sova | 1ac23747fbf6bc3c5ac928740e30b026d5ffbbd812f93de6453470d5473e50e9

Analysis

max time kernel
3667247s
max time network
160s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
13-03-2023 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tinder Premium (1).apk
Size

4.5MB
MD5

b9606454a3e24198b1551a24f6547473
SHA1

ab038885e0eea1f6e3d6f26700f9b33154bb1886
SHA256

0163e539625ea3e0a026af5606ff62762d10860feaec07f060137a2f36ed5644
SHA512

3fa2dabf1a6aa6b64e27d691e0d9be0e62cead7d540185773769289481d8583c48828be7adb6494d419c5cbce614a4939691bf33f0839fd221d768a378b40062
SSDEEP

98304:WJlj/TRyxPiZ9AvfRPr4thlijfwIhdagt7eFjo3yoriRhoF70cH:4rKP6OZT4Gj3h06SFjCdriXoNH

Score

10^/10

sova sova_v5 banker evasion infostealer trojan

Malware Config

Signatures

SOVA_v5 payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json	family_sova_v5
/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova
Sova_v5
Android banker first seen in July 2021.
banker trojan infostealer sova_v5

Makes use of the framework's Accessibility service. 2 IoCs

Processes:

com.legend.fit

description	ioc	process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.legend.fit
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.legend.fit

Acquires the wake lock. 1 IoCs

Processes:

com.legend.fit

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.legend.fit

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.legend.fit

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.legend.fit/app_DynamicOptDex/oat/x86/DuKi.odex --compiler-filter=quicken --class-loader-context=&com.legend.fit

ioc	pid	process
/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json	4090	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.legend.fit/app_DynamicOptDex/oat/x86/DuKi.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json	4035	com.legend.fit

Removes a system notification. 1 IoCs
evasion

Processes:

com.legend.fit

description ioc process

Framework service call android.app.INotificationManager.cancelNotificationWithTag com.legend.fit

description	ioc	process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.legend.fit

com.legend.fit
1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4035

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.legend.fit/app_DynamicOptDex/oat/x86/DuKi.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4090

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json
Filesize
2.2MB

MD5
690093f95f17c55ccc5b270ea9e63aea

SHA1
2e4f0c26fdc0b3efd9f414a00ea506db242c14bb

SHA256
808c2ed5beee8e21f3a72977f02fb934e8e0bb2dd74ef97cc4cd6b3a4eb7367c

SHA512
00f1af6c43b0ac56ebf07c452b2133ad82d521737776adabb238aba4fc364c0d6d914b3b1a11fe82fa560b61a37daeb76aed220b8b27dc3e88e63f6485f2bc73

Download Submit
/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json
Filesize
6.2MB

MD5
78984b9d4ac9309daa5afd4d09acc514

SHA1
cdf05aef6a1212fba43bed4b6eddc9d293d32fe9

SHA256
3a3f5e9814c41d39261f20183cecb4ff27c4bda9cd25ff67062532403d20a300

SHA512
a0f2874444ddd9291c167b41ed63005c7746df7071b781d89a87fab31f6ed84de916b6710a220cc1c5bbcac7d41d05364cf70746033ffdf66fde44184c9ae6ff

Download Submit
/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json
Filesize
6.2MB

MD5
ce8ffb65d2af4bbe0e5780beacae949c

SHA1
a9a3a9c373ce5e3cb06dbacd39f4ab367ab5c1b3

SHA256
6ca64c4b44510f6e26f2a72e6917b7915c660b833fbd4847a1962d568c6365fd

SHA512
21957e04e8274384fbb6148af34633fb1486baa475443ae8618ac92c111fa0b4ec59b7472270055a1e6060e55e7517a6587737cf25a36428e634715a9b018f21

Download Submit
/data/user/0/com.legend.fit/app_DynamicOptDex/DuKi.json.x86.flock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.legend.fit/app_DynamicOptDex/oat/DuKi.json.cur.prof
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.legend.fit/app_DynamicOptDex/oat/x86/DuKi.odex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.legend.fit/app_DynamicOptDex/oat/x86/DuKi.vdex
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.legend.fit/app_webview/GPUCache/index
Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.legend.fit/app_webview/GPUCache/index-dir/temp-index
Filesize
48B

MD5
aae8cdd331206c5820710d992a68a364

SHA1
6ac4375a3286425f0062fd8cf71a876d8df18b83

SHA256
ca9966e8c786e9f557ba9045fa57a7f4c7ecde89bfc27c8caf88149fa14b4f61

SHA512
77ba4d6b02cfcb7f9acb1f765e43eb216fa5d40480d1347d262b4a20144bb18a3341b8623b003e144ab5bc4110ee27b762660c9980bcd1e2a3c32c5d1cfdc4ff

Download Submit
/data/user/0/com.legend.fit/app_webview/Web Data
Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.legend.fit/app_webview/Web Data-journal
Filesize
1KB

MD5
3251c8d9896cd5baf5a873a23b4a26cc

SHA1
c5b6a3927fbbb25af519df556ad8c1a0752912f4

SHA256
82b5b918d36c41838959b4295043ca09cfecfc6c8ab5bf4427b2d1eabdf1a63c

SHA512
9d648ec30245b67fcf26faacdf1175542105028830f21c9f1a5d9d792a388146d5553a5a94aff11ee19e172b013edbedcb2e3e451365e1dbc8ecb9f9576651e7

Download Submit
/data/user/0/com.legend.fit/app_webview/metrics_guid
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.legend.fit/app_webview/metrics_guid
Filesize
36B

MD5
0a0850d24e8bd271d0f0c16f1018d1f1

SHA1
b1ae5c87ee6e34b4781c4d6cc8100f6a813efac3

SHA256
6ba9a772e93235daa9a93cee7255af1c7519fbb9de93a2a2afe7a824f4b163c3

SHA512
80a908856893a6bafde1569e69ae7dff772eafd2817c5b138d98c869e39b8bf91703ae451f2d1d2dc7dd9ecd1888dd3740f9509166c9a7f8d74cb7c89f9cf15e

Download Submit
/data/user/0/com.legend.fit/app_webview/variations_seed_new
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.legend.fit/app_webview/variations_stamp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.legend.fit/app_webview/webview_data.lock
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/2f3337478e49e949_0
Filesize
198B

MD5
ff14e7566befc1722b417e9cb09a8bf1

SHA1
7b5c63dad525df7925ad51189590271f6558578a

SHA256
51b7edf4944c9e5204e9ffd298606e713b998c27df599e0d6054b91a1a71d807

SHA512
fe682a42f213ef46fb67a164a55198969e9e39b99f069b65464a31679f211e5ed5085cc4b74e738b025c2503f92babb2cf0f48a430702c4ccf8bd39a2c52b31e

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/385bf0055d90dbc5_0
Filesize
289B

MD5
d61c4e9446fd8e007bb03136b94c4a76

SHA1
9afcf4ffb1f8e27495e57a1cdfe937cb642b118a

SHA256
b71135372c13fbf2507bba0958a6e926d2ceacf2cf06b7745e214eb1dc249aba

SHA512
4c9b6463fa0791f515ae3b75ed9c18a67d454116e68008ce2ac862dc47938c13f9f6cb8b9f5f22d4b14b1fefdfeb87fcd85fd02e312077ee35aca3fb5ef44d7a

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/418ad5e834d66b76_0
Filesize
191B

MD5
1fbbcb3642549458626db2a7305250e6

SHA1
0a2a98af87796bf89d24186c6d9ca4e0e87d4ff7

SHA256
991e6259ea473cab000c5acc66565a52e0bfb81c8558e86616606b52dead8b43

SHA512
e6f145a5d6943efebbc61619a7395ac188a532e45d1bd6bde26ed379d3e3ccb16993d201aafae952bf3283a000c80d8c3034f0a0dafa1535369c50f65e58e282

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/628aa70b6030a263_0
Filesize
184B

MD5
9daa777f6ff8c57d253646820895ea1d

SHA1
c8a3994199f0364520a66fc1c2902df27533e365

SHA256
0587c9c588c75fabe885fcd15f4b4a540bf4a16c39ae869032ea0c216a6d42b3

SHA512
733e80d32e59a6f84f35c55e4f774ec215c5c2a4933775110bab152a86198266d9e6c70e185083166d01e23682ebffd72a3252d6325a76fa03137fda825b0c3d

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/7081ad27615f85ec_0
Filesize
210B

MD5
7fff090c8abebea4eebdaa48cbd2bf27

SHA1
0f6c7c8055f9e7cf6609bf753bdf926b819e9f95

SHA256
772f43b4ce0bd4b0ad044f653fa5ad2eb80e4cdf87ac99b11c55080a42d28b9c

SHA512
4014378f3a79b58be046346f77e5d0f7893f7a87067974752d8caf39e1962af391d283170acd8457fae2cc49f85cb15c206d81c5101cf0b16b7f66c4c8869584

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/8a9dd9b28322a4bd_0
Filesize
197B

MD5
38a45f55ae8aa809bc168ba0b3cfda62

SHA1
cad22c4b9211d3a9ab2d21b821c30abef6728c62

SHA256
8b59bcf1f8eeec1d62569351f10bb117fccda1e37ff2597d6592bfbc14d71240

SHA512
c193c7001864620e826c553a01715d62840d6f34ddce3cf296a034870f98edddb5ce66a16bef2f1927f1233c92d4c547da2614302e803e17eb594da028887a02

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/bbbf120220612398_0
Filesize
176B

MD5
bba35bbc68637a31e472606cbd6d899c

SHA1
10be3568f4eeb1ecc74db077409eb482254f33b0

SHA256
0346cf896323677b561d2441bb24f8d7fccad0c19db80a49e96c73f974cfafd8

SHA512
0258199fb15ecf82e4c89bbe2ccf345aaa7a708569ef5fa37994cac0d1bb794810542329f07c48a5c4b078d6adaff6859434caafe006edfd44f70e4ec7d8a3f4

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/f3ef7cc211d63267_0
Filesize
208B

MD5
9615fa89b75a25324748f6948135136e

SHA1
9f398db0da3caafda65184c76f98f6396605f08b

SHA256
9bf052de085a7af07f5180b4b7439dac5e82f731cf9d042ef4edbce978de31aa

SHA512
2b0d6e4825b692ca0919340bd67c42bcbeee69b917af0a2be27e37a00125d934eed2d01f9db5b696015e87f6074c242ca2770b25882cfd1fef7576b40150b61a

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/index
Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/index-dir/temp-index
Filesize
48B

MD5
e49d5ea131352003a30c8f9839744008

SHA1
16d2416853d07506b8222f6de870c5786de17e7c

SHA256
f663995ab21cee1b222f4f7c4743b8e5064452839493a5ef73844332b2924ad1

SHA512
3227ee49b2b85e13b79ca24c88821c1838405091da2619f02b86aec93a215e4fe45514885fb677fff154b145425c280d0ec93ac31642b2e5ef761e825d9d5a4d

Download Submit
/data/user/0/com.legend.fit/cache/org.chromium.android_webview/index-dir/temp-index
Filesize
48B

MD5
dcf3676e198f4cc7491a8d2479dc9dd0

SHA1
30ff24d7c39f46ec929786e49ad7bf3af01f04be

SHA256
22bc471bb396d4200b77262ede97d76c1ecc84da6c1028d737f9632cd93769ab

SHA512
01969b04895148e6666885194fcc02f420b9885e9dc46a2867a01009690a962ea60e782191ea30950988ca1e473ffaa3e3467eb80d8bab72c685d4e80eb526aa

Download Submit
/data/user/0/com.legend.fit/no_backup/androidx.work.workdb
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.legend.fit/no_backup/androidx.work.workdb-journal
Filesize
524B

MD5
63fe2c0eb85d760a434f9e85940c3d68

SHA1
1cd4b00b449dea91cc13f38a01d670e651028cc2

SHA256
1cd45f5de1e0bc7291251a0b5b6a65baae67b8401e5fdc4cca2948f54f993cef

SHA512
71f1e59b825eadad33786c9480ff30fff294112122c90a0a9c69c1b3de93761761d5dc82adbac1ab37b203f296469307fbe987061f9b24f967338fb71f62f35b

Download Submit
/data/user/0/com.legend.fit/no_backup/androidx.work.workdb-shm
Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.legend.fit/no_backup/androidx.work.workdb-wal
Filesize
229KB

MD5
3480e985451a655bf44cd376ded81dd5

SHA1
877ce10d2dd9953c1bcdf34909a3c13423998b56

SHA256
c0b1f63af91e87e7ae6c0eb0504e23a5ca2ac22d7f43dd1a35781786c8cc73f6

SHA512
5a0f56a368343c1683f5146b7eb399ca69ac5169d4024a4f3fc78ba52a1bd8a61e554fa47af564d6779b9950681a1b0ac8b2046bbc3ea9140ae66320c95a7c90

Download Submit
/data/user/0/com.legend.fit/shared_prefs/WebViewChromiumPrefs.xml
Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit