sova | b76cb30c0c15e840e67e826f786ccbd9e74351b7c5100b5b760528b32fb77cff

Analysis

max time kernel
3283704s
max time network
157s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
09-03-2023 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15eae9134dac9268cbf005c23299c88dd5c5176a240201da751691a543375360.apk
Size

4.7MB
MD5

3fe3fa5fbebcf71367586d6d2a3824f9
SHA1

900122232d087a1b189168096798ef40a94ac442
SHA256

15eae9134dac9268cbf005c23299c88dd5c5176a240201da751691a543375360
SHA512

e2e847e6a99a7e106429024d52b2898346f7bdd2d42d4ab815300fd4aa6448532ebd5e72e637bcc843f367d491c421f3144a1d8630fd9e0547a2b3f56d6144dd
SSDEEP

98304:RWY/5eMi8wI0KAho87G0hsdQi3UGcJxuEfBAK7KSN1hwV:RW4e98VioNDdQi39cPrfBFKSNcV

Score

10^/10

sova sova_v5 banker evasion infostealer trojan

Malware Config

Extracted

Family

sova_v5

aHR0cDovLzQ1LjE0My4xMzguMTMz

aHR0cDovL2hhYmVyYXNhbmJpemRlbm96ZWxndW5kZW0uY28udnUv

Signatures

SOVA_v5 payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4195-0.dex	family_sova_v5
behavioral1/memory/4093-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova
Sova_v5
Android banker first seen in July 2021.
banker trojan infostealer sova_v5

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.civil.concert

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.civil.concert
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.civil.concert

Acquires the wake lock. 1 IoCs

Processes:

com.civil.concert

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.civil.concert

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.civil.concert/app_DynamicOptDex/jt.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.civil.concert/app_DynamicOptDex/oat/x86/jt.odex --compiler-filter=quicken --class-loader-context=&com.civil.concert

ioc	pid	Process
/data/user/0/com.civil.concert/app_DynamicOptDex/jt.json	4195	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.civil.concert/app_DynamicOptDex/jt.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.civil.concert/app_DynamicOptDex/oat/x86/jt.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.civil.concert/app_DynamicOptDex/jt.json	4093	com.civil.concert

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
44	ip-api.com

Removes a system notification. 1 IoCs

evasion

Processes:

com.civil.concert

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.civil.concert

com.civil.concert
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4093
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.civil.concert/app_DynamicOptDex/jt.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.civil.concert/app_DynamicOptDex/oat/x86/jt.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4195

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.civil.concert/app_DynamicOptDex/jt.json

Filesize
2.2MB

MD5
04571629e36f28298bce881bc63c0e0b

SHA1
0d70bd60cf523dba493df5d99c7ed6f5b62f1807

SHA256
b4eb659f646af4e5aac01f66da26e6e8215f96aefc6a873e2bedefba2f7d82ff

SHA512
84baaaaf01709ef96f9bec4d6e639ad65460c24de35aa9a24f620d3dc58169d416c1981ebb2c31eab29c8ea1d1eca8fbdeb8803ff86ae9f07a3a7de98779f5cb

Download Submit
/data/user/0/com.civil.concert/app_DynamicOptDex/jt.json

Filesize
6.2MB

MD5
cddd532c812be246e84f21f65b2d137e

SHA1
a7a8c415d664dfd37a521313893752b5a155b4fb

SHA256
91d8fa43c4743d5b71b403f38918dda8dd7343d4a717cc79d8f9c5c5539589b7

SHA512
fe37615ed6e46cf87b940871e218cf111cee0ccd316a449ca4e810a9b1bba49fd5d169b58c2523353cf35318317988e679ef4a0be93e4d13af875dc4a8d4ee7f

Download Submit
/data/user/0/com.civil.concert/app_DynamicOptDex/jt.json

Filesize
6.2MB

MD5
5f3139179afd05d654b4878d588c8ce1

SHA1
ee3481eeaf6ab79824255ad96320dfa47cd03577

SHA256
bed9a04dc483eb8c10750fe28b403e3d9f5cc64b8f08708f999fdbe4aa6db31a

SHA512
6d03bfba1b73611f71296a59ab9b66b3df1118d0d8eb6526a26a859b080303ff6774ffae7a7603658c2da21351a4ee82ac3756486368d043b0842bcf19af2d3d

Download Submit
/data/user/0/com.civil.concert/app_DynamicOptDex/jt.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.civil.concert/app_DynamicOptDex/oat/jt.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.civil.concert/app_DynamicOptDex/oat/x86/jt.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.civil.concert/app_DynamicOptDex/oat/x86/jt.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.civil.concert/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.civil.concert/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
381a91edcf804a4f6d5790dac26d4194

SHA1
399da572932a5a2480773e1196298386436845fe

SHA256
61c04e461f205bc9b5f00c6b7d84c420725a5f7a066990f543b0ece942eeea82

SHA512
88162827be125bbbbb35a0d259205580cff9ff9f6e63471e23b1ecb27e393b60a2ef8e8450541b572fe64d3e0b3bf10f4d28d343a968ea7b07d5431136b1778b

Download Submit
/data/user/0/com.civil.concert/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.civil.concert/app_webview/Web Data-journal

Filesize
1KB

MD5
426eb580428ee33742b27d6b4d87d5ab

SHA1
04505a30d0250d368a85f1cde3fc79256fb15e9a

SHA256
a4995709726477d4f86393a58cd87ad8182f56ae90e7de68817f6e031f7e7965

SHA512
83295c079d3915ed6f5e16565b999b1e70e79957e7b009d288b069f959abf1a0c8d90276cbd4386e8cadeea076786545170d71a24635246a8da4272b4091e8df

Download Submit
/data/user/0/com.civil.concert/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.civil.concert/app_webview/metrics_guid

Filesize
36B

MD5
2d03f724e1fa69ec6ef0984f1cbbc457

SHA1
7b79d50922cae1176fdd8fb77a2a389c39e70df3

SHA256
1129f962e3aada13f9e1de4d94f44c1e7a31b3e71339519095ff9189c96ae342

SHA512
de6f9ae83579c319fc3ce6777a28a4be56183a68925f1177f2c7cd60a523d487ddbae0ebc68f36b0ad591a956d1d4406e5758338be7c37889bee16a5cee628d7

Download Submit
/data/user/0/com.civil.concert/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.civil.concert/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.civil.concert/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/2f3337478e49e949_0

Filesize
198B

MD5
ff14e7566befc1722b417e9cb09a8bf1

SHA1
7b5c63dad525df7925ad51189590271f6558578a

SHA256
51b7edf4944c9e5204e9ffd298606e713b998c27df599e0d6054b91a1a71d807

SHA512
fe682a42f213ef46fb67a164a55198969e9e39b99f069b65464a31679f211e5ed5085cc4b74e738b025c2503f92babb2cf0f48a430702c4ccf8bd39a2c52b31e

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/385bf0055d90dbc5_0

Filesize
289B

MD5
d61c4e9446fd8e007bb03136b94c4a76

SHA1
9afcf4ffb1f8e27495e57a1cdfe937cb642b118a

SHA256
b71135372c13fbf2507bba0958a6e926d2ceacf2cf06b7745e214eb1dc249aba

SHA512
4c9b6463fa0791f515ae3b75ed9c18a67d454116e68008ce2ac862dc47938c13f9f6cb8b9f5f22d4b14b1fefdfeb87fcd85fd02e312077ee35aca3fb5ef44d7a

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/418ad5e834d66b76_0

Filesize
191B

MD5
1fbbcb3642549458626db2a7305250e6

SHA1
0a2a98af87796bf89d24186c6d9ca4e0e87d4ff7

SHA256
991e6259ea473cab000c5acc66565a52e0bfb81c8558e86616606b52dead8b43

SHA512
e6f145a5d6943efebbc61619a7395ac188a532e45d1bd6bde26ed379d3e3ccb16993d201aafae952bf3283a000c80d8c3034f0a0dafa1535369c50f65e58e282

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/628aa70b6030a263_0

Filesize
184B

MD5
9daa777f6ff8c57d253646820895ea1d

SHA1
c8a3994199f0364520a66fc1c2902df27533e365

SHA256
0587c9c588c75fabe885fcd15f4b4a540bf4a16c39ae869032ea0c216a6d42b3

SHA512
733e80d32e59a6f84f35c55e4f774ec215c5c2a4933775110bab152a86198266d9e6c70e185083166d01e23682ebffd72a3252d6325a76fa03137fda825b0c3d

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/7081ad27615f85ec_0

Filesize
210B

MD5
7fff090c8abebea4eebdaa48cbd2bf27

SHA1
0f6c7c8055f9e7cf6609bf753bdf926b819e9f95

SHA256
772f43b4ce0bd4b0ad044f653fa5ad2eb80e4cdf87ac99b11c55080a42d28b9c

SHA512
4014378f3a79b58be046346f77e5d0f7893f7a87067974752d8caf39e1962af391d283170acd8457fae2cc49f85cb15c206d81c5101cf0b16b7f66c4c8869584

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/8a9dd9b28322a4bd_0

Filesize
197B

MD5
38a45f55ae8aa809bc168ba0b3cfda62

SHA1
cad22c4b9211d3a9ab2d21b821c30abef6728c62

SHA256
8b59bcf1f8eeec1d62569351f10bb117fccda1e37ff2597d6592bfbc14d71240

SHA512
c193c7001864620e826c553a01715d62840d6f34ddce3cf296a034870f98edddb5ce66a16bef2f1927f1233c92d4c547da2614302e803e17eb594da028887a02

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/bbbf120220612398_0

Filesize
176B

MD5
bba35bbc68637a31e472606cbd6d899c

SHA1
10be3568f4eeb1ecc74db077409eb482254f33b0

SHA256
0346cf896323677b561d2441bb24f8d7fccad0c19db80a49e96c73f974cfafd8

SHA512
0258199fb15ecf82e4c89bbe2ccf345aaa7a708569ef5fa37994cac0d1bb794810542329f07c48a5c4b078d6adaff6859434caafe006edfd44f70e4ec7d8a3f4

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/f3ef7cc211d63267_0

Filesize
208B

MD5
9615fa89b75a25324748f6948135136e

SHA1
9f398db0da3caafda65184c76f98f6396605f08b

SHA256
9bf052de085a7af07f5180b4b7439dac5e82f731cf9d042ef4edbce978de31aa

SHA512
2b0d6e4825b692ca0919340bd67c42bcbeee69b917af0a2be27e37a00125d934eed2d01f9db5b696015e87f6074c242ca2770b25882cfd1fef7576b40150b61a

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
99593d9e973d0c05ba2f155d928a8b04

SHA1
89a71c0324108430ee33e50ff098d1c292e69a32

SHA256
35a72081b578893b9c23c3c7e0319d1c78eace5dc1cfeaaed48d57c0bc6ac9c7

SHA512
2ab94b47da47c709fe84d78b9cfadbf81fc1bb8dc182eed59132c0cb7f990bfe6994fe78c6bd742f8c285e6a514106970d71bee3a227d6741fe2d0ad2e795483

Download Submit
/data/user/0/com.civil.concert/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
bba76af92036931706a4c637728461e7

SHA1
4172bb57345900ab6741b827125383338ee603cc

SHA256
6d579d99c3272bf5754bdd5f212c12d7feb622740c1cf2b3c56121f1b2857600

SHA512
9296feba360188b2505857fbac94c569325c152e251bb01a4164b086780776b3fc23910e9d37388a547158e6b56ada4ead6ed026200080ffb1fb08ccf021251c

Download Submit
/data/user/0/com.civil.concert/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.civil.concert/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
a657d0c8fb6f737cff44fbd9350fd073

SHA1
e1192209b81317ff98e537b2ae72a7b9e78f1465

SHA256
2b73388bdf0e0b2965c0d09811e3a32b457abaacc9fd3f8b074ef9ed19cc658e

SHA512
87131cf2a55c7c175c487dc69cd238f51cce287b34e2b7b49831ca47b3ba96c4f545e735f72338f23f8bd134ab87b2c66c4b9dd22205826dde907acbd5969ee0

Download Submit
/data/user/0/com.civil.concert/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.civil.concert/no_backup/androidx.work.workdb-wal

Filesize
229KB

MD5
47440096fd9c572eb69b8375d71d1950

SHA1
edfab0d7da93d578ae02e0d2f967c4de286dd5a1

SHA256
6f89a8916c0bdec6d1d3af2cdecaff769dca59552211c73863368decf4193e5a

SHA512
c41b6d92bf6084905bbd5ffead97766bac13d71ba8becd749bdde0dba5348528cc5b3522adc3c57763bf2116ac7bb45c3cd7abe8de4a116348fb1e40b9061e08

Download Submit
/data/user/0/com.civil.concert/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit