sova | 3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054

Resubmissions

13-10-2022 15:48

221013-s89f5sbhen 10

06-10-2022 16:41

05-10-2022 13:53

31-08-2022 20:23

31-08-2022 20:11

31-08-2022 19:40

31-08-2022 17:36

31-08-2022 17:32

Analysis

max time kernel
2922330s
max time network
149s
platform
android_x64
resource
android-x64-arm64-20220823-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
submitted
06-10-2022 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ndQOhY0ypd.apk
Size

5.2MB
MD5

ca559118f4605b0316a13b8cfa321f65
SHA1

5ef4d5784738d79f22f9bc5e8db7c94985bc1a3a
SHA256

3eb7efa71648ae819f1bff89399717805129487081e8261dd65bf596f2467054
SHA512

091f07d51e9d7c924666f28a30b03e5ff887e239ad2ed9a99cbd65e7b9350c6fc89cafdbbe05de27f8ea6dc90ff8484c1b692fc891b58fcc6104fa6878e8f3d7
SSDEEP

98304:+Ld3yR0X7GPzP21DeReIrJ0jJMooanGHNdyc7scnuB5k9MWdU:+LxyR0X7Qz/diMolGfyXcNMWdU

Score

10^/10

sova sova_v4 banker infostealer trojan

Malware Config

Signatures

SOVA_v4 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4647-0.dex	family_sova_v4

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Sova payload 1 IoCs

resource	yara_rule
behavioral3/memory/4647-0.dex	family_sova

Sova_v4
Android banker first seen in July 2021.
banker trojan infostealer sova_v4

Makes use of the framework's Accessibility service. 1 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.slhytrowb.wfxaicaiw

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.slhytrowb.wfxaicaiw

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k	4647	com.slhytrowb.wfxaicaiw

com.slhytrowb.wfxaicaiw
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:4647

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Cookies

Filesize
64KB

MD5
dfb2098ca7b3bf16d6f5f1e7d3839af5

SHA1
ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d

SHA256
e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224

SHA512
fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Cookies-journal

Filesize
1KB

MD5
51ef435b1fedefabd958d1e48ba26d54

SHA1
a432456e357f593ee6dcbf6491d1da8cc4eda613

SHA256
5db0728f81c4250516b982080f4f0f70560cb9a93ea98052208f5113f0b9b6b1

SHA512
0c627ae17e1d1ca35773b476e6e453c423d66ee50075d2728b62c1b340770724869337e104819259834d84b1586ceada4f40c8dd9f5b59330173d5e26e8c7ffe

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/GPUCache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/GPUCache/index-dir/temp-index

Filesize
96B

MD5
d9826d21f83d33e8d6051081cb0218f3

SHA1
53bdaee35b065c752fa6f13800961042b386efda

SHA256
8c443c211c7d67b08075805eee7cb3c780f51d8d1471a1dced072bfd52fe19e2

SHA512
6ef890be75c831326bb381e3273119a4cf9de9d373b106cc684ad3e69336d135315866c4900a1e8c50b507569b48eb25fb0d6fcd7d5302b3ffd4693caf570a39

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Web Data

Filesize
120KB

MD5
a48cd9324b1f8754b07f00d863b840f3

SHA1
11c6614775b35a58f440971dfc87c8aaac6d6173

SHA256
8859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420

SHA512
35fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/Default/Web Data-journal

Filesize
2KB

MD5
165c2a20006edbc17c693ad1f77dcf62

SHA1
7d63a9be17c5471728b986f6adfa9b522e6c4edd

SHA256
4ed2d274a38d62ee7450970f4d301cbf751d69bd6bdd667370c2090012189908

SHA512
cf52974c5e1f3ceae7d4d6dc5295e201c57b567379817508135536221b08fe07325bfa899ddc07454f0298a1310dc67299c08af56df760689865bb1053261832

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/app_webview/webview_data.lock

Filesize
29B

MD5
18904d75915a074c133781be09531f6e

SHA1
94fbcdb5817ee3b5a8661676bb936573b1a9379b

SHA256
ae5510ffe25f64ca0ecde98d3a22d51b9c9f2c6242088ea9851bf80d0e3a6a47

SHA512
21a04d729f11b2896ce97656a107dbdc16e3d82ecdcb3d4769440ef94a78949d6b137f2404c11fda0227242cd11b7262a50dc479a78b816a7d0777127da9620d

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Crashpad/settings.dat

Filesize
40B

MD5
34ab8d3f870192c2de39d168a5bc6708

SHA1
ee88342ae985ff2ac983b8a5fe6f871d7c379e5c

SHA256
54397c3eb45c516c61a5b61b978f20861a296911f726b2feba66b4d7785b0971

SHA512
ccaf200554341f5cba53a400127d3bef880fbfec221a5b25092328a6b740583e024eccd30d99b110138fbb9b87b61589157e68bb3acf0622efe813b88fbfaa34

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/34dd37a88d836e5a_0

Filesize
338B

MD5
410804548bff6c6a723cce37af8c4a4c

SHA1
e595b9812dc186e4655e18bb41a47c951d0ecd5e

SHA256
016a2f54ae560aeb60cdf6f66a86f29f63a33aee2247c092fd00e4fdf0e5ca3b

SHA512
28ea106cb35bdb2f4a215e716d250df13a1f9d7aafd7595e803590fd766c3d0dccc2ba11b9c36712ad29e41c16bd9aead0d80c1864121364beb600c74b835385

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/6e9739198c241f7d_0

Filesize
520B

MD5
40400ac69e7f3fa9a36a392772b4f517

SHA1
2e5ee597b5ce48d201cc62cafb103e1193d4b9b9

SHA256
ffe58c8a3f6309820d8235e74c6fbcd5813c385f848cf03c031cca2ecc691a90

SHA512
8d80131a81f916c07411f925158ec14f31ba70ed5c3e155ce9937ae60a620ebba2ddc6e96f2c7390d45164ea1543f51c2edbd61011547ebb2c0e7d0b58d232ea

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/js/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/js/index-dir/temp-index

Filesize
96B

MD5
4086e765881075ca818c0150fd0fad93

SHA1
a2315821a51d9a9798f38a5e6e89c552d94c0fd0

SHA256
2815faccb50dfdd7616b3935b8bc253145e5de38ca2e921a445ae5ee08c243b9

SHA512
9c6b1cfd467f342f3d12b0dc782a999c385fad2ea6727d8326b08c31348ca623dc5e92da4a036d53fbc0c26a84491e84acda2e63778cacbb4f6fa023554b1f0c

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/Code Cache/wasm/index-dir/temp-index

Filesize
96B

MD5
0ce5323346cf991e9ee22a8c70b763c6

SHA1
4dc32b275969fa1856ba557220b797e1a9eb2bb6

SHA256
ee14fae82d690d4907ee8064cf3f14082c9b9717d94f81bca74f9c1f969d0f59

SHA512
bbf25b685a4072b7392ad0f14853b701260e71cd9448e33b7f3107680b2e9841b9ee7e53721f43576bb9dc7ee4c32375f81f72200a62db8fc366372eb955bcaf

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/ec384f68bcbe9b61_0

Filesize
340B

MD5
53c748b8d3078e77ba2255d6ca2bd047

SHA1
6c6d53aea5f4eb4a34653b0ecd8a4daeb0563c40

SHA256
3758f4b77fa21acd115ad8711d41320735d07c5b4d4363970444ac9f423a480a

SHA512
b8efc7d6a1e61490dc9515293ca2a7ae28d125dd447ff8b0d8f1e08f2da889148df4f85560316932f41841d014f27a7a7d733d60a344edec90050d96e806853a

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/index

Filesize
48B

MD5
6d7d499960179766cd4261d12dacc411

SHA1
e6f8553b0015e12b23cc551afe98763f3b1c9bed

SHA256
c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182

SHA512
6526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
144B

MD5
60562c54bf3fde8a13bfee0dcb164a85

SHA1
5073dfda3f42191904849aa3a7404e8b34e701e5

SHA256
6ac4b4631d1ad785cdbedbaeaeff7bb2b3cbeed13fd32ee660980412a6c64a4c

SHA512
d0763d1bb33051d90340204ced845b522bff298b00ca36d5b4e69d577a36e8de110233017c82459c67fc7b6454e488b24d825940b4314628e031b8c518a3716b

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/Default/HTTP Cache/index-dir/temp-index

Filesize
96B

MD5
3df9ea1aaae3ca3b26b2f68edeb61374

SHA1
5be44d38fc94ad9f055a0db18f89ef724eaa4ce2

SHA256
9ee22281b54d1f316392bad6ab3aef116a2bcd03b99ad0892f08e3f05b7ae223

SHA512
1c3224fb008b6b83d8ead8c2172641e3a2eaebe06c5a1b35eb7a14e55fb5268bd0d40d52ed281fbe3af0867966a59a19e9ee52d27aeea68ee2b382d263bddcd7

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/cache/WebView/font_unique_name_table.pb

Filesize
57KB

MD5
f080fa2a56ab5479d58063e5ea871447

SHA1
4b3fd57a98916fa5784305b76ba30af26b5253d9

SHA256
0aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815

SHA512
8aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/ihoftigt8f/ffkyffUhHfh8I89/base.apk.hkyhafI1.g8k

Filesize
1.7MB

MD5
2426b919cdc0753cfda937d3a87d6226

SHA1
f258933ea1ecdb552475032b89fc2b3c83e0e6f0

SHA256
e7c8f9bacba13bdadf4c74cf356dc7734b0a269bf1bf02695fbba37f87eaeb98

SHA512
2cbb1dbee4a7d8bba818b416b7015ba5128cf77b9ba53906fd6efc2940ee71341e62292a79e43eaaf061a6cd4c21a96893354ab4b8b54e35708b768de5fbf21e

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
97ccd9a2b2063143df56b6937f961ca4

SHA1
5e78a91ae5df289ce83443cb7d5589dd3504fb5d

SHA256
248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd

SHA512
86c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/com.android.launcher3.prefs.xml

Filesize
128B

MD5
20837fd8daf2a2de8d6c4ccd8e90653a

SHA1
7ac08617bd4585151c239325aea243d9eca586f7

SHA256
e05f0ae0ee70ef2efac07e999da273b5f506462b67549f9080f6cdf469d70cec

SHA512
a4fd7ac1ce847a84fe4f47c2e7079f00b16b86213fe840b70e3a55992a043da99ca6fe1c9a723e709e2ee3985ed3b7c5a299d1cf5b29e8228f3f81d3cbb6876a

Download Submit
/data/user/0/com.slhytrowb.wfxaicaiw/shared_prefs/multidex.version.xml

Filesize
307B

MD5
c5d133c10f8d1e2abe91876bdd475c75

SHA1
6c00670c7f7ef377d677666c30cada110f735cc9

SHA256
d3d3bb43b8e2620d0a2d662dbc9e627be9afa26174c928e9a02b5d9cb0f9c22b

SHA512
9902a9cc44e13549e0c69b7f6e1cf67be5a29a3422f221ff670078657491eaa209a7a18577fc7b3f37c3f2a625ab70b18232f7abe8b3ac01655b842031795590

Download Submit