Overview

overview

10

Static

static

7

Chrome.apk

android-9-x86

10

Chrome.apk

android-10-x64

10

Chrome.apk

android-11-x64

10

Analysis

  • max time kernel
    3906390s
  • max time network
    158s
  • platform
    android_x64
  • resource
    android-x64-20220823-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20220823-enlocale:en-usos:android-10-x64system
  • submitted
    25/01/2023, 12:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Chrome.apk
  • Size 4.6MB
  • Sample230125-payp7she81
  • SHA256 fcf0edf3418c9fb60f2899e86035aef19060c391abc58b626afacd5f42db81c9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sovasova_v5bankerinfostealertrojan

Malware Config

Extracted

Family

  • sova_v5

C2

  • aHR0cDovLzUuMTYxLjEyMC4yODo1MDAw

  • aHR0cDovL3lhbG5pc2dlemVuYWRhbWxhcmRhbmJpemhhYmVyLmNvLnZ1

Signatures

  • SOVA_v5 payload 1 IoCs
  • Sova

    Android banker first seen in July 2021.

    bankertrojaninfostealersova
  • Sova_v5

    Android banker first seen in July 2021.

    bankertrojaninfostealersova_v5
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • com.enrich.arrest
    1⤵
    • Loads dropped Dex/Jar
    PID:4719

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        JTFXbRq.json
        • Path /data/user/0/com.enrich.arrest/app_DynamicOptDex/JTFXbRq.json
        • Size 2.2MB
        • SHA256 f0ecca3dafe0d824cabbb5356cf3535324f9d670c1ddc81ef21da6b710d619a4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        JTFXbRq.json
        • Path /data/user/0/com.enrich.arrest/app_DynamicOptDex/JTFXbRq.json
        • Size 6.1MB
        • SHA256 98085cecb0a274648967b9ac2117c93263bd391d2a48b7cb58c196f6f2514aaf
        • MD5 SHA1 SHA512 SSDEEP
        Download

        index
        • Path /data/user/0/com.enrich.arrest/app_webview/GPUCache/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.enrich.arrest/app_webview/GPUCache/index-dir/temp-index
        • Size 96B
        • SHA256 5678a9f58fb51e6740679a295b8c93fae967f47f5168e90a75a3b0b97e22f4a4
        • MD5 SHA1 SHA512
        Submit Download

        Web Data
        • Path /data/user/0/com.enrich.arrest/app_webview/Web Data
        • Size 112KB
        • SHA256 c109aa8bfc364d5fd0756f1c9d35ee3d6df31325061ac70d8469f28cfc882ab7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/com.enrich.arrest/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 30affdd97babe8f2f8b1eb05215ea69fc93cb2173a6c2f270db2aa9bec607f09
        • MD5 SHA1 SHA512
        Submit Download

        metrics_guid
        • Path /data/user/0/com.enrich.arrest/app_webview/metrics_guid
        • Size 36B
        • SHA256 642b0f168a86de8ec9d899877384014c6d00c3c7f7fdf74a6b2898cd218d4330
        • MD5 SHA1 SHA512
        Submit Download

        settings.dat
        • Path /data/user/0/com.enrich.arrest/cache/WebView/Crashpad/settings.dat
        • Size 40B
        • SHA256 ced3c03ef93086c24d809a13d91d12409a271b346077f9245f3b2ae749907eb0
        • MD5 SHA1 SHA512
        Submit Download

        2f3337478e49e949_0
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/2f3337478e49e949_0
        • Size 420B
        • SHA256 2f166469a7293256f9e726bb8995a59c4a3acfd9a4d23e32a93957c49bf00ccb
        • MD5 SHA1 SHA512
        Submit Download

        385bf0055d90dbc5_0
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/385bf0055d90dbc5_0
        • Size 602B
        • SHA256 b993f719ef73ec5b39a9b44e7923efd0ab13d8c30a51c380d382a217fc9315d3
        • MD5 SHA1 SHA512
        Submit Download

        418ad5e834d66b76_0
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/418ad5e834d66b76_0
        • Size 406B
        • SHA256 938531cf2c097844124805a7cf357f33f7c01407ac351a2379549069cac04335
        • MD5 SHA1 SHA512
        Submit Download

        628aa70b6030a263_0
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/628aa70b6030a263_0
        • Size 392B
        • SHA256 a635c15a72ffa4d991e18f199eb32c0c255f8ba531dcfd8aeb2d4905c07a9e54
        • MD5 SHA1 SHA512
        Submit Download

        7081ad27615f85ec_0
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/7081ad27615f85ec_0
        • Size 444B
        • SHA256 53d33bb40213543472215130f4537aecbc1c7435c73593295329d07ae55259f4
        • MD5 SHA1 SHA512
        Submit Download

        8a9dd9b28322a4bd_0
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/8a9dd9b28322a4bd_0
        • Size 418B
        • SHA256 086b80f4935b1013d15c698f477598b150dfddb16d1ae7fecd94e1237658751a
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/Code Cache/js/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/Code Cache/js/index-dir/temp-index
        • Size 96B
        • SHA256 f4c7996814440b7f29a4b1be7e9a6fd8099d69a5dbe46badb085b0732da65b0b
        • MD5 SHA1 SHA512
        Submit Download

        bbbf120220612398_0
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/bbbf120220612398_0
        • Size 376B
        • SHA256 c6386e9b2024fb8cf62e29520c8adecdaee2481573e8349f19a050c07999f8d5
        • MD5 SHA1 SHA512
        Submit Download

        f3ef7cc211d63267_0
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/f3ef7cc211d63267_0
        • Size 440B
        • SHA256 f87fba3d308521ee163bc9c67623f3e846ffb33414089de2a2eb03a3d356ec4f
        • MD5 SHA1 SHA512
        Submit Download

        index
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/index
        • Size 48B
        • SHA256 c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 96B
        • SHA256 ba417936d37cd1ccbdcf976c9a6a86258e9c268514cdabff9a78f651b47c7eee
        • MD5 SHA1 SHA512
        Submit Download

        temp-index
        • Path /data/user/0/com.enrich.arrest/cache/org.chromium.android_webview/index-dir/temp-index
        • Size 96B
        • SHA256 cd31634a4f02ce8c8ac760540de6584690e2d3032675297a3ebf57bc26ca8ebc
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb
        • Path /data/user/0/com.enrich.arrest/no_backup/androidx.work.workdb
        • Size 8KB
        • SHA256 63a219c7092be26641907c5f955aa977e7675e3922a8e4ee2af25bfed8c7bbfb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-journal
        • Path /data/user/0/com.enrich.arrest/no_backup/androidx.work.workdb-journal
        • Size 1KB
        • SHA256 943f4a4aca4bb114f082797d6d36698bbff29db15525e7c47996be43b9a7ea6b
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/user/0/com.enrich.arrest/no_backup/androidx.work.workdb-shm
        • Size 16B
        • SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-wal
        • Path /data/user/0/com.enrich.arrest/no_backup/androidx.work.workdb-wal
        • Size 458KB
        • SHA256 1da6e95567ba40da077dab99ffb5311ed43d8bb63e1e16845b0f5187c953d76d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/com.enrich.arrest/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 10b13d894f36d4391fcc31313a244d5f6cd89c8e8c03347282e281c4af13c0a6
        • MD5 SHA1 SHA512
        Submit Download

        prefs.xml
        • Path /data/user/0/com.enrich.arrest/shared_prefs/prefs.xml
        • Size 135B
        • SHA256 6fd2c6ee0cc04113fdff44195a45da423aa4643da5653e9220be0fe531c410b8
        • MD5 SHA1 SHA512
        Submit Download