Analysis
-
max time kernel
4009057s -
max time network
162s -
platform
android_x64 -
resource
android-x64-arm64-20220823-en -
resource tags
-
submitted
17-03-2023 09:42
General
-
Target
obf2.apk
-
Size
4.5MB
-
MD5
796f99f95297d5a4f569f7736ae1bc44
-
SHA1
78ec290ec357a1d32af01db76b153bfe59d752da
-
SHA256
cebc8d19438e9af6f337ca473123fffbd890e4f66e31e93ee85902a17cef6efc
-
SHA512
c99fc7d97d0f3d63e08f7fb7c2ece579a0eb52ffe423efc2cc34975683f2da400a080f6540abd00ce0001f4eba1f8857d6de5bc070efea956d1d9f138908e7bd
-
SSDEEP
98304:2x+iewanbOUhJxqY/x9wTrczq8SGbMtYqmAMEbaj7+cEpcxM4xhV:2xcOU7xqYgTQVzMtpV+6CL
Malware Config
Signatures
-
SOVA_v5 payload 1 IoCs
-
Sova
Android banker first seen in July 2021.
-
Makes use of the framework's Accessibility service. 2 IoCs
-
Acquires the wake lock. 1 IoCs
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs
Processes
-
com.prefer.diesel1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5eb678082c2581f28f9202479dc0bb174
SHA10c437c857ea1a330706ff0639d97d98965ca622c
SHA2568d60f37f8aeb3d7ace7e6fb501fdcfaa7e3a183f5841b9845dbcd659656dd7f6
SHA51239a0f435462b95b71921b5c0637263a3ccb49c589da589993389d1669b9364500cea0184351b77599e7552812cc1144fbb89a9e0fbe8a5dbf41d97389eae0fd7
-
Filesize
6.0MB
MD5e76a3426fa79e28b2ce2fe2795ba2ef6
SHA13dd30a7106197e4ff4e593f00e049d352bea7c1f
SHA25612796f8750d450d85ed0e3d18f2ce05875f3544ea82bf750bb79bf88944a0866
SHA512ad549079baa4f3d2b8a3c0a62cf1a55e34982a3970bc12b09a9adf018089e45d837e0354ce4e27b64e44cd027fb06d0c36a1ac06adb9a47d78aaf387faf252b5
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
8KB
MD5e579a6b00eef1318f9166352228eba18
SHA176988896854f0139083e77862eea1a4846cf039f
SHA2564b34cf505050facf47aa7936e4e7667e1969105665c632b3eefe7ecddf9a6935
SHA512c47632e957d87727bf6504a82ca7a44d8da24d30cd997a0f449a96e4f97c656a1b4d9da3fcd827e2a48c59677688da0b872358ebd0f9369d898d1b8ec18d5699
-
Filesize
1KB
MD50dd9c3e4e0cf832261b2311ae3da1f52
SHA1bba595f078496be666025f68a06401341d783c48
SHA25611cab657907d32f8cdf0c1fd4e80c5ef8c1126c9beed738dbfca6d21c39b2fe6
SHA512123e1343ee825e4c5d89729c9768bfd87cc8c0d23c60bb74de7ee949b1ac653a7ced87983c50e4febb8da578a370ee187134f81b05116b26f2eb3d6b9f358af6
-
Filesize
16B
MD54ae71336e44bf9bf79d2752e234818a5
SHA1e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA256374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
SHA5120b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
-
Filesize
458KB
MD51750ee60cf5bea8076d44d504c44be50
SHA1030cd9cf0147204e6d47ab82f2bc4d1e26745a0b
SHA256c54e4a7beee49191ebc3a899f7332ef3b341a915e1ba5195f7de240c7cb1a32e
SHA512d60a486eefb6327af1abf3da8cf08d0146f1c6a54236de145a5bceae49919c086e06c468c7653348295e94a4fb971eb1c90c34fd478168a192a99d02a2b0458d