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
96B

MD5
2f282bac2798fc1a5243624879035f40

SHA1
9577109c297902296605d06cd558b42ed98366b6

SHA256
5c3139353f1e5bacef673fb64e6e1617588a404d6cac3ac77e5407dc3d5e6a0e

SHA512
9b912b0b087ae0689138f3bd52952007b19688a758caaeb4f76cea41f8bf733d82fb862ac9f10ec785e21f912b4aa13cb7fde6d2c1919c032f2bf96497c9c89a

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/com.android.launcher3.prefs.xml

Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/shared_prefs/multidex.version.xml

Filesize
307B

MD5
ab84fa3c2421212f44fe1458aac3fc3f

SHA1
161a276f9be63d70a022a0d16ef0e3d62279021f

SHA256
6946540ad88d54665d2e5786278c15198d2c9ca13c4e581305153be68b5b8db4

SHA512
451bdc24ab5107465e8a407195d856787c538c33a400953b0e63f88196ef0d2c07754bc4b6b181742c60d9a1ee6c3a2eaaaf03c475c5f57425467fe270c00db5

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/base.apk.I8Tuf8H1.t8g

Filesize
1.6MB

MD5
cb24a6c4d91a05002e4396d94936d9eb

SHA1
7391cd105430e2017d9bb22b4823ea400f34427b

SHA256
d9e95c193a3ffa0c2e621425c503031c18afa77f3e90cfccb9ed817458838888

SHA512
17923ca572625866d4aaef2ba57e7965638ab5a09d645f4660f0797a6dc6bf38199320e5d67f8d247e78fa30c0252abbf442baca539333d44a008e21a9b3de9a

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/gUIHgfIk.yTyp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.kkaxrzqsc.ckiradcii/yki8ygfaUa/k8tUITp6jja9jkj/tmp-base.apk.I8Tuf8H2181769132340477754.t8g

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit