Overview

overview

10

Static

static

7

7C805F51EE...02.apk

android-10-x64

10

7C805F51EE...02.apk

android-11-x64

10

7C805F51EE...02.apk

android-9-x86

10

Resubmissions

07/03/2023, 23:25

230307-3d95ascb7110

06/10/2022, 16:35

221006-t321jshhe810

12/08/2022, 07:35

220812-jen4nschf58

Analysis

  • max time kernel
    3194428s
  • max time network
    148s
  • platform
    android_x64
  • resource
    android-x64-arm64-20220823-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system
  • submitted
    07/03/2023, 23:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7C805F51EE3B2994E742D73954E51D7C2C24C76455B0B9A1B44D61CB4E280502.apk
  • Size 4.0MB
  • Sample230307-3d95ascb71
  • SHA256 7c805f51ee3b2994e742d73954e51d7c2c24c76455b0b9a1b44d61cb4e280502
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sovabankerevasioninfostealertrojan

Malware Config

Signatures

  • SOVA_v5 payload 1 IoCs
  • Sova

    Android banker first seen in July 2021.

    bankertrojaninfostealersova
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests enabling of the accessibility settings. 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
    evasion
  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.bean.cousin
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Requests enabling of the accessibility settings.
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Removes a system notification.
    PID:4397

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CtaDwII.json
        • Path /data/user/0/com.bean.cousin/app_DynamicOptDex/CtaDwII.json
        • Size 2.2MB
        • SHA256 11b1cbdef463227d288271c05101ed180109d372d68fc924c29db43bf518922b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CtaDwII.json
        • Path /data/user/0/com.bean.cousin/app_DynamicOptDex/CtaDwII.json
        • Size 6.0MB
        • SHA256 acd7234022738f4e8499749de805c474879fea06de0d7ca066483d03e7ef02f5
        • MD5 SHA1 SHA512 SSDEEP
        Download

        androidx.work.workdb
        • Path /data/user/0/com.bean.cousin/no_backup/androidx.work.workdb
        • Size 8KB
        • SHA256 4b34cf505050facf47aa7936e4e7667e1969105665c632b3eefe7ecddf9a6935
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-journal
        • Path /data/user/0/com.bean.cousin/no_backup/androidx.work.workdb-journal
        • Size 1KB
        • SHA256 6803ac71b0a067fea3a8c1dd8c64aa5af75cc251d15b581b2b556dc89a794a37
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/user/0/com.bean.cousin/no_backup/androidx.work.workdb-shm
        • Size 16B
        • SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-wal
        • Path /data/user/0/com.bean.cousin/no_backup/androidx.work.workdb-wal
        • Size 458KB
        • SHA256 9189d24319fc698a2ecd781d02ac4bfb1d7c04c340988c2af7cdbf2c414c458a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download