sova | 894723b804ae51e7294a69169f0d7b0244a18ba712fa8e3042cb63e8e58cbccf

Resubmissions

09-03-2023 12:51

230309-p3sdwsbd2x 10

24-01-2023 13:11

24-01-2023 13:11

16-01-2023 15:02

16-01-2023 14:58

Analysis

max time kernel
3325527s
max time network
70s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
09-03-2023 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Video_Player.apk
Size

4.3MB
MD5

54013894dcaf20181b2ca431bb9d0575
SHA1

6cb71982ce39526340616a51ab45ccf46dcf799d
SHA256

894723b804ae51e7294a69169f0d7b0244a18ba712fa8e3042cb63e8e58cbccf
SHA512

fca6cf580c15e0e623b76fa83c9d1234d1f376a9059274e24debdab02ae6c9ab74c16be7b13c26cca810b93290405619a5a17a1dbf9d087dcea57953aa74369d
SSDEEP

98304:QkrGUuVDcQJBwXBtEgQJPL8dKNPtJOvar/xGvKp2QqP2kWnRUrCvLP95cd:Q21uZckBwXBtVQ9wG/QSpLhRUrCvxWd

Score

10^/10

sova banker evasion infostealer trojan

Malware Config

Signatures

SOVA_v5 payload 2 IoCs

resource	yara_rule
behavioral3/memory/4163-0.dex	family_sova_v5
behavioral3/memory/4110-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.exist.debate
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.exist.debate

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.exist.debate

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json	4163	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.exist.debate/app_DynamicOptDex/oat/x86/CGSbpH.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json	4110	com.exist.debate

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	ip-api.com

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.exist.debate

com.exist.debate
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4110
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.exist.debate/app_DynamicOptDex/oat/x86/CGSbpH.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4163

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json

Filesize
2.2MB

MD5
620c929c8196c891363645faae990759

SHA1
7afb9f0944b1ada292a0352f551136c4ed33236b

SHA256
c307f9d17ff1f91aa0f9256e61087d0057688a4c1a8c9c2c0ad517737110c143

SHA512
b0106feb245419eaf2a86bf5a3f30c9ff6fc3bc3dd23fa62dff1a47a4891ce26626c7ae489a4a8368cbae71ea99d5d7cafb8bffe9d7777bf33dfb71e3dd7a6a4

Download Submit
/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json

Filesize
6.2MB

MD5
40cfb27f41c2d5877e3759c571f49556

SHA1
7b303336095219ec463b4436951ce480ee3aa125

SHA256
1bd92a9bfa65b34834251e0d150cb7cd9df226f42dac49cda7d9caa918a074f3

SHA512
673cb4f94c681833c658e6b8d744d80de03a3b1447d6184d36a60ea23334c62ad36897958665d3a3d3a304d35bf0540e043ab21e5968e20bf4e54440fa2f3521

Download Submit
/data/user/0/com.exist.debate/app_DynamicOptDex/CGSbpH.json

Filesize
6.2MB

MD5
1ef9b27a9dae41cca65cb3472e69884d

SHA1
f9ea99749a313184ab4826f9e2daee22c33c4b25

SHA256
7295be9efb520d79f517c68cd8d560e2b7d175d239be3a3761576ecb31f36804

SHA512
6d8402d6ac777c708f6fd2a0c60ee243cbd60b47c6bfcd0c29ce8c40e6c5998b537d6bf1285f6db08068b7104acc7a5b6e4a26c0a2b56c3390206d8e8c69545d

Download Submit
/data/user/0/com.exist.debate/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.exist.debate/app_webview/Cookies-journal

Filesize
1KB

MD5
b0616fc060e82eca23f12f79aceb5590

SHA1
b1cbcb26b0b2fa7cb1ade1b14fe5ea49b1d351d3

SHA256
2a6b651dbae00064eb7619a38513fb741bcf9cef279db3542c9e9fb6ccab9aef

SHA512
187631ac42ea3571ab45bc0dc63e717ada17be0813f0ccf0ffa27d6b8fae8b21973872f43fbb41fe65dd195519398bddc63d85245ba544d81900f374c003118f

Download Submit
/data/user/0/com.exist.debate/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.exist.debate/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
f54ec7267bb66e4a290ded4e0556e2eb

SHA1
146b202d11a1bdcedf5ff9fee8d8fe4ed20b54fb

SHA256
08298b4972c7f0776a561ef6e1d4b84ed01ffa0ee75fdb4fb4219eeea46503a9

SHA512
a9e69e292392b7685ed364ecebae93ec5c40c7aa947b31b10d7ca253e599e5774765a24e12a5d96472bf9989d7b771a38cad9aecc051d506c726630bc836667f

Download Submit
/data/user/0/com.exist.debate/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.exist.debate/app_webview/Web Data-journal

Filesize
1KB

MD5
95ad9bc56d1a1535e02a2934829749d5

SHA1
009f11aeaf4553b7cc8d4d0f03307a25742f9411

SHA256
b3c36ddd60c91d457474855bb9faa345c5caedf3c766a16583becedf221a3773

SHA512
7d1bae1d54ecb428f19a5e70ba258da1c148fbdc9db3e327a054be0d1c45c2a4928e58b03aa6aaa8002c25fc9e1449adf4bc7a8839039bf2fe59f7822f085836

Download Submit
/data/user/0/com.exist.debate/app_webview/metrics_guid

Filesize
36B

MD5
22182a745c5ff1c9231b5cf6e551694f

SHA1
00b97c167c156278bcbf043a652179fab7316168

SHA256
edb0cfeb0c1758d0b837230cb9b3eff6e6894dddaadbe8e5de3206aad026c0e6

SHA512
40aa855952cdd8a5d87feb7e22ae065ab22efadd4c565ce954b27c7033fe43fea893914c947425831a5c1e28a7cb93ee0de1d43f3ba363d05f15eb2b410673c5

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/2f3337478e49e949_0

Filesize
198B

MD5
ff14e7566befc1722b417e9cb09a8bf1

SHA1
7b5c63dad525df7925ad51189590271f6558578a

SHA256
51b7edf4944c9e5204e9ffd298606e713b998c27df599e0d6054b91a1a71d807

SHA512
fe682a42f213ef46fb67a164a55198969e9e39b99f069b65464a31679f211e5ed5085cc4b74e738b025c2503f92babb2cf0f48a430702c4ccf8bd39a2c52b31e

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/36703fa6334dfd63_0

Filesize
21KB

MD5
765ee33c3f76868150bb0634518e1410

SHA1
539b87f0af0f50f16d28c7f4e679665cf5f9b112

SHA256
66aceaf0abc027f2bdad30fea7373b7dabe1f39fa8e1e494ded0415c6f537ebe

SHA512
420ae063995838388ee1722b4aa4d915cac86d9502277c3b1d85c25ef34bd3119327280e549ac472a5af264f3809e0f3abb63da9d025358301b01c113c8f6f83

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/418ad5e834d66b76_0

Filesize
191B

MD5
1fbbcb3642549458626db2a7305250e6

SHA1
0a2a98af87796bf89d24186c6d9ca4e0e87d4ff7

SHA256
991e6259ea473cab000c5acc66565a52e0bfb81c8558e86616606b52dead8b43

SHA512
e6f145a5d6943efebbc61619a7395ac188a532e45d1bd6bde26ed379d3e3ccb16993d201aafae952bf3283a000c80d8c3034f0a0dafa1535369c50f65e58e282

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/5016ca2a78afe9d0_0

Filesize
208B

MD5
490742a415602561da8a3f624a951113

SHA1
1630e665e60cde8378ce4708c343969bef7fc0ef

SHA256
b5df4eb95a1d5f8d739cef3c6334a6ef60232ef92e861eca5d85bf73aac53537

SHA512
f97f9c11b72d594c8d0dbda3eb50f7fc5f1a6e8ebd74bd15cbeb190b91a4ad8986d5d6e5385b73204576ac20105730bcd4e890045c52fd3a93f86d602f683276

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/628aa70b6030a263_0

Filesize
184B

MD5
9daa777f6ff8c57d253646820895ea1d

SHA1
c8a3994199f0364520a66fc1c2902df27533e365

SHA256
0587c9c588c75fabe885fcd15f4b4a540bf4a16c39ae869032ea0c216a6d42b3

SHA512
733e80d32e59a6f84f35c55e4f774ec215c5c2a4933775110bab152a86198266d9e6c70e185083166d01e23682ebffd72a3252d6325a76fa03137fda825b0c3d

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/7081ad27615f85ec_0

Filesize
210B

MD5
7fff090c8abebea4eebdaa48cbd2bf27

SHA1
0f6c7c8055f9e7cf6609bf753bdf926b819e9f95

SHA256
772f43b4ce0bd4b0ad044f653fa5ad2eb80e4cdf87ac99b11c55080a42d28b9c

SHA512
4014378f3a79b58be046346f77e5d0f7893f7a87067974752d8caf39e1962af391d283170acd8457fae2cc49f85cb15c206d81c5101cf0b16b7f66c4c8869584

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/86a120befb3c1f61_0

Filesize
289B

MD5
6d25b33136e487b528fc0ac7e26546ac

SHA1
646b57efef23e28fb1989a322b7a87855f0c1c90

SHA256
73e73f5b211659f83b94c608e5eaa955074f40615dec6a2bbf66d47336bfddab

SHA512
cbdc6adb4eb2d56b595e341ed8367e66e4ac3358c7c5821db4155e46691ace84c01a3e67671c7e834c2d10dbea4c7fb509e28bfd6ccfccf7817f3bb69f602fd9

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/bbbf120220612398_0

Filesize
176B

MD5
bba35bbc68637a31e472606cbd6d899c

SHA1
10be3568f4eeb1ecc74db077409eb482254f33b0

SHA256
0346cf896323677b561d2441bb24f8d7fccad0c19db80a49e96c73f974cfafd8

SHA512
0258199fb15ecf82e4c89bbe2ccf345aaa7a708569ef5fa37994cac0d1bb794810542329f07c48a5c4b078d6adaff6859434caafe006edfd44f70e4ec7d8a3f4

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/de2a0b8a9db359af_0

Filesize
2.5MB

MD5
57069141185affef2864fab56508b31d

SHA1
781b209b4dc7c383699d68e1020175077b027e8f

SHA256
d490cf5efc4eee8251c7f30f993fa8922226299416ddc5f27eb4508c71ac4bb4

SHA512
bf86c98abb9a03723320be26df58db12aa2a8973d789b45ea9efe7f482ba587d76a0d069862f1101c119347aaf5569a5755c8cae8db97cb82437b03efb847279

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/ec6f7511e88aab5d_0

Filesize
205B

MD5
d2ef3020ac0a4d8e79de415e15eef8d7

SHA1
a3a5ad100f692cb52c0419cf3fc30e7605c2d2e0

SHA256
caec162c8b1293961b145e2bb04d475d991ef2eae435cbb36bd86c1143568a7f

SHA512
da431a5ef9ae2b25a641de367ca3fdeb9013d79e80be6c81c825f0c4feafd3693b85c76ea2adf05353f02c21a52d2022678188fffa770e0c068c762019aae4cd

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
e7bad619d3e235762290d2d7c60e8453

SHA1
08cc74777c358c3bdfcb5c19737922f92cf40c19

SHA256
87091bdc28f9c02ff4dd3cad511974ec5ef6ca14bc3397edf1fcaa25223b3b29

SHA512
c31e27d3c1dfd481c88da853018d90df85782d7a42f2eb071f95d011b8bd8c6920ba8dccb6b4ffe99e8066e318c4dd857ceeefd3ced16383e937231d7377307d

Download Submit
/data/user/0/com.exist.debate/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
d4f127c47e659543a2cbf6b55daed4f1

SHA1
2f5a42bd7c85bf81cc85f8b2df4d710a06a701d4

SHA256
e6b3ee3f679f05a21cfa1cf2e3f491be6bb0deefcec161b1b86d5a81bf341674

SHA512
cc228efdedafe39d1d09bd3b19cd6d4b164d9c2f9ecd076c65d42f788496138737defd89dc844de86060e0d42340e03c99781930bf79d6b8500a4f7861196cb1

Download Submit
/data/user/0/com.exist.debate/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.exist.debate/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
023154edb19019c646f321fd12d938a6

SHA1
8b6496b6e61cbf94c77403a89db6935719566395

SHA256
525997cdf6a9d921fdfb4251b7fb06be55a337a1ed724cd00f6222d96fbf505f

SHA512
e44ade7c5574ce89165c3f8eace61bc7914ae5692f8bfc519bc11797b62ad25795aeddd0b5d734a003f0662322145c0f009c910166984f1ffd7ddb6c86e03ab9

Download Submit
/data/user/0/com.exist.debate/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.exist.debate/no_backup/androidx.work.workdb-wal

Filesize
229KB

MD5
94742946cd69acf399e5ebc24df1a93d

SHA1
852fd014c5532db2ff2f1bd031bddc7714b19a0f

SHA256
3eeaff248d7d196fa6b3e558df7ff2dca6b9a8a9827e3ceff3eb5f4b40718e83

SHA512
61a30731d96f6525289503c331a51f0e834d22e4b89fd120a8d75c307dec86389fc0abc382fc55f27a803bfd95177b5f05761f1ce8a7909c27ac56e364c0c517

Download Submit
/data/user/0/com.exist.debate/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit