Analysis
-
max time kernel
2296363s -
max time network
149s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
19-12-2023 23:34
General
-
Target
6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1.apk
-
Size
3.4MB
-
MD5
c9ddaa4d670c262bf2621b8299ccf84e
-
SHA1
8773fe52563b9aa22909e53671d99d1277427f87
-
SHA256
6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1
-
SHA512
786e56c8011f179f96b489b7ad8f97185194ae3221f108ca5badb6aef3007d2f54ab3dd3ac4c43290b8dca0cfacb9d4387c7dd8099823a4fdf1b54069abd77f9
-
SSDEEP
98304:hJJ7q4BP+NGHd/UMZ7VvJlptaqnQuT/cVSIzqh4mUhkB82+:h3XBPaYblzlpzQG7ph4W82+
Malware Config
Signatures
-
Sova
Android banker first seen in July 2021.
-
Sova payload 1 IoCs
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
com.wjyfqwzhu.fbqipukbm1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD526da111ae1e457281ab3b9daf5aecab2
SHA1954f370b92d1ec1a0f10e159a4fe7464c7188910
SHA256f904487206a6ffba1d20ca8b4d918a228d01585575d0d1a2deaf13414834ba7b
SHA512d9dcbbe09cade7c68d40e791b1e49b840115b2b7874645adf6a388c03dc8ffe5751561e9d656ecdc9635fa19d1f3688595f2873ce649895607b6b5edae575200
-
Filesize
495KB
MD5bc97bcf8dd4f7a5a6bf5ff093cad5f37
SHA1026e094dee541cd465d0e07b32ccdfd6b1f85cb7
SHA2564cae15ba01d4a21bcd4ce7a390cd58fd8a325c19ee9069adcc474b97d186535e
SHA5127373f5c72e9135c70f57db86e940b28e95e51cf57ecb34fe6b5ebf9b8328bec122c3c1d88635906e6c519afaeb3c276d9b3f6a4d50fe018c7a8f83e053f29dcc