Overview

overview

10

Static

static

7

3dcd8e0cf7...3f.apk

android-9-x86

10

3dcd8e0cf7...3f.apk

android-10-x64

10

3dcd8e0cf7...3f.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3dcd8e0cf7403ede8d56df9d53df26266176c3c9255a5979da08f5e8bb60ee3f.apk

  • Size

    4.3MB

  • Sample

    230413-frr5bahe86

  • MD5

    d87e04db4f4a36df263ecbfe8a8605bd

  • SHA1

    1c99c658e30c672927dccbd8628107abf36d990d

  • SHA256

    3dcd8e0cf7403ede8d56df9d53df26266176c3c9255a5979da08f5e8bb60ee3f

  • SHA512

    101c8f7326e1d617f515ce94490a54772c2550e3b48158a055f3ea2c47efa82e9a90ea626e60f7f2cf3dbf36be77599fb8a3b9f1620c28b8253549069a1a2d5d

  • SSDEEP

    98304:gjYTsK5/hRKuT8kLp0EDb1putwdre5VRLmoVE9zOEhqRbcs:/wK55J8gRBp3dre5VRaoe9zhibV

Score
10/10
sovaandroidbankerevasioninfostealertrojan

Malware Config

Extracted

Family

sova

C2

http://5.161.97.57:5000/

Targets

    • Target

      3dcd8e0cf7403ede8d56df9d53df26266176c3c9255a5979da08f5e8bb60ee3f.apk

    • Size

      4.3MB

    • MD5

      d87e04db4f4a36df263ecbfe8a8605bd

    • SHA1

      1c99c658e30c672927dccbd8628107abf36d990d

    • SHA256

      3dcd8e0cf7403ede8d56df9d53df26266176c3c9255a5979da08f5e8bb60ee3f

    • SHA512

      101c8f7326e1d617f515ce94490a54772c2550e3b48158a055f3ea2c47efa82e9a90ea626e60f7f2cf3dbf36be77599fb8a3b9f1620c28b8253549069a1a2d5d

    • SSDEEP

      98304:gjYTsK5/hRKuT8kLp0EDb1putwdre5VRLmoVE9zOEhqRbcs:/wK55J8gRBp3dre5VRaoe9zhibV

    Score
    10/10
    sovabankerevasioninfostealertrojan

    • SOVA_v5 payload

    • Sova

      Android banker first seen in July 2021.

      bankertrojaninfostealersova

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks