Extracted

• • Target

    U54LmYEms3

  • Size

    4.3MB

  • MD5

    d87e04db4f4a36df263ecbfe8a8605bd

  • SHA1

    1c99c658e30c672927dccbd8628107abf36d990d

  • SHA256

    3dcd8e0cf7403ede8d56df9d53df26266176c3c9255a5979da08f5e8bb60ee3f

  • SHA512

    101c8f7326e1d617f515ce94490a54772c2550e3b48158a055f3ea2c47efa82e9a90ea626e60f7f2cf3dbf36be77599fb8a3b9f1620c28b8253549069a1a2d5d

  • SSDEEP

    98304:gjYTsK5/hRKuT8kLp0EDb1putwdre5VRLmoVE9zOEhqRbcs:/wK55J8gRBp3dre5VRaoe9zhibV

  Score

  10^/10

  sovabankerinfostealertrojanevasion

  • SOVA_v5 payload

  • Sova

    Android banker first seen in July 2021.

    bankertrojaninfostealersova

  • Makes use of the framework's Accessibility service.

  • Acquires the wake lock.

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Removes a system notification.

    evasion
  behavioral1behavioral2