Resubmissions
09-03-2023 12:51
230309-p3sdwsbd2x 1024-01-2023 13:11
230124-qe9hyadb3z 1024-01-2023 13:11
230124-qe3emabe74 716-01-2023 15:02
230116-senmksgh58 1016-01-2023 14:58
230116-scnjsscg9v 10Analysis
-
max time kernel
3135442s -
max time network
160s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
16-01-2023 14:58
Static task
static1
Behavioral task
behavioral1
Sample
Video_Player.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
Video_Player.apk
Resource
android-x64-20220823-en
General
-
Target
Video_Player.apk
-
Size
4.3MB
-
MD5
54013894dcaf20181b2ca431bb9d0575
-
SHA1
6cb71982ce39526340616a51ab45ccf46dcf799d
-
SHA256
894723b804ae51e7294a69169f0d7b0244a18ba712fa8e3042cb63e8e58cbccf
-
SHA512
fca6cf580c15e0e623b76fa83c9d1234d1f376a9059274e24debdab02ae6c9ab74c16be7b13c26cca810b93290405619a5a17a1dbf9d087dcea57953aa74369d
-
SSDEEP
98304:QkrGUuVDcQJBwXBtEgQJPL8dKNPtJOvar/xGvKp2QqP2kWnRUrCvLP95cd:Q21uZckBwXBtVQ9wG/QSpLhRUrCvxWd
Malware Config
Extracted
sova_v5
aHR0cDovLzUuMTYxLjk3LjU3OjUwMDAv
aHR0cDovL2RheWlndXZlbmVjZWtoYWJlcmxhcmdlbGVjZWsuY28udnUv
aHR0cDovL2hlcmtlc2VhY2lraGFsZGVnZWxlY2VraGFiZXIuY28udnUv
aHR0cDovL2Jpemltc2l6ZGVuaGFiZXJhbGRpZ2ltaXpoYWJlcmxlci5jby52dS8\u003d
aHR0cDovL2thcmFrZWRpaGFiZXJsZXJpbmJhc2JlbGVzaW9sZHVpemwuY28udnUv
aHR0cDovL2Jpemltc2l6ZGVuYWxhY2FnaW1pemhhYmVybGVyZGVheS5jby52dS8\u003d
Signatures
-
SOVA_v5 payload 2 IoCs
Processes:
resource yara_rule /data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json family_sova_v5 /data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json family_sova_v5 -
Sova
Android banker first seen in July 2021.
-
Sova_v5
Android banker first seen in July 2021.
-
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
com.exist.debatedescription ioc process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.exist.debate Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.exist.debate -
Acquires the wake lock. 1 IoCs
Processes:
com.exist.debatedescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.exist.debate -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.exist.debate/app_DynamicOptDex/oat/x86/CGSbpH.odex --compiler-filter=quicken --class-loader-context=&com.exist.debateioc pid process /data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json 4204 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.exist.debate/app_DynamicOptDex/oat/x86/CGSbpH.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json 4132 com.exist.debate -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 41 ip-api.com -
Removes a system notification. 1 IoCs
Processes:
com.exist.debatedescription ioc process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.exist.debate
Processes
-
com.exist.debate1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4132 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.exist.debate/app_DynamicOptDex/oat/x86/CGSbpH.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4204
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5620c929c8196c891363645faae990759
SHA17afb9f0944b1ada292a0352f551136c4ed33236b
SHA256c307f9d17ff1f91aa0f9256e61087d0057688a4c1a8c9c2c0ad517737110c143
SHA512b0106feb245419eaf2a86bf5a3f30c9ff6fc3bc3dd23fa62dff1a47a4891ce26626c7ae489a4a8368cbae71ea99d5d7cafb8bffe9d7777bf33dfb71e3dd7a6a4
-
Filesize
6.2MB
MD540cfb27f41c2d5877e3759c571f49556
SHA17b303336095219ec463b4436951ce480ee3aa125
SHA2561bd92a9bfa65b34834251e0d150cb7cd9df226f42dac49cda7d9caa918a074f3
SHA512673cb4f94c681833c658e6b8d744d80de03a3b1447d6184d36a60ea23334c62ad36897958665d3a3d3a304d35bf0540e043ab21e5968e20bf4e54440fa2f3521
-
Filesize
6.2MB
MD51ef9b27a9dae41cca65cb3472e69884d
SHA1f9ea99749a313184ab4826f9e2daee22c33c4b25
SHA2567295be9efb520d79f517c68cd8d560e2b7d175d239be3a3761576ecb31f36804
SHA5126d8402d6ac777c708f6fd2a0c60ee243cbd60b47c6bfcd0c29ce8c40e6c5998b537d6bf1285f6db08068b7104acc7a5b6e4a26c0a2b56c3390206d8e8c69545d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
64KB
MD5cb7543c4df600f2af58097cce0e334ba
SHA183cc92f38c27fdb4fa519b1ce2f37912f24af1f0
SHA25664c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233
SHA512ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980
-
Filesize
1KB
MD55e832377f41caef13f1b7b7f3ebe6260
SHA1165ea97149c361e2c184e4658f6936aa27480f80
SHA256a9ea40add242702f565fc56f1d2dc7d8251c61c9911329e213527ae097b3fbcc
SHA512f4994a326ec808b9a2272a2cd7773d5d98d1673002a74c9742c53f42c1a3a0a1d576a9cd3ba5599efed9921617ec4457e72ec3489368370847db6a10c6e44432
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD52a0a419946f67858de08d16454ee62b4
SHA17105996e7734451c695584858bb20a024404f53d
SHA256d61b42e3f9b5a96779fcbe14c3b45714ebe4b3722a8f2b0d03c0aab8ad5e2f39
SHA512abb4a783e26bca08853b4846f8ccae620c4a779e2f880618bc2311d6f6f84cde1894d3fd96800db163c53547515014cac9ccf556b10cc1f678e8737f3f6f4d5b
-
Filesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
Filesize
1KB
MD5b7903a3ecb8cf5b39f1ce485841370fa
SHA1140db3d2bd0527d5f1fa5fa0ac5873741bd15bbb
SHA25604b7e6f1841654f98d2f44eb5606e3b4b8c5f234c59033710f66454741783027
SHA512952732162093f3e351ce23bfddd6809990113c8c9142212288530c6a911b88093ffb8a97b7764e8a4a45ad06ad5a01607f3ea4c97c8c9d8fe2d62be959693ea1
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
36B
MD5ae9f0d3178289588dcd5255c135d0b00
SHA1f05f821e4bc2f5a6553e56cb976645d8b4cb49a3
SHA2561f258f90e8d50dacd699904ed843727697a3e7ec231a5bd2bdc6e0961ae2f6a1
SHA512e5b211cba86a1e47c18a973638744013c2c65f77d87f9ca80365bfc95f4b75b55f6fc85c2ed4aac93e25aa51cc103bc1299e5c2ea7c1f8ba0ad3a40230d2c135
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
198B
MD5ff14e7566befc1722b417e9cb09a8bf1
SHA17b5c63dad525df7925ad51189590271f6558578a
SHA25651b7edf4944c9e5204e9ffd298606e713b998c27df599e0d6054b91a1a71d807
SHA512fe682a42f213ef46fb67a164a55198969e9e39b99f069b65464a31679f211e5ed5085cc4b74e738b025c2503f92babb2cf0f48a430702c4ccf8bd39a2c52b31e
-
Filesize
21KB
MD5c153fb27ad815e99e833d8a5033dce21
SHA19586093e30a2ee13226d12a2c77efcc18d1fd771
SHA256902b9f601e66f3e4b2dd272a1488946b559ea4a3ecdebdc9fca21c3e5de3cfe2
SHA51283ffe744f333d1a0a3d7b90625e6ec5d511828eaa8c2839d79ec4f0181a12b76e8bcfce1da9717be3aacd8769ce81dbd1deb7c24d99b58de5aa4f9c5023ed2b9
-
Filesize
191B
MD51fbbcb3642549458626db2a7305250e6
SHA10a2a98af87796bf89d24186c6d9ca4e0e87d4ff7
SHA256991e6259ea473cab000c5acc66565a52e0bfb81c8558e86616606b52dead8b43
SHA512e6f145a5d6943efebbc61619a7395ac188a532e45d1bd6bde26ed379d3e3ccb16993d201aafae952bf3283a000c80d8c3034f0a0dafa1535369c50f65e58e282
-
Filesize
208B
MD5490742a415602561da8a3f624a951113
SHA11630e665e60cde8378ce4708c343969bef7fc0ef
SHA256b5df4eb95a1d5f8d739cef3c6334a6ef60232ef92e861eca5d85bf73aac53537
SHA512f97f9c11b72d594c8d0dbda3eb50f7fc5f1a6e8ebd74bd15cbeb190b91a4ad8986d5d6e5385b73204576ac20105730bcd4e890045c52fd3a93f86d602f683276
-
Filesize
184B
MD59daa777f6ff8c57d253646820895ea1d
SHA1c8a3994199f0364520a66fc1c2902df27533e365
SHA2560587c9c588c75fabe885fcd15f4b4a540bf4a16c39ae869032ea0c216a6d42b3
SHA512733e80d32e59a6f84f35c55e4f774ec215c5c2a4933775110bab152a86198266d9e6c70e185083166d01e23682ebffd72a3252d6325a76fa03137fda825b0c3d
-
Filesize
210B
MD57fff090c8abebea4eebdaa48cbd2bf27
SHA10f6c7c8055f9e7cf6609bf753bdf926b819e9f95
SHA256772f43b4ce0bd4b0ad044f653fa5ad2eb80e4cdf87ac99b11c55080a42d28b9c
SHA5124014378f3a79b58be046346f77e5d0f7893f7a87067974752d8caf39e1962af391d283170acd8457fae2cc49f85cb15c206d81c5101cf0b16b7f66c4c8869584
-
Filesize
289B
MD56d25b33136e487b528fc0ac7e26546ac
SHA1646b57efef23e28fb1989a322b7a87855f0c1c90
SHA25673e73f5b211659f83b94c608e5eaa955074f40615dec6a2bbf66d47336bfddab
SHA512cbdc6adb4eb2d56b595e341ed8367e66e4ac3358c7c5821db4155e46691ace84c01a3e67671c7e834c2d10dbea4c7fb509e28bfd6ccfccf7817f3bb69f602fd9
-
Filesize
176B
MD5bba35bbc68637a31e472606cbd6d899c
SHA110be3568f4eeb1ecc74db077409eb482254f33b0
SHA2560346cf896323677b561d2441bb24f8d7fccad0c19db80a49e96c73f974cfafd8
SHA5120258199fb15ecf82e4c89bbe2ccf345aaa7a708569ef5fa37994cac0d1bb794810542329f07c48a5c4b078d6adaff6859434caafe006edfd44f70e4ec7d8a3f4
-
Filesize
2.5MB
MD5c070f249097e272236a8da3730fc59b2
SHA182e1c1013410da1f9ed2a14c359c9027780e4715
SHA256f5777e03e4437576a5717bf661f6d84179f0b79f2361bbaef6fefc1af230286b
SHA51205d821589d28e60ce27fbfa39fe30289205217ec394d874511b4aced07532211a2c5bef9b3eee0d364f5f3559c755f41940c6e990c87fba8ed2ccb1d17b01892
-
Filesize
205B
MD5d2ef3020ac0a4d8e79de415e15eef8d7
SHA1a3a5ad100f692cb52c0419cf3fc30e7605c2d2e0
SHA256caec162c8b1293961b145e2bb04d475d991ef2eae435cbb36bd86c1143568a7f
SHA512da431a5ef9ae2b25a641de367ca3fdeb9013d79e80be6c81c825f0c4feafd3693b85c76ea2adf05353f02c21a52d2022678188fffa770e0c068c762019aae4cd
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD51519ebad1558857cfee85f6d88b79ad8
SHA12a7cd0030fa456894653a544f4d9d9985276eaf0
SHA256330ec368a6ba5b74f6c05e0d7b86415888bf4e072eff185fb2f17b4c29cb9f32
SHA512541bb51192ce9475eca7c49244bdee82e19a051cefb0f444fb3c7cf7dfa2991f4a55920ab4b9491729dddd00a986cf7f123f20c534b19376f5834b410fc2fb05
-
Filesize
72B
MD5583e1b5fa6c68fa2a2327f35a114fefc
SHA12b6f17ef64126b5c813c354721e4c4a5404811e0
SHA256a0a5446202466b8bad483719c541b9c736494005f7f3219eac54a2f8582e3319
SHA5121636970544f74004257bb5d77862597383b3c8bf3f0cf9f0c70e363fc7f3de60c4d58c82228cb592717547aec55a134c44dbf4e75add7c13db03dfd00418fa32
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
524B
MD579cc9bdf80e805caea9a11e1f1229607
SHA1cb05fc27632266c705f6ccaff289c13c78217982
SHA256f19498ac4f4ee2ee0c8c1af4df2526c0b84d2e1e1e6b0482cdecd8c264b71f02
SHA512a8f442f4a634573523cf6a2c98cba105b32ee4eee80530b6b7a20e5540001e2c04fba40d1a2067ad3694e1015f69082a18f1790a70ba2295e284e2fd66895467
-
Filesize
8B
MD57dea362b3fac8e00956a4952a3d4f474
SHA105fe405753166f125559e7c9ac558654f107c7e9
SHA256af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
SHA5121b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b
-
Filesize
229KB
MD53c73d42aceac6272e533cd03baa308e7
SHA1542a947e30c25346fc56a7a64a25d5b5e4b7156a
SHA256d37755138a38b8d4ee779ec50a777eb032331e699db5dcb054688834ea050325
SHA51263e5cad7d02e178ded89d13f2f720c1448295f06e8942717377b20f984bd3cf65c5573ff14d5857a2ff3703745ec336612973c84930f3c52d595dec6cea5b24a
-
Filesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48