sova | 376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4

Resubmissions

18-12-2023 14:22

231218-rpvcfacfc8 10

24-03-2023 05:00

230324-fneptaed4v 10

21-03-2023 16:44

230321-t8talaca44 10

Analysis

max time kernel
2102490s
max time network
157s
platform
android_x64
resource
android-33-x64-arm64-20231215-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20231215-enlocale:en-usos:android-13-x64system
submitted
18-12-2023 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

376D13AFFCBFC5D5358D39ABA16B814F711F2E81632059A4BCE5AF060E038EA4.apk
Size

4.6MB
MD5

d4c6871dbd078685cb138a499113d280
SHA1

60b64c8481f9de5b92634efc70a9ff42f451c78f
SHA256

376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4
SHA512

e8823b7c73140af88ad6fd8c52a6619d245281170ddb31feb9d4e726ee47a8f34575f687048947272fabfb13dbed2c24f50d6fbd6117d40c1db577305955af59
SSDEEP

98304:M0C+HR25SOeU0lhoBenZFOw2QxW74PNTcG/bZ7vf0sc:jCmtO/07oEOw2QU74PNT9/t7nc

Score

10^/10

sova banker evasion infostealer trojan

Malware Config

Extracted

Family

sova

http://193.42.32.84/

http://193.42.32.87/

Signatures

SOVA_v5 payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4241-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

Processes:

com.help.marine

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.help.marine
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.help.marine

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

Processes:

com.help.marine

ioc	pid	Process
/data/user/0/com.help.marine/app_DynamicOptDex/nx.json	4241	com.help.marine

Acquires the wake lock 1 IoCs

Processes:

com.help.marine

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.help.marine

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
11	ip-api.com

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

Processes:

com.help.marine

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.help.marine

com.help.marine
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4241

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.help.marine/app_DynamicOptDex/nx.json

Filesize
2.2MB

MD5
cf9772416a747ac509ec2970cb9c9e74

SHA1
128bcf36307203dbb198d45c3560f30cd63bbd8d

SHA256
6e9478358dbfbefe00e28c9bf85255a8706873479cf8f0746a2246bbbab03c04

SHA512
9f0789d68ba6143d289a066db215a06b64adafa7967bd6915516f12ee416a02cb70bb52dc6cef945ed8965640e8d969093b33c2ce0fc35c480b9cfc57c8da014

Download Submit
/data/data/com.help.marine/app_DynamicOptDex/nx.json

Filesize
2.2MB

MD5
dd644c0a66a11feb4a0d086916d77d42

SHA1
06c009c8e0e9258ab46348573a8023ba2a17086d

SHA256
12d162274020d3a09c7921c34ab8461a1a2a562667feb79f4ab222813b7e6b43

SHA512
f8978a8486d094b33024c0c4d40dd1eca425ab66ed6fe6423e176cb5edb2e38007410b47010c3e3f5edf6a3229f8ef4e61bbb991bd213d52ca8afc49492b4ddc

Download Submit
/data/data/com.help.marine/app_DynamicOptDex/oat/nx.json.cur.prof

Filesize
4KB

MD5
bd823427e6f4d10779f316fd6574841d

SHA1
9cce87be6a71634a77abcbca1863cadabf05c597

SHA256
7e4f4d85155259e095ac4d844c604f05379de500e145354b913f44e86972cc2f

SHA512
5e8b70584e071bf31b8af1260813ec2c3aaa8562c832422ec24fbc2e65d8c83a16d6aa73e6affd014928e7d26d92b44c85fa3c0009fc7cad09a5788760a6cbed

Download Submit
/data/data/com.help.marine/app_DynamicOptDex/oat/x86_64/nx.vdex

Filesize
113KB

MD5
ccc40097c44dec170c02a59f9412cbe4

SHA1
7d8b300fa0e1f2f96545b4f6f5b9e8ccc108a01a

SHA256
5153d8b9cbfa226d0b8e5fe022adf412f44a563e05d67c239091d445bff0a6e6

SHA512
dab7dc19ba7d0a3ab9ca88acd3b53880119cbbb1cb1c449f4b7b9381028cdcdb1b36401d4c7a737ce7e62962d9ca8814010b87aa8d2cf72fe5482f874b692d33

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb

Filesize
4KB

MD5
0eb157e1a86d4d00aa601dd2f6ff3ee3

SHA1
fee434f784e73cc7916322e949f727caf8363102

SHA256
b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4

SHA512
b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
db8d8c7d453ebc7d440a4010441e520b

SHA1
20514ce8d54f1d4bf4bc150e69c7b3ad9382981c

SHA256
f854e5574236390ab819c8fda6d3a9d82292331e7df594b30ae75280d490460a

SHA512
a0242c11d65afd7cc192023b4e4a0b41004cd6c754efb930332c8158e5c6c0e4628c1d4847729e923755e98bd0d106ab29650ddad0e75ee03f8feb5700b3445a

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb-wal

Filesize
173KB

MD5
7c4b4a6ae412cba8b8c58ee6b41bf19d

SHA1
15e087d1bae75ce1e734c0e955a6bd74675e37e1

SHA256
0d8f968caf5d53b7212370cec419b816d577ca0b75d9051ef3d08f4c447f99d7

SHA512
370fd853b6d396310b5aa8175be017ea61061708a005ea91927d66f51fe907736fbffa64c4f9e0edaf585860c34105d2e75b64f33c121d0879b732d5263c803b

Download Submit
/data/data/com.help.marine/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
4fc29577ea3a6d473f264e648aad5b39

SHA1
b3290d0b73e2402c1cf47f1c2c5f3a2623151977

SHA256
053e551c23a3d1f905361fd86889c536d9fbbec6d30349371f3ba2d69baebf39

SHA512
80d27a02e39f2598e931e2473a2b1403a11eb45a12fab7d5245afd980d10de86f50d18d0cbe4a2941d18f577ac78ab6076ba1e6f22263fca9ac4d2fee8565a52

Download Submit
/data/user/0/com.help.marine/app_DynamicOptDex/nx.json

Filesize
6.1MB

MD5
781a5fd150ae010085b1e7ff4501a0f4

SHA1
bfbe600cec76f9f00f02a6f0eca5f4bbd5eb1e71

SHA256
9ae5523ea2a7080ac97ef5443bf4b781f775c67fefaec687e58b5b983caf3146

SHA512
d5dafba7a47802f4312d03557c428e4834d1ca02f0e49f60bb59873ca674deb7be340cb6d0a714295c29894746512869d480da21ab3862eeb27fee9265a98bde

Download Submit