Overview

overview

10

Static

static

7

Chrome (2).apk

android-10-x64

10

Chrome (2).apk

android-11-x64

10

Chrome (2).apk

android-9-x86

10

Resubmissions

15-05-2023 13:59

230515-rahebseb3x 10

07-03-2023 17:32

230307-v39wtsad7t 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Chrome (2).apk

  • Size

    4.7MB

  • Sample

    230515-rahebseb3x

  • MD5

    4b0e93354da17984f0bef68b9ab83380

  • SHA1

    bff351735b6153339cc8d52089495db0533392b3

  • SHA256

    bbaf483c2b6f67f22eb6e1fa00f200e9c1e201b0110070acaefd416cf846b1aa

  • SHA512

    7353933b7919a87feae7345a09eb2e90bfa32723ae5a0df0d879ca29f0184ce799d1ed625564fc1d095154567618b8d4b79a6fadc0e1b669bafbfde9d6ff9933

  • SSDEEP

    98304:pza2GxDDbL6zkfwe+0F3hoiLUpbcqon9BsTBAx5r3LyNXvOwxHMRA2QAFZ:pzMxDDbL6ew6Ro6Szo9BCBAxs8wtkA2f

Score
10/10
sovaandroidbankerevasioninfostealertrojan

Malware Config

Extracted

Family

sova

C2

http://5.161.23.122:5000

http://nexsuslazim.net:5000

http://nexsuslazim1.net:5000

Targets

    • Target

      Chrome (2).apk

    • Size

      4.7MB

    • MD5

      4b0e93354da17984f0bef68b9ab83380

    • SHA1

      bff351735b6153339cc8d52089495db0533392b3

    • SHA256

      bbaf483c2b6f67f22eb6e1fa00f200e9c1e201b0110070acaefd416cf846b1aa

    • SHA512

      7353933b7919a87feae7345a09eb2e90bfa32723ae5a0df0d879ca29f0184ce799d1ed625564fc1d095154567618b8d4b79a6fadc0e1b669bafbfde9d6ff9933

    • SSDEEP

      98304:pza2GxDDbL6zkfwe+0F3hoiLUpbcqon9BsTBAx5r3LyNXvOwxHMRA2QAFZ:pzMxDDbL6ew6Ro6Szo9BCBAxs8wtkA2f

    Score
    10/10
    sovabankerinfostealertrojanevasion

    • SOVA_v5 payload

    • Sova

      Android banker first seen in July 2021.

      bankertrojaninfostealersova

    • Makes use of the framework's Accessibility service.

    • Acquires the wake lock.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Requests enabling of the accessibility settings.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      evasion

    • Removes a system notification.

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks