sova | 3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054

Resubmissions

13-10-2022 15:48

221013-s89f5sbhen 10

06-10-2022 16:41

05-10-2022 13:53

31-08-2022 20:23

31-08-2022 20:11

31-08-2022 19:40

31-08-2022 17:36

31-08-2022 17:32

Analysis

max time kernel
2922329s
max time network
138s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
06-10-2022 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ndQOhY0ypd.apk
Size

5.2MB
MD5

ca559118f4605b0316a13b8cfa321f65
SHA1

5ef4d5784738d79f22f9bc5e8db7c94985bc1a3a
SHA256

3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054
SHA512

091f07d51e9d7c924666f28a30b03e5ff887e239ad2ed9a99cbd65e7b9350c6fc89cafdbbe05de27f8ea6dc90ff8484c1b692fc891b58fcc6104fa6878e8f3d7
SSDEEP

98304:+Ld3yR0X7GPzP21DeReIrJ0jJMooanGHNdyc7scnuB5k9MWdU:+LxyR0X7Qz/diMolGfyXcNMWdU

Score

10^/10

sova sova_v4 banker evasion infostealer trojan

Malware Config

Signatures

SOVA_v4 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4200-0.dex	family_sova_v4
behavioral1/memory/4117-0.dex	family_sova_v4

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Sova payload 2 IoCs

resource	yara_rule
behavioral1/memory/4200-0.dex	family_sova
behavioral1/memory/4117-0.dex	family_sova

Sova_v4
Android banker first seen in July 2021.
banker trojan infostealer sova_v4

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.slhytrowb.wfxaicaiw

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.slhytrowb.wfxaicaiw

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	4200	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	4117	com.slhytrowb.wfxaicaiw

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.slhytrowb.wfxaicaiw

com.slhytrowb.wfxaicaiw
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4117
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/oat/x86/base.apk.hkyhafI1.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Cookies-journal

Filesize
1KB

MD5
85d5de68414f3cc715a70e134bdb5a66

SHA1
3c42f91ebd1865429457934e3f3b9d0af5d74ab4

SHA256
5d1fe5b778f6df4a1fee768fe995e6c43054c93712c37237c64cac147ba8d057

SHA512
e8395cf0b5a2ad60e9f6ee0a687bf72ce02d942f5c2bc61e1e04c89db06b453a855652485eb144615bdce09d6683190554a85be71817236c74132c26cad6f446

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
351313607661af31bbf33538fc26783c

SHA1
34c9e351fed79c18ecd54dcde870bf97f6f45a9a

SHA256
b0c8f0f487e5f7a5df935be904c7049bc2656c38c245aa99946825c17d7d14c4

SHA512
e7a2dde85d9ca65dce2be167d36e15c97903282a214791b97d6f78788f9d6cb0549304246c463dfe22a9b257f89e28ae8d34ff31fad0d134d7169c2cf3574413

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Web Data-journal

Filesize
1KB

MD5
72e439d3c634b60d1ffe403cf5644c42

SHA1
8a150fc408b2c53ed6ee34e5669256d49bfa14b9

SHA256
4ccb050b72ba19e2c17adf268f0d4b8917718e42d6bf8186051078526876695b

SHA512
7847d3a51b971446a6b263cafa06ae8725457f5ac093754c7200cfccf05c56e9b910c6db7c46097300c653e5b3a2ff7f24b4fc8e804818e52547d890c95c34f9

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/metrics_guid

Filesize
36B

MD5
aaf249722a6e3ad04c80eec646349f9e

SHA1
38d90318f9c1e6fd4e4a8bed8d30f86ef0843718

SHA256
833fb6fb6f18f1585884740ee7b0ac0131e9ec5e99a370f9d79cf5cd3f482bed

SHA512
b7dceffb660f6d6765e1ca0c1adcf2adb3d08c94626305bba2beee01bddb0151a2b4eac6f372da7f7160a8c760779b3b29199abd9b5fd7fa84441552fadad4cd

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/12e363d49ccf8b91_0

Filesize
247B

MD5
15a82153a4c9505c12cc470fcf650587

SHA1
d50cf6fc1ab4d70c26df2d2e765469256e4ebd6a

SHA256
c72eb37d898dcd960b6bea7e4335f9635169087f15c7cf9758debfa27bf83dbe

SHA512
50acf7d8ecd2e5aa7b7ec6f77dd2e5fb33ff33586469b70175cfae9c7ceb8d7a14ddf6293247499727d2c15c35e93054fb88f3364359e680b8473f3e3a539882

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/d449800084ea13d6_0

Filesize
158B

MD5
2cb8b37ff7093460aab6c621c8f818b9

SHA1
9c57b205842644cd4adc1e429ed3692c094a6ab3

SHA256
9c0df6d533eb9788aad886584bf997e50881ed6dfc91b5ad3e5ac6661aeddc43

SHA512
16f8f0b6eb94282d86852d68e2651d7f821a3611336888c6ede7439c7e1ec16e9f53d942cbeb694e44ddc4c24af9b599fac55aca28f45044d7dc85ea33c25406

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/dd533a7e05389102_0

Filesize
157B

MD5
04ad8537d5f4fc0939d88c2c58acb089

SHA1
bc6c99338eaaa146f1d33e0dd84fcc4d7ce7b1ac

SHA256
845e11384c61b8592e62f1d7b61af400c15a3806c7f58a35079ed2394a8ceaa3

SHA512
9348c2e038422b88b5cb2a9f769a4ca60910473fb3a8d054c6944b8cd4cf95e498aeb5d73d11c97979f2fbaccd7197b5a9433c8a8805acafe5dbeb184eb3bd4e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
27e0a6c6ec54d6d9b8ca5c68acd96b59

SHA1
c214a2091765676ab0df81a6eb3206bc75f73e64

SHA256
551deb00aa434d287a3ed00b5e33f59c747c5efcd7e0cd259ef4b6b3fb1c0bee

SHA512
70a7e01501cf18832e5c3ea319e4401e738f40cb7e12446a05104da0c34031f0ac98c87b9fef73bd334dfe8861e33557b2bdebf5d725d1a032fef1654ed63dcd

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
9aa78b28d19c57f0f79f4cd74c9d2eb4

SHA1
8fb1e4009c8eaeaf1470752647b7fc258cecba9a

SHA256
c02ece3183a699305af60bd961ddcbc6e92c6cf33515b131f05d5837cf6b5c9c

SHA512
271f773ee1534b18bdc9a3fd4a350842cf00cc7d486788c25aab590585b60ee745695d4f4d5c9cf81733221a0003b42455ceab8b0612d1aa19c8a8d0690eebaa

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k

Filesize
1.7MB

MD5
d88de6e7d0da8ed1048e50a65228861b

SHA1
6354701609b3540f2b099a6834ffce83f7cff066

SHA256
4392239b7496e249c652effd92ea73f8f24a2fd0763e28c0420c774c4883ca72

SHA512
afb24a980935ab6c62341bd7cee253092053add3257aaf370854b556405cbf69e0ed3789fa56492ec39a66decbe1588cb69420dad3f5818752001d10fab87fa9

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k

Filesize
1.7MB

MD5
2426b919cdc0753cfda937d3a87d6226

SHA1
f258933ea1ecdb552475032b89fc2b3c83e0e6f0

SHA256
e7c8f9bacba13bdadf4c74cf356dc7734b0a269bf1bf02695fbba37f87eaeb98

SHA512
2cbb1dbee4a7d8bba818b416b7015ba5128cf77b9ba53906fd6efc2940ee71341e62292a79e43eaaf061a6cd4c21a96893354ab4b8b54e35708b768de5fbf21e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/com.android.launcher3.prefs.xml

Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/multidex.version.xml

Filesize
307B

MD5
104fb900ddf7c7e9992205f8864fae63

SHA1
076943d07ff485bacf17eaa21203537811d85ed8

SHA256
f79bd9289ee5449e73f6098635342af0d027bf7e0998317fe3879d4ff3ef40d1

SHA512
310f5ec9068a91f294d1baffbe995e29001c23be64941b4815efd091b858d2ec5f0c4238d31adb54fb0799714e1451d3e243d7a36211338c6738060cb30bd7b5

Download Submit