Overview

overview

10

Static

static

7

b2e592c5cf...1).apk

android-9-x86

10

b2e592c5cf...1).apk

android-10-x64

10

b2e592c5cf...1).apk

android-11-x64

10

Resubmissions

06-10-2022 16:35

221006-t3rjtaabhq 10

29-09-2021 15:14

210929-smfa6sfbg7 8

29-09-2021 15:11

210929-sk47hsfbg5 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3 (1).apk

  • Size

    6.8MB

  • Sample

    221006-t3rjtaabhq

  • MD5

    b1101bb941285fc54a21c271ee7bf60e

  • SHA1

    e883525faf27f91493f17a657577289be038cd64

  • SHA256

    b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3

  • SHA512

    c6368129febea4c32145c3f941590afdea9370ceb4ea10d7920125da8807bd733cc27b70d248750afffad832012a5bc2131e08717af1e89a30d1a74539efe881

  • SSDEEP

    196608:1afUNP3J+obzYV6zNRxxdXBoWu3FGw0IMweI5Q/Dt7Xo3Ub:gcNvJ+LwRPxdxoNAw0IMCU78Ub

Score
10/10
sovaandroidbankerevasioninfostealertrojan

Malware Config

Targets

    • Target

      b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3 (1).apk

    • Size

      6.8MB

    • MD5

      b1101bb941285fc54a21c271ee7bf60e

    • SHA1

      e883525faf27f91493f17a657577289be038cd64

    • SHA256

      b2e592c5cf8ccc944c06a11ff156efdfa4233fe46e2281bab3fd238f03b505e3

    • SHA512

      c6368129febea4c32145c3f941590afdea9370ceb4ea10d7920125da8807bd733cc27b70d248750afffad832012a5bc2131e08717af1e89a30d1a74539efe881

    • SSDEEP

      196608:1afUNP3J+obzYV6zNRxxdXBoWu3FGw0IMweI5Q/Dt7Xo3Ub:gcNvJ+LwRPxdxoNAw0IMCU78Ub

    Score
    10/10
    sovabankerinfostealertrojanevasion

    • SOVA_v3 payload

    • Sova

      Android banker first seen in July 2021.

      bankertrojaninfostealersova

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks