Analysis
-
max time kernel
2297517s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
19-12-2023 23:34
General
-
Target
6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1.apk
-
Size
3.4MB
-
MD5
c9ddaa4d670c262bf2621b8299ccf84e
-
SHA1
8773fe52563b9aa22909e53671d99d1277427f87
-
SHA256
6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1
-
SHA512
786e56c8011f179f96b489b7ad8f97185194ae3221f108ca5badb6aef3007d2f54ab3dd3ac4c43290b8dca0cfacb9d4387c7dd8099823a4fdf1b54069abd77f9
-
SSDEEP
98304:hJJ7q4BP+NGHd/UMZ7VvJlptaqnQuT/cVSIzqh4mUhkB82+:h3XBPaYblzlpzQG7ph4W82+
Malware Config
Signatures
-
Sova
Android banker first seen in July 2021.
-
Sova payload 2 IoCs
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
com.wjyfqwzhu.fbqipukbm1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/base.apk.j6jU8Ug1.gdf --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.wjyfqwzhu.fbqipukbm/GFqufipowG/8gG8oI6y8gkhugg/oat/x86/base.apk.j6jU8Ug1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD57133001d32a5bec9f4c7f2cc280ecde0
SHA129a40fef0951d246495b5f7b8f2e73122d578536
SHA25649de204d6579c1827f14f9ca6932531fbe03979992994fa3d1dd3d1541f8fc56
SHA512200b1c744eba67e349e3efc44446a4e9311872e0806613f24a2a52988171caa3c38b28715d6ac449e6a8ca77b627092ebde4054f862fdcd4f41f6599b52e4413
-
Filesize
495KB
MD5872f9b80fe333bf5071776c87a9d4823
SHA1d5ce703ea75c52d83b429b77dc19f4fac31b7b87
SHA2561d53bf4587bba9c6e17feeb45b9406d881658d2f052e09af5525ae95c94a1077
SHA51237765af20da0e6f24778fbf7a1651139fa9e491941386c2d4a605df575580a699499bebfbbe4a5ce39483c6c66efe7994a32fd3e8e1e508384e19ad141dbcbff
-
Filesize
495KB
MD5bc97bcf8dd4f7a5a6bf5ff093cad5f37
SHA1026e094dee541cd465d0e07b32ccdfd6b1f85cb7
SHA2564cae15ba01d4a21bcd4ce7a390cd58fd8a325c19ee9069adcc474b97d186535e
SHA5127373f5c72e9135c70f57db86e940b28e95e51cf57ecb34fe6b5ebf9b8328bec122c3c1d88635906e6c519afaeb3c276d9b3f6a4d50fe018c7a8f83e053f29dcc