Resubmissions
09-03-2023 12:51
230309-p3sdwsbd2x 1024-01-2023 13:11
230124-qe9hyadb3z 1024-01-2023 13:11
230124-qe3emabe74 716-01-2023 15:02
230116-senmksgh58 1016-01-2023 14:58
230116-scnjsscg9v 10Analysis
-
max time kernel
3329131s -
max time network
72s -
platform
android_x64 -
resource
android-x64-arm64-20220823-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20220823-enlocale:en-usos:android-11-x64system -
submitted
09-03-2023 12:51
Static task
static1
Behavioral task
behavioral1
Sample
Video_Player.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral2
Sample
Video_Player.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral3
Sample
Video_Player.apk
Resource
android-x86-arm-20220823-en
General
-
Target
Video_Player.apk
-
Size
4.3MB
-
MD5
54013894dcaf20181b2ca431bb9d0575
-
SHA1
6cb71982ce39526340616a51ab45ccf46dcf799d
-
SHA256
894723b804ae51e7294a69169f0d7b0244a18ba712fa8e3042cb63e8e58cbccf
-
SHA512
fca6cf580c15e0e623b76fa83c9d1234d1f376a9059274e24debdab02ae6c9ab74c16be7b13c26cca810b93290405619a5a17a1dbf9d087dcea57953aa74369d
-
SSDEEP
98304:QkrGUuVDcQJBwXBtEgQJPL8dKNPtJOvar/xGvKp2QqP2kWnRUrCvLP95cd:Q21uZckBwXBtVQ9wG/QSpLhRUrCvxWd
Malware Config
Signatures
-
SOVA_v5 payload 1 IoCs
resource yara_rule behavioral2/memory/4416-0.dex family_sova_v5 -
Sova
Android banker first seen in July 2021.
-
Makes use of the framework's Accessibility service. 1 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId com.exist.debate -
Acquires the wake lock. 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.exist.debate -
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json 4416 com.exist.debate -
Requests enabling of the accessibility settings. 1 IoCs
description ioc Process Intent action android.settings.ACCESSIBILITY_SETTINGS com.exist.debate -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 53 ip-api.com 64 icanhazip.com 65 icanhazip.com -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
description ioc Process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.exist.debate -
Removes a system notification. 1 IoCs
description ioc Process Framework service call android.app.INotificationManager.cancelNotificationWithTag com.exist.debate
Processes
-
com.exist.debate1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Removes a system notification.
PID:4416
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5620c929c8196c891363645faae990759
SHA17afb9f0944b1ada292a0352f551136c4ed33236b
SHA256c307f9d17ff1f91aa0f9256e61087d0057688a4c1a8c9c2c0ad517737110c143
SHA512b0106feb245419eaf2a86bf5a3f30c9ff6fc3bc3dd23fa62dff1a47a4891ce26626c7ae489a4a8368cbae71ea99d5d7cafb8bffe9d7777bf33dfb71e3dd7a6a4
-
Filesize
6.2MB
MD51ef9b27a9dae41cca65cb3472e69884d
SHA1f9ea99749a313184ab4826f9e2daee22c33c4b25
SHA2567295be9efb520d79f517c68cd8d560e2b7d175d239be3a3761576ecb31f36804
SHA5126d8402d6ac777c708f6fd2a0c60ee243cbd60b47c6bfcd0c29ce8c40e6c5998b537d6bf1285f6db08068b7104acc7a5b6e4a26c0a2b56c3390206d8e8c69545d
-
Filesize
64KB
MD5dfb2098ca7b3bf16d6f5f1e7d3839af5
SHA1ebb7a8bc886062d77a4092bd306b77a0ce7a3e9d
SHA256e4119d32577d7fc63b267cc23eb7a9bbfb12d238f23e08918c38838fe0181224
SHA512fccec45399258eb98220b7f01b492a72b8b3d1254dec6e196e344d89a0376c6ee24534a31a6675c866d4a17256d3ac6823657eaf04e1d386757d0cbfc6597e50
-
Filesize
1KB
MD5ed773e242f40e05b4afe82c9feaa76d5
SHA18270d91aafa3e27aed8131a8772b3d8619555630
SHA25698b634f6e85eecb9584c0c3b75b9eb3d81edfe2faf3ee24fbe3d4f8de553a746
SHA512a75b378bfc4be50ec55019820440b54a539084ad6d27a9dc304fcfc448d1c50d319f933cb9d3cbd9e44b38784ac445350cc277e138030172a6b0cf2011268e36
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
96B
MD5546153d5be0ff74d5a8248f0a7881ec2
SHA17051d22635859d8d344b899278bcfa0a81ce26af
SHA25689586e00f965a25f771e4e87407d15568dcefc113e29305c28362b3cbc432a2e
SHA512f7c6a93b139bf35ec4649ac327f71a2458a1fdd16370df7e4c22b6c84492428a0a315d5a7dd5b39a5504a049158d2b23cc3e265ccb8d8eccee5f7a020b3ba327
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
61B
MD59f7eadc15e13d0608b4e4d590499ae2e
SHA1afb27f5c20b117031328e12dd3111a7681ff8db5
SHA2565c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
SHA51288455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
-
Filesize
128B
MD5bccf61aff4e78457047e9b1090dbd52c
SHA11c8c5ed0603efe08981c9ffecb1a48bc2e7311e5
SHA2569224f30cb46f2eba91c5f3d1852f9fa59004159ad3e4500e5cb1fa092ef7effe
SHA51251c578421cb78ad4387180fd00f2cfdff406642caa3bae1f03076d2d0137c940dd33a98a8d415cb9affcddd100f35515da7c47c496218ed6adef03bcb713edc4
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
120KB
MD5a48cd9324b1f8754b07f00d863b840f3
SHA111c6614775b35a58f440971dfc87c8aaac6d6173
SHA2568859a216183793485d4699bf69d7ed96904679834188d07b9a70424d47eb1420
SHA51235fa712f0af4a5eeed7e00e4e59ed5027dc6609d268462fe79d92043be9ae0c5961ce9e1d2f64b1a196c9b6aa6242b8b83817b3ee4c1058596c58a99c45478b1
-
Filesize
2KB
MD504b5b6424e28f41fc7c3246b3fa3c879
SHA16ecba9d5574b9b380f605804273e6e58d298dec9
SHA256fb5357500acbd190a4d6b96451c2bb5374bf3f68f4e036841a5d81534c1910e8
SHA512e75786656247a6faad698d29a1fd657db33c6c10b42f0d93235742e4ecad690529341ff561c05f0dabed6f0ecfb22d82edd84cbe4f79b8926fcc962ab22a348a
-
Filesize
22B
MD56dba77330c2e90baeb948e455b25f089
SHA1ea12ef3cf9fbe196e41bb9f7cf3a5be4275e04c3
SHA2567901a6be0e73afcd1f50fef8d317a787baa9e048841c7f0a209bcf656c00c1bb
SHA512122123a8f70c4c6690cd98b4ee6cbed9e44b0aa3f29e95d0e403c6571f2fc0e7aeac0ef5c7ca89616e130b4bd2c362071edd2c8b3609b96047f91b9165a2d6a7
-
Filesize
40B
MD5c272d553b7ea6ab8f4a0ff3d76d46960
SHA195ada8c12f382b6e9d4aec48f5a2d2a2e8e18c51
SHA256127afda5d2a95c2b1e2710f85ae65f0b9f1b89bca9c2969c6964bd8a1607e45d
SHA51288c0db322a6ef3db4ec26e234d5b808b7a4d9601ccf3f38b17d03f22a27fa5ad3ada6de116581c036e8e399e197d0ae0966084047bdfad92ced19943fc5bd892
-
Filesize
420B
MD5f085f03e9f5e0add57fda3d499d409a2
SHA1b539745684bb183e9f281568cb3abaf6221a6185
SHA2562f166469a7293256f9e726bb8995a59c4a3acfd9a4d23e32a93957c49bf00ccb
SHA512f6c8cadd2bf7adb204613b9023f0b8941f0dda55334e0a68783cab9da6777e737bdafabbae39711dbf6cbcd06f90a545d7ee251d6a943bfb29acbb4a72cfd4c0
-
Filesize
42KB
MD5d06e2ea058d2fdd2f5a5532650c0d22a
SHA133533c7d3e609352ede807c2843826d106ab4830
SHA256bfc672d818f3406a38878ffca87cb43f9df57cc737c05575a6c5def7c410cb66
SHA5128d26c1a612882efe27e9b4c6d90696edcb6a780ee0cd26dc493d9e932cfc011e23b14b9f29f82614b4770bce6a372a17009825286b673e3806b0ddb0c61a8e25
-
Filesize
406B
MD55edb8fffa237e0df6c7dac6a76eb06c8
SHA1522b21aafd7d63437679b33f7348ea38c4c2364e
SHA256938531cf2c097844124805a7cf357f33f7c01407ac351a2379549069cac04335
SHA51294e959d004bbe074f5aff9ff68c5ea59dec33ec2059cc0fafc0496f97173fa784fd327efbc5e82cf765c60555fb0e80d31b3426ebb75d29711378af987581628
-
Filesize
440B
MD59d30d093fa77774fdee0f665e15b15d9
SHA1eda5996e98273965328cfdb1bfaac93afc0c9099
SHA256fe0a5a27b87462a26b22f546634bd8cfce5c67f805222f7914244d490a51fc97
SHA512855ac2db75e0ac1d2310d4b9dfc2a1e8ecf459d5d51ad11fc4c5174b8d1095f02ab45b27357948f374b734fb4e2f464365c182f67ff0d8b2ecc6aeb6841d1234
-
Filesize
392B
MD5a11692a2f1f30ec6bea040aaabc8d55e
SHA1e7aa2bb65c78af453969a68f4e1cec3c087dd8cc
SHA256a635c15a72ffa4d991e18f199eb32c0c255f8ba531dcfd8aeb2d4905c07a9e54
SHA51283bb36d181441ed30186f3c376122ebe462463ece61c135d4249019f2d6cb96d64aeb49ca585efd6d616ee68f6ec8b50ced11d20f41a966486700a209d7791a7
-
Filesize
444B
MD5d471876c0b846ef1e1c2ecea6cc2b8d9
SHA11786e65b81e3a6cac04668a978d5d8844707bba7
SHA25653d33bb40213543472215130f4537aecbc1c7435c73593295329d07ae55259f4
SHA512f5988b7f0b5238f1835e3d56c333ee46bb4fa6a6f238665101b7a9850e293c2bf729a0127624e7f6f7d2b7cbe00b688861bee7b3c5e858957ae5eac2feefdf5f
-
Filesize
602B
MD5086409121e68d6b9ca5219a5c11726d7
SHA1760f269c80ca5a9ae19432d2123ad86bd9192eb7
SHA256447142fe76c09364ccd15e2d6afda0c28972dad406251a52ea943ef99d5ee625
SHA512476d2b6a3e8780e717b91a7d7e40b774f7940ed89183cde7da56ad77ce65ed34972cecfe747b42d2d432e70af69c090b92715a86a160c03cbad68969b2e50ee4
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
96B
MD5a1ffb594b7338f1e7f8fc81a4f97558e
SHA1d6d508c11b4aa5e64229d1e416b155e203acd63f
SHA256d242f6684ae69306874690e01b3779d26d338cb4c6ab2f241119945ecfe4467d
SHA51284e3386f2339c762a81480713d3445a1a0c6400b2088c7497f70274460881b2a0ea79e8a7607ea77ce7a5c75b2feb7fa331f6342999358a6e0f4f7f110840524
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
96B
MD5a1ffb594b7338f1e7f8fc81a4f97558e
SHA1d6d508c11b4aa5e64229d1e416b155e203acd63f
SHA256d242f6684ae69306874690e01b3779d26d338cb4c6ab2f241119945ecfe4467d
SHA51284e3386f2339c762a81480713d3445a1a0c6400b2088c7497f70274460881b2a0ea79e8a7607ea77ce7a5c75b2feb7fa331f6342999358a6e0f4f7f110840524
-
Filesize
376B
MD5bc0357e6a511d97ce35fcefa1f7aaf85
SHA1b98cf608bcd9fc32266c1b5075ec75cde4ca0cf1
SHA256c6386e9b2024fb8cf62e29520c8adecdaee2481573e8349f19a050c07999f8d5
SHA512f92f09685a49905e5b5211ff43df7e8090b8467638b06ee6ba766c326daafe62fe075227171ba11d311eaea5500b83bcd80d48df26cb3df941a94a1c3cc8fb33
-
Filesize
10.0MB
MD5ce0c21435948acd4a477ea416163afb6
SHA1593f17ecdc65828260a04f0c381ab5dd0cf8233d
SHA25684a8a0369356609b789f641571f25cae9df7ad9b4e25e46256f97a6cb88ff326
SHA512b0a8dc95446fd6951405e8099aca5bc8beed6168743643b888113fe67b308d880c3f2ebdd44774a932bdc7a3e753cab7f9f59751c9453147d67a1f5894a25d09
-
Filesize
434B
MD557e13860d8996ee10d5006c270bc0c31
SHA1c2fc158a0fee9322b4ac1633a2903115e6c58d77
SHA256079ec218b7dffdf06a5d8c52f06538246d5d37deb6b25f63c2bd46cc07b4a3d5
SHA512baf04838ee8e39f6365302f065ccf5cf23fbf6de1522c100b51199da1ff311b254c3c7e86a0dbb7cdcfd4a226cfe7796845b7bd039a6dcaa5cda15db69cb1e7b
-
Filesize
48B
MD56d7d499960179766cd4261d12dacc411
SHA1e6f8553b0015e12b23cc551afe98763f3b1c9bed
SHA256c96ac03cfdbc6f4c1bdcdf764f1a6573f852e7aae5ef405969516b93ed271182
SHA5126526c668477a01a850b8757b77dd3e7be27ad1991f5cf777685efcb03a21f31b71f6eae00f326931599baae4b16360e33e3d0f2894f1b2c1753391df02a14547
-
Filesize
480B
MD56e78585574d801004c44b2e927232bc9
SHA13cef10c8575e1abf91f3cff7aedbdec31f296ce9
SHA25697cf95a0046811528e10d601a1da259e33d0873cc79a8090a1ded1a91dabd7ef
SHA5128873cfcd32214765c9beeb5d0e251804a2c7ca7fca22c832b15af049962299a2c78092863b8ac65f52a4a3e3d84aeb6fbd7d6461b966e79fad9ed51c8d7e8647
-
Filesize
144B
MD52b3e23ceb65e81ed720f79d14419cdc1
SHA17236f58f9419460cd42d55c711071ffbd1199dfd
SHA2566da1317cbc96cd45b230fdc7dd64354ebdc8efa05df0048463fd53eb349464a8
SHA512f72c197a039a8d2f070608f95d9d8db3bef392bdc3b18a61e0133fad10cc8f7b243c3ddec840b919a03c2cb35ca88913e91cbeb8dd2371767ec202dea2614b16
-
Filesize
57KB
MD5f080fa2a56ab5479d58063e5ea871447
SHA14b3fd57a98916fa5784305b76ba30af26b5253d9
SHA2560aa374bc456330fd1b5daf18d25b4bb8e2df1998dfa85466f2c31843ff56e815
SHA5128aee3186a95b389d39882620b7c4199a29aa50580aa98a381b2931a934de6406943c89d4d00ebeabff21e2b03b4a4adcc01e37e32a2335c4838be24bdbf61936
-
Filesize
8KB
MD5e579a6b00eef1318f9166352228eba18
SHA176988896854f0139083e77862eea1a4846cf039f
SHA2564b34cf505050facf47aa7936e4e7667e1969105665c632b3eefe7ecddf9a6935
SHA512c47632e957d87727bf6504a82ca7a44d8da24d30cd997a0f449a96e4f97c656a1b4d9da3fcd827e2a48c59677688da0b872358ebd0f9369d898d1b8ec18d5699
-
Filesize
1KB
MD5a8591be2e92a1c24e0da572af9e3df05
SHA14043a09dc8b960845bfbdcf8496ec8ca53f40bf8
SHA25605ee1d471cc8b136cdc6455627f301626f3d3d39a7420ffd069f60c179fb722d
SHA5129606b747940cb52bb864b6ba65996e65a3d587870093027d4f55effb1c944496f6b86dd5c54d6a2ae40c90a8ef23f8b14b469f68af0f3093683da80a76d5e38d
-
Filesize
16B
MD54ae71336e44bf9bf79d2752e234818a5
SHA1e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA256374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
SHA5120b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
-
Filesize
458KB
MD52ac3df90d085a500a859fcb0d408d4dd
SHA1a8005139b299f59fd089217ace6d1bb2566dc5a7
SHA256b92a28cd0c01ccb51b4d6c2676c8f610736c43b9acfa26eabf2cc80acd933488
SHA512831c6b640c6cf7280407b6d2c45883ae2843efb097646e5948e244e6cdfff226a27e42fb6c553483b8bf5e9132d502f55415eddea2e6ac9e987292c6f5b4ee97
-
Filesize
127B
MD597ccd9a2b2063143df56b6937f961ca4
SHA15e78a91ae5df289ce83443cb7d5589dd3504fb5d
SHA256248ff7928128015b1cfe3e6517c8f9b8c9511bfb8c8baf44fc1370640eac61fd
SHA51286c05a5bb3d7eedea390664796966e9e5a5bf846c85808da54407788a76b3ee25b91428242a1e76d8765bfe51e1ba3636617fbab6e7dbb39fcc433e07c3fcd3b
-
Filesize
135B
MD57736f4ed63020ad4ffc2f5359a7c9d64
SHA158116665dafceb7ae0aaee3bc59717a9a5c00cee
SHA2566fd2c6ee0cc04113fdff44195a45da423aa4643da5653e9220be0fe531c410b8
SHA51210e555b9ff4baa4dbf8ad8fef7563e4756b194595b7794845ea54856e01745bb8eaeef9a5c67da76174fe1832025c9c0d220b49f839b3702d24f5372716a700c