Analysis
-
max time kernel
2296471s -
max time network
146s -
platform
android_x64 -
resource
android-x64-arm64-20231215-en -
resource tags
-
submitted
19-12-2023 23:34
General
-
Target
6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1.apk
-
Size
3.4MB
-
MD5
c9ddaa4d670c262bf2621b8299ccf84e
-
SHA1
8773fe52563b9aa22909e53671d99d1277427f87
-
SHA256
6d1566ffd1f60ed64b798ca1eea093982c43e1e88c096bc69dd98e0fd5c1c2d1
-
SHA512
786e56c8011f179f96b489b7ad8f97185194ae3221f108ca5badb6aef3007d2f54ab3dd3ac4c43290b8dca0cfacb9d4387c7dd8099823a4fdf1b54069abd77f9
-
SSDEEP
98304:hJJ7q4BP+NGHd/UMZ7VvJlptaqnQuT/cVSIzqh4mUhkB82+:h3XBPaYblzlpzQG7ph4W82+
Malware Config
Signatures
-
Sova
Android banker first seen in July 2021.
-
Sova payload 1 IoCs
-
Makes use of the framework's Accessibility service 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
com.wjyfqwzhu.fbqipukbm1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD57133001d32a5bec9f4c7f2cc280ecde0
SHA129a40fef0951d246495b5f7b8f2e73122d578536
SHA25649de204d6579c1827f14f9ca6932531fbe03979992994fa3d1dd3d1541f8fc56
SHA512200b1c744eba67e349e3efc44446a4e9311872e0806613f24a2a52988171caa3c38b28715d6ac449e6a8ca77b627092ebde4054f862fdcd4f41f6599b52e4413
-
Filesize
495KB
MD5bc97bcf8dd4f7a5a6bf5ff093cad5f37
SHA1026e094dee541cd465d0e07b32ccdfd6b1f85cb7
SHA2564cae15ba01d4a21bcd4ce7a390cd58fd8a325c19ee9069adcc474b97d186535e
SHA5127373f5c72e9135c70f57db86e940b28e95e51cf57ecb34fe6b5ebf9b8328bec122c3c1d88635906e6c519afaeb3c276d9b3f6a4d50fe018c7a8f83e053f29dcc