Analysis
- max time kernel
2296471s - max time network
146s - platform
android_x64 - resource
android-x64-arm64-20231215-en - resource tags
- submitted
19/12/2023, 23:34
General
- Target 6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1.apk
- Size 3.4MB
- Sample231219-3kgfkabff7
- SHA256 6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1
Score
10/10
Malware Config
Signatures
- Sova
Android banker first seen in July 2021.
- Sova payload 1 IoCs
- Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
- Acquires the wake lock 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
com.wjyfqwzhu.fbqipukbm1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
tmp-base.apk.j6jU8Ug1247314185032881485.gdf
base.apk.j6jU8Ug1.gdf