Resubmissions
09-03-2023 12:51
230309-p3sdwsbd2x 1024-01-2023 13:11
230124-qe9hyadb3z 1024-01-2023 13:11
230124-qe3emabe74 716-01-2023 15:02
230116-senmksgh58 1016-01-2023 14:58
230116-scnjsscg9v 10Analysis
-
max time kernel
3820166s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
24-01-2023 13:11
Static task
static1
General
-
Target
Video_Player.apk
-
Size
4.3MB
-
MD5
54013894dcaf20181b2ca431bb9d0575
-
SHA1
6cb71982ce39526340616a51ab45ccf46dcf799d
-
SHA256
894723b804ae51e7294a69169f0d7b0244a18ba712fa8e3042cb63e8e58cbccf
-
SHA512
fca6cf580c15e0e623b76fa83c9d1234d1f376a9059274e24debdab02ae6c9ab74c16be7b13c26cca810b93290405619a5a17a1dbf9d087dcea57953aa74369d
-
SSDEEP
98304:QkrGUuVDcQJBwXBtEgQJPL8dKNPtJOvar/xGvKp2QqP2kWnRUrCvLP95cd:Q21uZckBwXBtVQ9wG/QSpLhRUrCvxWd
Malware Config
Extracted
sova_v5
aHR0cDovLzUuMTYxLjk3LjU3OjUwMDAv
aHR0cDovL2RheWlndXZlbmVjZWtoYWJlcmxhcmdlbGVjZWsuY28udnUv
aHR0cDovL2hlcmtlc2VhY2lraGFsZGVnZWxlY2VraGFiZXIuY28udnUv
aHR0cDovL2Jpemltc2l6ZGVuaGFiZXJhbGRpZ2ltaXpoYWJlcmxlci5jby52dS8\u003d
aHR0cDovL2thcmFrZWRpaGFiZXJsZXJpbmJhc2JlbGVzaW9sZHVpemwuY28udnUv
aHR0cDovL2Jpemltc2l6ZGVuYWxhY2FnaW1pemhhYmVybGVyZGVheS5jby52dS8\u003d
Signatures
-
SOVA_v5 payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4255-0.dex family_sova_v5 behavioral1/memory/4192-0.dex family_sova_v5 -
Sova
Android banker first seen in July 2021.
-
Sova_v5
Android banker first seen in July 2021.
-
Makes use of the framework's Accessibility service. 2 IoCs
Processes:
com.exist.debatedescription ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.exist.debate Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText com.exist.debate -
Acquires the wake lock. 1 IoCs
Processes:
com.exist.debatedescription ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.exist.debate -
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.exist.debate/app_DynamicOptDex/oat/x86/CGSbpH.odex --compiler-filter=quicken --class-loader-context=&com.exist.debateioc pid Process /data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json 4255 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.exist.debate/app_DynamicOptDex/oat/x86/CGSbpH.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json 4192 com.exist.debate -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 50 ip-api.com -
Removes a system notification. 1 IoCs
Processes:
com.exist.debatedescription ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.exist.debate
Processes
-
com.exist.debate1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4192 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.exist.debate/app_DynamicOptDex/oat/x86/CGSbpH.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4255
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5620c929c8196c891363645faae990759
SHA17afb9f0944b1ada292a0352f551136c4ed33236b
SHA256c307f9d17ff1f91aa0f9256e61087d0057688a4c1a8c9c2c0ad517737110c143
SHA512b0106feb245419eaf2a86bf5a3f30c9ff6fc3bc3dd23fa62dff1a47a4891ce26626c7ae489a4a8368cbae71ea99d5d7cafb8bffe9d7777bf33dfb71e3dd7a6a4
-
Filesize
6.2MB
MD540cfb27f41c2d5877e3759c571f49556
SHA17b303336095219ec463b4436951ce480ee3aa125
SHA2561bd92a9bfa65b34834251e0d150cb7cd9df226f42dac49cda7d9caa918a074f3
SHA512673cb4f94c681833c658e6b8d744d80de03a3b1447d6184d36a60ea23334c62ad36897958665d3a3d3a304d35bf0540e043ab21e5968e20bf4e54440fa2f3521
-
Filesize
6.2MB
MD51ef9b27a9dae41cca65cb3472e69884d
SHA1f9ea99749a313184ab4826f9e2daee22c33c4b25
SHA2567295be9efb520d79f517c68cd8d560e2b7d175d239be3a3761576ecb31f36804
SHA5126d8402d6ac777c708f6fd2a0c60ee243cbd60b47c6bfcd0c29ce8c40e6c5998b537d6bf1285f6db08068b7104acc7a5b6e4a26c0a2b56c3390206d8e8c69545d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
64KB
MD5cb7543c4df600f2af58097cce0e334ba
SHA183cc92f38c27fdb4fa519b1ce2f37912f24af1f0
SHA25664c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233
SHA512ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980
-
Filesize
1KB
MD5de0f51173fb1ce5dbe14668258a9113c
SHA19225e6af2c4dc420e3998a877a98e140de85c883
SHA2563dcac7a8aed9fb99c0442093311516a02a2871f891f28a43ec8c4b8af398eb60
SHA51295e05d152b4b76032b219536dda19084fca450498ce09074acac38f6dd1c7d0924d988e2fc46d8fc841bdfd90db8b4c152cbdcb82ae5515e202bc2ad92fe0f03
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD556cdc8f45984a0ee3f248788890a7f71
SHA12de6ff64756c80d955faaa85e7b27efa9e460dcd
SHA2560d7eee8ee36502bb5dcf2ed660c493a3e94d8eca38ffbeebe2c457a696b2c0ff
SHA512b372334a9bb4abae06e2c3fa1b9cfa8749c24a4572af49793611a09092e9d31acb43e342ff6eb7a528e98c8e1a99e9d090173cc50bda6141b5d2116e4c523afc
-
Filesize
48B
MD5b5ddad02eeeead48f5b25282602bff54
SHA145772287ae4532ecaf9c139ba39a87dc100f0b7b
SHA256214b4b31774febb9f087b8f00f57804d900f755a429e7b0a9892021f216623bd
SHA512e7968d7c3aab12a76ee4a23052e4db61e96e0249affb55f23f16fd251275ba151d689ac2cfb5ca4caa63499a19a1737762d3876225264dfcd9530e8f17db4067
-
Filesize
104KB
MD5dc79f9ce5f3ab5270b33e61119dfc959
SHA11844bf222a5144b513dcf2fb50a18c011701c647
SHA25647e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA51218b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e
-
Filesize
1KB
MD54004461e1764c98fe08bd66e9955afca
SHA173750eeb303357a13073b4356fe5c412c0bce2ec
SHA256a2309ea9eeefda0fca3dd9759f3a0b883afcd1ab0330020d7a162ffa2196c296
SHA5122dfba47afb67e87df0131edc6d17de0215e8feca762b7fb848a21186fd56183875cb06eaa79b29adda494d785fb568d59059a1de1257f9fe7a374ea985092729
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
36B
MD5df309d7c736cedddbf2b6c830f941edf
SHA132d1a7f48e4ec3ba7827110443c5b8e7b0b54d66
SHA256359e5360e63b996a1e54a73cf6f482328d333f206636d92acc229e84278c57da
SHA512b109a64c6da10869e5004db2d384ba2c44b5e97f619e46537e90e2d76444c65c316b37f9a72791bba2469d7e9199ab3d5d0495c85303e8b94d9f86e85b376447
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
198B
MD5ff14e7566befc1722b417e9cb09a8bf1
SHA17b5c63dad525df7925ad51189590271f6558578a
SHA25651b7edf4944c9e5204e9ffd298606e713b998c27df599e0d6054b91a1a71d807
SHA512fe682a42f213ef46fb67a164a55198969e9e39b99f069b65464a31679f211e5ed5085cc4b74e738b025c2503f92babb2cf0f48a430702c4ccf8bd39a2c52b31e
-
Filesize
21KB
MD53dbdabf8bc92b0e5fcceba1d88f970e3
SHA1790bf66cb15f4c3a4ac23f0eaad86bdce0b0f198
SHA256dc925945dd74563381519f875112659080064e588fa5cad1c4503bbb21af6926
SHA512d3fc0d31647ba67e42fccea9d91da8a6e77adb7d1fa7c736023202a842834398c0e4249c8c9569640891e49864b41e0979b9ad33cdcbc364a488ede18d4c4310
-
Filesize
191B
MD51fbbcb3642549458626db2a7305250e6
SHA10a2a98af87796bf89d24186c6d9ca4e0e87d4ff7
SHA256991e6259ea473cab000c5acc66565a52e0bfb81c8558e86616606b52dead8b43
SHA512e6f145a5d6943efebbc61619a7395ac188a532e45d1bd6bde26ed379d3e3ccb16993d201aafae952bf3283a000c80d8c3034f0a0dafa1535369c50f65e58e282
-
Filesize
208B
MD5490742a415602561da8a3f624a951113
SHA11630e665e60cde8378ce4708c343969bef7fc0ef
SHA256b5df4eb95a1d5f8d739cef3c6334a6ef60232ef92e861eca5d85bf73aac53537
SHA512f97f9c11b72d594c8d0dbda3eb50f7fc5f1a6e8ebd74bd15cbeb190b91a4ad8986d5d6e5385b73204576ac20105730bcd4e890045c52fd3a93f86d602f683276
-
Filesize
184B
MD59daa777f6ff8c57d253646820895ea1d
SHA1c8a3994199f0364520a66fc1c2902df27533e365
SHA2560587c9c588c75fabe885fcd15f4b4a540bf4a16c39ae869032ea0c216a6d42b3
SHA512733e80d32e59a6f84f35c55e4f774ec215c5c2a4933775110bab152a86198266d9e6c70e185083166d01e23682ebffd72a3252d6325a76fa03137fda825b0c3d
-
Filesize
210B
MD57fff090c8abebea4eebdaa48cbd2bf27
SHA10f6c7c8055f9e7cf6609bf753bdf926b819e9f95
SHA256772f43b4ce0bd4b0ad044f653fa5ad2eb80e4cdf87ac99b11c55080a42d28b9c
SHA5124014378f3a79b58be046346f77e5d0f7893f7a87067974752d8caf39e1962af391d283170acd8457fae2cc49f85cb15c206d81c5101cf0b16b7f66c4c8869584
-
Filesize
289B
MD56d25b33136e487b528fc0ac7e26546ac
SHA1646b57efef23e28fb1989a322b7a87855f0c1c90
SHA25673e73f5b211659f83b94c608e5eaa955074f40615dec6a2bbf66d47336bfddab
SHA512cbdc6adb4eb2d56b595e341ed8367e66e4ac3358c7c5821db4155e46691ace84c01a3e67671c7e834c2d10dbea4c7fb509e28bfd6ccfccf7817f3bb69f602fd9
-
Filesize
176B
MD5bba35bbc68637a31e472606cbd6d899c
SHA110be3568f4eeb1ecc74db077409eb482254f33b0
SHA2560346cf896323677b561d2441bb24f8d7fccad0c19db80a49e96c73f974cfafd8
SHA5120258199fb15ecf82e4c89bbe2ccf345aaa7a708569ef5fa37994cac0d1bb794810542329f07c48a5c4b078d6adaff6859434caafe006edfd44f70e4ec7d8a3f4
-
Filesize
2.5MB
MD58a181c6d8eefd20b58c3316a6074c16d
SHA1e97f7a8a24f67d1fe5edcc6d431fee8668159cd9
SHA256378760d03d9bedd86d14fc4bfcef960882f8929ea4a3b22637cf7ab412f02cb1
SHA512caf0e0b13cd00e239897e4f213f2b088243f4c6ab5b5e12977177c61f2a18c936ce8680bff21392436bdde4e5c4c944eae6c1026a80dbcb60e9b0e228c7ef8a1
-
Filesize
205B
MD5d2ef3020ac0a4d8e79de415e15eef8d7
SHA1a3a5ad100f692cb52c0419cf3fc30e7605c2d2e0
SHA256caec162c8b1293961b145e2bb04d475d991ef2eae435cbb36bd86c1143568a7f
SHA512da431a5ef9ae2b25a641de367ca3fdeb9013d79e80be6c81c825f0c4feafd3693b85c76ea2adf05353f02c21a52d2022678188fffa770e0c068c762019aae4cd
-
Filesize
20B
MD593027d42b314432c4216e6cfca48b384
SHA143448dd8102979c3926828182579691945eedd4e
SHA2563cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e
-
Filesize
48B
MD54e53257f39a0800a5d9aa6a2d1fe9ec8
SHA1afc4f58ab34c1ceb39f404287db9dfe12a2b8cfa
SHA25648c920e61a475bd3ac5c988edda371f9bcf23d611681967826ca45b68ec88a8d
SHA5123cd628c7459b857564cca45eb8954778581bee1a4a8d1537aa37d0b26090a700742b879ddd756d3610f4c330c685bb0ebccc16fac8dfb94c0bc06282a26cc518
-
Filesize
72B
MD51a814bc83c2c146dc02488a3a4eb6907
SHA11e207461def210c498febb9df5d7566cb6717f49
SHA25642e181c333c5f89ce111b5d510705bd42acc96ad8fd26751ca080142c736817c
SHA51216748c29da3b4eb0306f5582caecb570033abd7507e8b1ba5bc65c43dfcea89008e79f119fac68bfeac1d62770cd3e762f8b05765f6ab7cbbace7f1b9f69d75a
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
524B
MD5dbbabea54d064f66c54206b8a1c4f9b0
SHA167b676768030198c1643cae0361d71b1a7eab4b5
SHA256138ec9fca31fb995194284511b2ab88140f2ebda233d6c2b04517713f652f535
SHA512283479e5ca74c431ab5876f3689da2b566ccd81ee05b7bb5b29d4dedebc0d57dfe30caedfbda8790c6d82bb65bd3ce2e34f211eb91189e5ada3dfdea03aa7d55
-
Filesize
8B
MD57dea362b3fac8e00956a4952a3d4f474
SHA105fe405753166f125559e7c9ac558654f107c7e9
SHA256af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
SHA5121b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b
-
Filesize
229KB
MD5d2aff8af087881bd0b9e6203b438dc5e
SHA12c8fc54b82996fb8875689cf83acc3703f184800
SHA2565ed9f0b67b15e3ba95704ed055db95c1d5529c75b52d61a4332189238a48cb6f
SHA51207192806c65a8dfe5bc07c26edf8a3d9aef1acb1f9f36ded405b0a435fd5fe1649c1e807ea04a1338dd90b7c4e5789cf53d87a0d66f9e16d8486cb4451e08fe7
-
Filesize
127B
MD521223e9184445fe043476484cd8cb1f9
SHA12b4813f849121d60ba35eb0889080668bb62c778
SHA256bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48