Overview

overview

10

Static

static

7

Chrome (2).apk

android-9-x86

10

Chrome (2).apk

android-10-x64

10

Chrome (2).apk

android-11-x64

10

Resubmissions

15-05-2023 13:59

230515-rahebseb3x 10

07-03-2023 17:32

230307-v39wtsad7t 10

Analysis

  • max time kernel
    3169635s
  • max time network
    158s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    07-03-2023 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Chrome (2).apk

  • Size

    4.7MB

  • MD5

    4b0e93354da17984f0bef68b9ab83380

  • SHA1

    bff351735b6153339cc8d52089495db0533392b3

  • SHA256

    bbaf483c2b6f67f22eb6e1fa00f200e9c1e201b0110070acaefd416cf846b1aa

  • SHA512

    7353933b7919a87feae7345a09eb2e90bfa32723ae5a0df0d879ca29f0184ce799d1ed625564fc1d095154567618b8d4b79a6fadc0e1b669bafbfde9d6ff9933

  • SSDEEP

    98304:pza2GxDDbL6zkfwe+0F3hoiLUpbcqon9BsTBAx5r3LyNXvOwxHMRA2QAFZ:pzMxDDbL6ew6Ro6Szo9BCBAxs8wtkA2f

Score
10/10
sovasova_v5bankerevasioninfostealertrojan

Malware Config

Extracted

Family

sova_v5

C2

aHR0cDovL25leHN1c2xhemltLm5ldDo1MDAw

aHR0cDovLzUuMTYxLjIzLjEyMjo1MDAw

aHR0cDovL25leHN1c2xhemltMS5uZXQ6NTAwMA\u003d\u003d

Signatures

  • SOVA_v5 payload 2 IoCs
  • Sova

    Android banker first seen in July 2021.

    bankertrojaninfostealersova
  • Sova_v5

    Android banker first seen in July 2021.

    bankertrojaninfostealersova_v5
  • Makes use of the framework's Accessibility service. 2 IoCs
  • Acquires the wake lock. 1 IoCs
  • Loads dropped Dex/Jar 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Removes a system notification. 1 IoCs
    evasion

Processes

  • com.crop.horse
    1⤵
    • Makes use of the framework's Accessibility service.
    • Acquires the wake lock.
    • Loads dropped Dex/Jar
    • Removes a system notification.
    PID:4098
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.crop.horse/app_DynamicOptDex/imbb.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.crop.horse/app_DynamicOptDex/oat/x86/imbb.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.crop.horse/app_DynamicOptDex/imbb.json
    Filesize

    2.2MB

    MD5

    858dd4afb8f8c789f89aac5a69babf50

    SHA1

    55f0d01077c5c11087f8d2bea70de13945444ead

    SHA256

    0f1be928ea66579631c2604bcacf1c005d613fbac3b76640a47cf8959cb4eb42

    SHA512

    ab8ee1041d1f529777b8cd993a4458a58c62783f12a6e133e11b5511a03fd9eea7a140b0569468c99936fb9439efc0937a92eef9f986cac1c279b2d8a4aee895

    Download Submit

  • /data/user/0/com.crop.horse/app_DynamicOptDex/imbb.json
    Filesize

    6.1MB

    MD5

    3e2d5b80df4107fdbb2ace8e341028a1

    SHA1

    cf797c6d212fdacb3db82b2ea28ec7e454ffa132

    SHA256

    d5857b96cfe96a72eecedb4d24eb79ed940193b3d89cbfa653328ce4bf33276a

    SHA512

    0ecd505450c4c12925fae30a584ec4d89989fdc2392d0d704ab32332d0a8ee35f52a2ea0d88a6cbf10cfcd3b2990152a92276fb681b116e96120cf212045c377

