Overview

overview

10

Static

static

7

U54LmYEms3.apk

android-10-x64

10

U54LmYEms3.apk

android-9-x86

10

Resubmissions

11-04-2023 14:54

230411-r9z4eseg5s 10

11-04-2023 14:52

230411-r8194ada99 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample-2342978-d87e04db4f4a36df263ecbfe8a8605bd.zip

  • Size

    3.9MB

  • Sample

    230411-r9z4eseg5s

  • MD5

    bb3286b6e0a375bb45479025f3ab5887

  • SHA1

    adac059eba391beedc8b59b5dbc4ebbcedd7354e

  • SHA256

    ac65bd56ae8518497951393645a33ec9d906d19bafb85d07998705d08c9a29bd

  • SHA512

    7258a4228a3e5b4573b21861990b27ec3febfc3de4f414223a6925dc1f1e7167daba9d266b4896dfa54023df58af499c7054898f93129b93abc36974f5927427

  • SSDEEP

    98304:7vZ6LDkRTaZ20xAyBIOj+6wzxXkq/vhnZblXSyVB:7vYMTaZXxAxzxU6PpLB

Score
10/10
sovaandroidbankerevasioninfostealertrojan

Malware Config

Extracted

Family

sova

C2

http://5.161.97.57:5000/

Targets

    • Target

      U54LmYEms3

    • Size

      4.3MB

    • MD5

      d87e04db4f4a36df263ecbfe8a8605bd

    • SHA1

      1c99c658e30c672927dccbd8628107abf36d990d

    • SHA256

      3dcd8e0cf7403ede8d56df9d53df26266176c3c9255a5979da08f5e8bb60ee3f

    • SHA512

      101c8f7326e1d617f515ce94490a54772c2550e3b48158a055f3ea2c47efa82e9a90ea626e60f7f2cf3dbf36be77599fb8a3b9f1620c28b8253549069a1a2d5d

    • SSDEEP

      98304:gjYTsK5/hRKuT8kLp0EDb1putwdre5VRLmoVE9zOEhqRbcs:/wK55J8gRBp3dre5VRaoe9zhibV

    Score
    10/10
    sovabankerinfostealertrojanevasion

    • SOVA_v5 payload

    • Sova

      Android banker first seen in July 2021.

      bankertrojaninfostealersova

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Removes a system notification.

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks