sova | f3fc80a8793e60a901da44b9ab315931699e64a4f3eddb8aba839fe860de46dc

Analysis

max time kernel
3580156s
max time network
159s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
12/03/2023, 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PancakeSwap.apk
Size

4.5MB
MD5

22d82606c804126663992f59e3d1f0c9
SHA1

a8a7c8896772bda9c5e17ce665eaabf32c0c959c
SHA256

f3fc80a8793e60a901da44b9ab315931699e64a4f3eddb8aba839fe860de46dc
SHA512

de8b90858bc7bd539383cd24b88c432586b09b9951d6f9a9ad2f6f0c46ba1042d00644b4c368fcfcc5ca6bba9182da5ceb5d495301cdc187c4fc2f4ef53487f0
SSDEEP

98304:jccN08QfEUXSRxAJDFJLhohK0/anjwH9U3RFRGOsR3oHFoZdt7+CSEpDj9O:jccN08iEUioJZJ1oXldciOsq0t7tSEC

Score

10^/10

sova sova_v5 banker evasion infostealer trojan

Malware Config

Signatures

SOVA_v5 payload 2 IoCs

resource	yara_rule
behavioral1/memory/4122-0.dex	family_sova_v5
behavioral1/memory/4059-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova
Sova_v5
Android banker first seen in July 2021.
banker trojan infostealer sova_v5

Makes use of the framework's Accessibility service. 2 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.card.gift
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.card.gift

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.card.gift

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.card.gift/app_DynamicOptDex/gXQDo.json	4122	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.card.gift/app_DynamicOptDex/gXQDo.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.card.gift/app_DynamicOptDex/oat/x86/gXQDo.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.card.gift/app_DynamicOptDex/gXQDo.json	4059	com.card.gift

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	ip-api.com

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.card.gift

com.card.gift
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4059
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.card.gift/app_DynamicOptDex/gXQDo.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.card.gift/app_DynamicOptDex/oat/x86/gXQDo.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4122

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.card.gift/app_DynamicOptDex/gXQDo.json

Filesize
2.2MB

MD5
b22b04341e6249b2553da1362529c5cc

SHA1
4c986b4a0e515207d07ccc8a590ae6efa9e2b636

SHA256
b0d67beff407d23003c7f4ca64f05794ad625c302fc844b725bc6adf91eee199

SHA512
3e6dad9f780eba72e7ea9d8ea836956cae4fd9fe9e76547df5be227817e39ddf6e9e051e77225a9077e71587b901830f1268829db01ea0f15896a88e1d3afb8e

Download Submit
/data/user/0/com.card.gift/app_DynamicOptDex/gXQDo.json

Filesize
6.1MB

MD5
5145d72cd26d21644751a2a1bfe7dd6f

SHA1
40109b67d6cc9be7a49da97d2fa6eba3359d6b85

SHA256
ed9b36e8d78cc9574a9572a18d5b014d4d360b2eff55040a785378735063da20

SHA512
de37328f1f17d23fb57992271b851ed61f6bb21d2d1c3508adbcf902fb2304b78de9fe93403fb52ef312f7821fcba987a33d3df7db4c2eef860eebe103c70002

Download Submit
/data/user/0/com.card.gift/app_DynamicOptDex/gXQDo.json

Filesize
6.1MB

MD5
dd9e12fdbb6c6b2e1e2d0c5ce1b05363

SHA1
818573694294026f1e2d779caf1547d51c5e7a89

SHA256
7b6e7b80c1b586475104c652495bc6a2d252f8256e8877fff9fd62c2f1fa91f5

SHA512
25aa9d591604a1552aeda497275f20983a74ada6b97f16502a82ab36cc43163eb8563a4b43ca2ce6df555fb923cac337b5c23e0c7b98aa21e5ed7a26a7a964b4

Download Submit
/data/user/0/com.card.gift/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.card.gift/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
50143dd1e9c26d320154b3ade69f2912

SHA1
58e634d09e3532cb610c3a8a2c838401708613f4

SHA256
8ccf152a9b7ed1eefefa146fc9daecd0fa6ab80209650b256d0d80cad84d6b48

SHA512
ccc06f26ab3ca872d84c62e96cad06758e809bd32290527e47b91719b2e136b6194b8fefbba23546b1dc8d5ca8b692740b5df861d0a0e1cba2b0512a71ad711d

Download Submit
/data/user/0/com.card.gift/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.card.gift/app_webview/Web Data-journal

Filesize
1KB

MD5
290c848550dd7adb4acf4e6754d9647b

SHA1
8a298bcd0720ea9c925db8f9b5674408681f658d

SHA256
bca4f4b07b189df892721cfb5f1cb588de8b796158eafa63e5764f0f8150aff9

SHA512
db4d113551d0e56997517184d042b9f78d0e8f1f4f18885deaffa94283f61ee6b12e534dac9140eda6f9810fad02fee73344008b6487d8e86d6d093c28af1857

Download Submit
/data/user/0/com.card.gift/app_webview/metrics_guid

Filesize
36B

MD5
f5aeab7f0d626999ccd2d899341e6282

SHA1
5466a28893de8b886a2afb0968cb299144ccd689

SHA256
ffe0d6e30abd5e8b3bd66d30a2e5601cdd69846f78acb9a42daf0e41c4930632

SHA512
1b85735aab5110eb1af2b5a97a45d21507e5f1240423cca01c793f61769fd69de1571937ecb45e6b40d653aa07c38ffb735141b5ad6e9e8fd438eea4bf4f68fb

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/2f3337478e49e949_0

Filesize
198B

MD5
ff14e7566befc1722b417e9cb09a8bf1

SHA1
7b5c63dad525df7925ad51189590271f6558578a

SHA256
51b7edf4944c9e5204e9ffd298606e713b998c27df599e0d6054b91a1a71d807

SHA512
fe682a42f213ef46fb67a164a55198969e9e39b99f069b65464a31679f211e5ed5085cc4b74e738b025c2503f92babb2cf0f48a430702c4ccf8bd39a2c52b31e

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/385bf0055d90dbc5_0

Filesize
289B

MD5
d61c4e9446fd8e007bb03136b94c4a76

SHA1
9afcf4ffb1f8e27495e57a1cdfe937cb642b118a

SHA256
b71135372c13fbf2507bba0958a6e926d2ceacf2cf06b7745e214eb1dc249aba

SHA512
4c9b6463fa0791f515ae3b75ed9c18a67d454116e68008ce2ac862dc47938c13f9f6cb8b9f5f22d4b14b1fefdfeb87fcd85fd02e312077ee35aca3fb5ef44d7a

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/418ad5e834d66b76_0

Filesize
191B

MD5
1fbbcb3642549458626db2a7305250e6

SHA1
0a2a98af87796bf89d24186c6d9ca4e0e87d4ff7

SHA256
991e6259ea473cab000c5acc66565a52e0bfb81c8558e86616606b52dead8b43

SHA512
e6f145a5d6943efebbc61619a7395ac188a532e45d1bd6bde26ed379d3e3ccb16993d201aafae952bf3283a000c80d8c3034f0a0dafa1535369c50f65e58e282

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/628aa70b6030a263_0

Filesize
184B

MD5
9daa777f6ff8c57d253646820895ea1d

SHA1
c8a3994199f0364520a66fc1c2902df27533e365

SHA256
0587c9c588c75fabe885fcd15f4b4a540bf4a16c39ae869032ea0c216a6d42b3

SHA512
733e80d32e59a6f84f35c55e4f774ec215c5c2a4933775110bab152a86198266d9e6c70e185083166d01e23682ebffd72a3252d6325a76fa03137fda825b0c3d

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/7081ad27615f85ec_0

Filesize
210B

MD5
7fff090c8abebea4eebdaa48cbd2bf27

SHA1
0f6c7c8055f9e7cf6609bf753bdf926b819e9f95

SHA256
772f43b4ce0bd4b0ad044f653fa5ad2eb80e4cdf87ac99b11c55080a42d28b9c

SHA512
4014378f3a79b58be046346f77e5d0f7893f7a87067974752d8caf39e1962af391d283170acd8457fae2cc49f85cb15c206d81c5101cf0b16b7f66c4c8869584

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/8a9dd9b28322a4bd_0

Filesize
197B

MD5
38a45f55ae8aa809bc168ba0b3cfda62

SHA1
cad22c4b9211d3a9ab2d21b821c30abef6728c62

SHA256
8b59bcf1f8eeec1d62569351f10bb117fccda1e37ff2597d6592bfbc14d71240

SHA512
c193c7001864620e826c553a01715d62840d6f34ddce3cf296a034870f98edddb5ce66a16bef2f1927f1233c92d4c547da2614302e803e17eb594da028887a02

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/bbbf120220612398_0

Filesize
176B

MD5
bba35bbc68637a31e472606cbd6d899c

SHA1
10be3568f4eeb1ecc74db077409eb482254f33b0

SHA256
0346cf896323677b561d2441bb24f8d7fccad0c19db80a49e96c73f974cfafd8

SHA512
0258199fb15ecf82e4c89bbe2ccf345aaa7a708569ef5fa37994cac0d1bb794810542329f07c48a5c4b078d6adaff6859434caafe006edfd44f70e4ec7d8a3f4

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/f3ef7cc211d63267_0

Filesize
208B

MD5
9615fa89b75a25324748f6948135136e

SHA1
9f398db0da3caafda65184c76f98f6396605f08b

SHA256
9bf052de085a7af07f5180b4b7439dac5e82f731cf9d042ef4edbce978de31aa

SHA512
2b0d6e4825b692ca0919340bd67c42bcbeee69b917af0a2be27e37a00125d934eed2d01f9db5b696015e87f6074c242ca2770b25882cfd1fef7576b40150b61a

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
168B

MD5
960cb48cfb98b17c981de3cf65955a45

SHA1
9f23d01ecfe6b738d6ba157d4d6a98aed80576e3

SHA256
91884e5d9242adaa06c4e74e2e2e102daf03330789d49e1945770af8c769f8cd

SHA512
e97b56a5a7cdf583b42755365fd0a18f4223a96760e5b9d04ab88fb3b6e77d667fe30b9b30a6601950d100cd73398f8d746245ea4f87aff2e8fca593d0ceae95

Download Submit
/data/user/0/com.card.gift/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
2952c0d33f03a1343a7a9288b343ac96

SHA1
6d1006abbaec72fcf399a6e380cd53d4c6fd096a

SHA256
ad9242e983629f0e9667fab179717d552b90c84bc908bfc9f6ca738f9ec8e041

SHA512
bc7de5f50b8df1a83f2afe125c6641e9f941890e19913dea2964cf22d8386773e376051b27e619ddb660ab1fae465692f1718ad46afd9b3e3b52a1bc3e665c00

Download Submit
/data/user/0/com.card.gift/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.card.gift/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
02cabd2c5cd585ef7470c8b5b3453654

SHA1
fdd5e4c242e91012144d9fb6bee978ecb6a0fc21

SHA256
ad1e16150f7310f2200871ace04053c7cc116537d600d1f09c98a06141d7b956

SHA512
5729d558dc828f974eb2b6cd702cf2f06fd64d15ee457a635648d11784545e7c16fe9044f8eb9ee94cc4e43301b14366dd77d0af23c0ec06fe49a9abd5dfea5a

Download Submit
/data/user/0/com.card.gift/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.card.gift/no_backup/androidx.work.workdb-wal

Filesize
229KB

MD5
3d0a67ebac8651e271d0c53e7dc5bbab

SHA1
c6097bec5e70b8f49887b0c115193395918861cf

SHA256
08f08322f463e06fa1d3641ece136a3728920d94bd224fd113a4663406076a2a

SHA512
9cadd7885c3c1483d1d030595fcb3246a6eb8a2d76b57f304461ef55114aa4ec7aa554b08924827d5a00fa839b02ed51bf2bff7c2a7eed0c50dbe534f48b0160

Download Submit
/data/user/0/com.card.gift/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.card.gift/shared_prefs/prefs.xml

Filesize
135B

MD5
7736f4ed63020ad4ffc2f5359a7c9d64

SHA1
58116665dafceb7ae0aaee3bc59717a9a5c00cee

SHA256
6fd2c6ee0cc04113fdff44195a45da423aa4643da5653e9220be0fe531c410b8

SHA512
10e555b9ff4baa4dbf8ad8fef7563e4756b194595b7794845ea54856e01745bb8eaeef9a5c67da76174fe1832025c9c0d220b49f839b3702d24f5372716a700c

Download Submit