General
-
Target
Nexus.zip
-
Size
4.2MB
-
Sample
230329-rn1g3agf72
-
MD5
5708bc1273790b8236b85768ec049e4b
-
SHA1
967ef7876ce7de51e3b0efd64a4c1542d53f6866
-
SHA256
923f9740c518cee69d82f77c19944a1976c4d4516b859f519369bff120ff47cd
-
SHA512
4aa80a580714e2300e0000528a3b75ed3c30fadc246e77bcaa641e5285fac197891a716efd4f36a9cbcb6ec0d819e5c4018f09a0c661644005d8226807285def
-
SSDEEP
98304:pP/9p7yQ+59o94Rg9KzXiG10kvfAHo9TP1:pP/7HNaRg9eXia8o9TP1
Malware Config
Extracted
sova
http://193.42.32.84/
http://193.42.32.87/
Targets
-
-
Target
376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4
-
Size
4.6MB
-
MD5
d4c6871dbd078685cb138a499113d280
-
SHA1
60b64c8481f9de5b92634efc70a9ff42f451c78f
-
SHA256
376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4
-
SHA512
e8823b7c73140af88ad6fd8c52a6619d245281170ddb31feb9d4e726ee47a8f34575f687048947272fabfb13dbed2c24f50d6fbd6117d40c1db577305955af59
-
SSDEEP
98304:M0C+HR25SOeU0lhoBenZFOw2QxW74PNTcG/bZ7vf0sc:jCmtO/07oEOw2QU74PNT9/t7nc
Score10/10-
SOVA_v5 payload
-
Sova
Android banker first seen in July 2021.
-
Makes use of the framework's Accessibility service.
-
Acquires the wake lock.
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).
-
Removes a system notification.
-