    Download Submit

  • /data/user/0/com.crop.horse/app_DynamicOptDex/imbb.json
    Filesize

    6.1MB

    MD5

    602ed21d6cddfcc1ba2b5836b39f2f71

    SHA1

    ff4ec1c19300397dc10ee8e6734de1534618e728

    SHA256

    29b56cded720d754c5a068ed531f4a8e2aa439d67bc2d7405a392383af3060aa

    SHA512

    fd4945a16b8470bafc33099f60e28eb87b96117d69c62127c34dc3ae6d6f19a4cc166c2fd0d171c64a728181dac8666fb254f5f16256458768688f35df2cd790

    Download Submit

  • /data/user/0/com.crop.horse/app_DynamicOptDex/imbb.json.x86.flock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.crop.horse/app_DynamicOptDex/oat/imbb.json.cur.prof
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.crop.horse/app_DynamicOptDex/oat/x86/imbb.odex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.crop.horse/app_DynamicOptDex/oat/x86/imbb.vdex
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.crop.horse/app_webview/GPUCache/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

    Download Submit

  • /data/user/0/com.crop.horse/app_webview/GPUCache/index-dir/temp-index
    Filesize

    48B

    MD5

    160ff2eae1ded2aecca021590e968a45

    SHA1

    780f3b49c1d28657bc2300cc84e63f92b98548d6

    SHA256

    51e1ab34e5a679636ae560357c790d9f13da1c8aaa2bf0d9d78b792e98a02379

    SHA512

    65251b4cadeb00ecd0bab5168b90f2394f9c2feb8ed84e9e355517a7d909968872578b633e6b8bc142ed475a98384a69ae18f98027943abeab2f313baeba830d

    Download Submit

  • /data/user/0/com.crop.horse/app_webview/Web Data
    Filesize

    104KB

    MD5

    dc79f9ce5f3ab5270b33e61119dfc959

    SHA1

    1844bf222a5144b513dcf2fb50a18c011701c647

    SHA256

    47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

    SHA512

    18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

    Download Submit

  • /data/user/0/com.crop.horse/app_webview/Web Data-journal
    Filesize

    1KB

    MD5

    15ce919160a94e327f7f64495a9a1b8a

    SHA1

    7c1e5efb878935404a5256ca9a8085bdb609ca9a

    SHA256

    73a8bea9b26b2adac496f328bd866f5678c91ff6d69c224f43921177afbf2f2c

    SHA512

    32584325eb5c493d3dca843f9e2414ee52b909281849d031f7b3b889057b1ee9328afe7e8eb56e98788fd2d12a16c29f8e47436c19f7e7ee846eb68043e90cc9

    Download Submit

  • /data/user/0/com.crop.horse/app_webview/metrics_guid
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.crop.horse/app_webview/metrics_guid
    Filesize

    36B

    MD5

    d07f624cd0e61c87ef657c294cc88497

    SHA1

    f7f26748cee12627df07c599794fe6701c0633a8

    SHA256

    75180500149e1688fa0af0de4805f0c31617fc6f86dcdfb17b535af45fc6e98b

    SHA512

    9ff0348249e218f63ff0d5424bba895aaaa63c9053de1ef3a9b4c0c18250974de80c6a98b07a25a9e1ffafc8373a6ece2bd82ec1f7d6d6f46cb1f5f7725ab572

    Download Submit

  • /data/user/0/com.crop.horse/app_webview/variations_seed_new
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.crop.horse/app_webview/variations_stamp
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.crop.horse/app_webview/webview_data.lock
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/2f3337478e49e949_0
    Filesize

    198B

    MD5

    ff14e7566befc1722b417e9cb09a8bf1

    SHA1

    7b5c63dad525df7925ad51189590271f6558578a

    SHA256

    51b7edf4944c9e5204e9ffd298606e713b998c27df599e0d6054b91a1a71d807

    SHA512

    fe682a42f213ef46fb67a164a55198969e9e39b99f069b65464a31679f211e5ed5085cc4b74e738b025c2503f92babb2cf0f48a430702c4ccf8bd39a2c52b31e

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/385bf0055d90dbc5_0
    Filesize

    289B

    MD5

    d61c4e9446fd8e007bb03136b94c4a76

    SHA1

    9afcf4ffb1f8e27495e57a1cdfe937cb642b118a

    SHA256

    b71135372c13fbf2507bba0958a6e926d2ceacf2cf06b7745e214eb1dc249aba

    SHA512

    4c9b6463fa0791f515ae3b75ed9c18a67d454116e68008ce2ac862dc47938c13f9f6cb8b9f5f22d4b14b1fefdfeb87fcd85fd02e312077ee35aca3fb5ef44d7a

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/418ad5e834d66b76_0
    Filesize

    191B

    MD5

    1fbbcb3642549458626db2a7305250e6

    SHA1

    0a2a98af87796bf89d24186c6d9ca4e0e87d4ff7

    SHA256

    991e6259ea473cab000c5acc66565a52e0bfb81c8558e86616606b52dead8b43

    SHA512

    e6f145a5d6943efebbc61619a7395ac188a532e45d1bd6bde26ed379d3e3ccb16993d201aafae952bf3283a000c80d8c3034f0a0dafa1535369c50f65e58e282

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/628aa70b6030a263_0
    Filesize

    184B

    MD5

    9daa777f6ff8c57d253646820895ea1d

    SHA1

    c8a3994199f0364520a66fc1c2902df27533e365

    SHA256

    0587c9c588c75fabe885fcd15f4b4a540bf4a16c39ae869032ea0c216a6d42b3

    SHA512

    733e80d32e59a6f84f35c55e4f774ec215c5c2a4933775110bab152a86198266d9e6c70e185083166d01e23682ebffd72a3252d6325a76fa03137fda825b0c3d

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/7081ad27615f85ec_0
    Filesize

    210B

    MD5

    7fff090c8abebea4eebdaa48cbd2bf27

    SHA1

    0f6c7c8055f9e7cf6609bf753bdf926b819e9f95

    SHA256

    772f43b4ce0bd4b0ad044f653fa5ad2eb80e4cdf87ac99b11c55080a42d28b9c

    SHA512

    4014378f3a79b58be046346f77e5d0f7893f7a87067974752d8caf39e1962af391d283170acd8457fae2cc49f85cb15c206d81c5101cf0b16b7f66c4c8869584

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/8a9dd9b28322a4bd_0
    Filesize

    197B

    MD5

    38a45f55ae8aa809bc168ba0b3cfda62

    SHA1

    cad22c4b9211d3a9ab2d21b821c30abef6728c62

    SHA256

    8b59bcf1f8eeec1d62569351f10bb117fccda1e37ff2597d6592bfbc14d71240

    SHA512

    c193c7001864620e826c553a01715d62840d6f34ddce3cf296a034870f98edddb5ce66a16bef2f1927f1233c92d4c547da2614302e803e17eb594da028887a02

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/bbbf120220612398_0
    Filesize

    176B

    MD5

    bba35bbc68637a31e472606cbd6d899c

    SHA1

    10be3568f4eeb1ecc74db077409eb482254f33b0

    SHA256

    0346cf896323677b561d2441bb24f8d7fccad0c19db80a49e96c73f974cfafd8

    SHA512

    0258199fb15ecf82e4c89bbe2ccf345aaa7a708569ef5fa37994cac0d1bb794810542329f07c48a5c4b078d6adaff6859434caafe006edfd44f70e4ec7d8a3f4

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/f3ef7cc211d63267_0
    Filesize

    208B

    MD5

    9615fa89b75a25324748f6948135136e

    SHA1

    9f398db0da3caafda65184c76f98f6396605f08b

    SHA256

    9bf052de085a7af07f5180b4b7439dac5e82f731cf9d042ef4edbce978de31aa

    SHA512

    2b0d6e4825b692ca0919340bd67c42bcbeee69b917af0a2be27e37a00125d934eed2d01f9db5b696015e87f6074c242ca2770b25882cfd1fef7576b40150b61a

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/index
    Filesize

    20B

    MD5

    93027d42b314432c4216e6cfca48b384

    SHA1

    43448dd8102979c3926828182579691945eedd4e

    SHA256

    3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

    SHA512

    a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    168B

    MD5

    aad238f0469c112c00a16656387a4376

    SHA1

    72c5450f76daeebcfe85d5caa71fca21a51cec60

    SHA256

    122efadc18e477fbd0c23eed672a46c08eb52f7125a627dd86f02c952b124e41

    SHA512

    268a5468ad91f3379103129ee460d468fb987b2b5d5a4479e78f20ecf674770709a539ae4e5fd908847dbdcd2946da3e146e6bc8a2301e52977420d3e5fee629

    Download Submit

  • /data/user/0/com.crop.horse/cache/org.chromium.android_webview/index-dir/temp-index
    Filesize

    48B

    MD5

    5d624c2b12516ec9644a6e19fb75e657

    SHA1

    d669aacff08c9c4dd2a5516a800d5f976a788e17

    SHA256

    019f0d12b692b1c32c1f8386132bcb3bc6c68f98f5c7a554fe008b38d622d35d

    SHA512

    589f6be78fd2f3dceb784ee66924db625ead4cc30d1eafb3dafef35041f6bcf73186c17b905da8d79cf09ec47c9272cc4a80d04596bdbbc46f661526127af64e

    Download Submit

  • /data/user/0/com.crop.horse/no_backup/androidx.work.workdb
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit

  • /data/user/0/com.crop.horse/no_backup/androidx.work.workdb-journal
    Filesize

    524B

    MD5

    88463550e49dc845d6e80288bebd2f86

    SHA1

    19256723a8e188b4872a707b2870437fe9a1b45e

    SHA256

    e0ed5eb16fe5760a6387368e70e0eccd151df3758a0355d101fbeeebf374e7af

    SHA512

    a28a1948d408b1b5528f3868a9b846a4ef615f7b516a263084285e6b6b72c9a9dcd8133849efdf1a0bf6f5ca14667eb468df7fa09f356e3c0430f926252a21d4

    Download Submit

  • /data/user/0/com.crop.horse/no_backup/androidx.work.workdb-shm
    Filesize

    8B

    MD5

    7dea362b3fac8e00956a4952a3d4f474

    SHA1

    05fe405753166f125559e7c9ac558654f107c7e9

    SHA256

    af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

    SHA512

    1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

    Download Submit

  • /data/user/0/com.crop.horse/no_backup/androidx.work.workdb-wal
    Filesize

    229KB

    MD5

    2205c5efef91ef2318880b16e7f69bee

    SHA1

    9135200201888bd2d7d25ca58dd7f0613b651e51

    SHA256

    e6a77c37c6113a785242ae5b7afdc5a38bbfadc08205bb991fac070abccfd9d8

    SHA512

    39f5c95da309c6ae17a09718b3c1da20adcc72fbadc71ba55481927ae568ed778c60a193c8b378b53aaac8f7641daebcbdcab4d584c5eeaecd9e6f7d5ec768a0

    Download Submit

  • /data/user/0/com.crop.horse/shared_prefs/WebViewChromiumPrefs.xml
    Filesize

    127B

    MD5

    21223e9184445fe043476484cd8cb1f9

    SHA1

    2b4813f849121d60ba35eb0889080668bb62c778

    SHA256

    bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

    SHA512

    be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

    Download Submit

  • /data/user/0/com.crop.horse/shared_prefs/prefs.xml
    Filesize

    135B

    MD5

    7736f4ed63020ad4ffc2f5359a7c9d64

    SHA1

    58116665dafceb7ae0aaee3bc59717a9a5c00cee

    SHA256

    6fd2c6ee0cc04113fdff44195a45da423aa4643da5653e9220be0fe531c410b8

    SHA512

    10e555b9ff4baa4dbf8ad8fef7563e4756b194595b7794845ea54856e01745bb8eaeef9a5c67da76174fe1832025c9c0d220b49f839b3702d24f5372716a700c

    Download Submit