Overview

overview

10

Static

static

7

app.apk

android-9-x86

10

app.apk

android-10-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    app.apk
  • Size 4.7MB
  • Sample230317-llxeqsfe52
  • SHA256 2d2aa0beb3ed562bc563065bb618130e91c615ae6a031efec263149fd997e565
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sova_v5androidbankerevasioninfostealerstealthtrojan

Malware Config

Extracted

Family

  • sova_v5

C2

  • http://cortniadrombasket.store

  • http://qwestrebkinasvaflea.online

  • http://mosuckerdip.store

Targets

    • Target
      app.apk
    • Size 4.7MB
    • SHA256 2d2aa0beb3ed562bc563065bb618130e91c615ae6a031efec263149fd997e565
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    sova_v5bankerevasioninfostealerstealthtrojan

    • Sova_v5

      Android banker first seen in July 2021.

      bankertrojaninfostealersova_v5

    • Makes use of the framework's Accessibility service.

    • Removes its main activity from the application launcher

      stealthtrojan

    • Acquires the wake lock.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks