Overview

overview

10

Static

static

7

cf13b98703...c4.apk

android-9-x86

10

cf13b98703...c4.apk

android-10-x64

10

cf13b98703...c4.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf13b9870395865dff925eee46eb85a087ac020e5e977f516e72dee346fbe2c4.apk

  • Size

    4.7MB

  • Sample

    230322-s8wkaabf3y

  • MD5

    15c23886c4c3be5160c1db5e536cbc24

  • SHA1

    304d205c56b2d374c12701c9c1e20cad068c24f2

  • SHA256

    cf13b9870395865dff925eee46eb85a087ac020e5e977f516e72dee346fbe2c4

  • SHA512

    16a8db9cf15eb088bd24ed2fe3e366c8ec36ba3390833965f4cbbe47dc526fd349f9919f0ce42c04e9a0a911d1e847e37c52ef4384a80274a518e396dee3e624

  • SSDEEP

    98304:+hoeT1ggRBPzVNk6KcWJVDdJ4FyII0azrzBlwrZMVJP0/hLNFe:+hhbnVu6LWJVZJuyxRrwSye

Score
10/10
sovasova_v5androidbankerevasioninfostealertrojan

Malware Config

Targets

    • Target

      cf13b9870395865dff925eee46eb85a087ac020e5e977f516e72dee346fbe2c4.apk

    • Size

      4.7MB

    • MD5

      15c23886c4c3be5160c1db5e536cbc24

    • SHA1

      304d205c56b2d374c12701c9c1e20cad068c24f2

    • SHA256

      cf13b9870395865dff925eee46eb85a087ac020e5e977f516e72dee346fbe2c4

    • SHA512

      16a8db9cf15eb088bd24ed2fe3e366c8ec36ba3390833965f4cbbe47dc526fd349f9919f0ce42c04e9a0a911d1e847e37c52ef4384a80274a518e396dee3e624

    • SSDEEP

      98304:+hoeT1ggRBPzVNk6KcWJVDdJ4FyII0azrzBlwrZMVJP0/hLNFe:+hhbnVu6LWJVZJuyxRrwSye

    Score
    10/10
    sovasova_v5bankerevasioninfostealertrojan

    • SOVA_v5 payload

    • Sova

      Android banker first seen in July 2021.

      bankertrojaninfostealersova

    • Sova_v5

      Android banker first seen in July 2021.

      bankertrojaninfostealersova_v5

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks