Overview

overview

10

Static

static

7

Video_Player.apk

android-9-x86

10

Resubmissions

09/03/2023, 12:51

230309-p3sdwsbd2x10

24/01/2023, 13:11

230124-qe9hyadb3z10

24/01/2023, 13:11

230124-qe3emabe747

16/01/2023, 15:08

230116-sh8rxsha23

16/01/2023, 15:02

230116-senmksgh5810

16/01/2023, 14:58

230116-scnjsscg9v10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Video_Player.apk
  • Size 4.3MB
  • Sample230116-senmksgh58
  • SHA256 894723b804ae51e7294a69169f0d7b0244a18ba712fa8e3042cb63e8e58cbccf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sovasova_v5androidbankerevasioninfostealertrojan

Malware Config

Extracted

Family

  • sova_v5

C2

  • aHR0cDovLzUuMTYxLjk3LjU3OjUwMDAv

  • aHR0cDovL2RheWlndXZlbmVjZWtoYWJlcmxhcmdlbGVjZWsuY28udnUv

  • aHR0cDovL2hlcmtlc2VhY2lraGFsZGVnZWxlY2VraGFiZXIuY28udnUv

  • aHR0cDovL2Jpemltc2l6ZGVuaGFiZXJhbGRpZ2ltaXpoYWJlcmxlci5jby52dS8\u003d

  • aHR0cDovL2thcmFrZWRpaGFiZXJsZXJpbmJhc2JlbGVzaW9sZHVpemwuY28udnUv

  • aHR0cDovL2Jpemltc2l6ZGVuYWxhY2FnaW1pemhhYmVybGVyZGVheS5jby52dS8\u003d

Targets

    • Target
      Video_Player.apk
    • Size 4.3MB
    • SHA256 894723b804ae51e7294a69169f0d7b0244a18ba712fa8e3042cb63e8e58cbccf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    sovasova_v5bankerevasioninfostealertrojan

    • SOVA_v5 payload

    • Sova

      Android banker first seen in July 2021.

      bankertrojaninfostealersova

    • Sova_v5

      Android banker first seen in July 2021.

      bankertrojaninfostealersova_v5

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Removes a system notification.

      evasion
    behavioral1

MITRE ATT&CK Matrix

Tasks