sova | 7c805f51ee3b2994e742d73954e51d7c2c24c76455b0b9a1b44d61cb4e280502

Analysis

max time kernel
2330676s
max time network
158s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
20-12-2023 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c805f51ee3b2994e742d73954e51d7c2c24c76455b0b9a1b44d61cb4e280502.apk
Size

4.0MB
MD5

74b8956dc35fd8a5eb2f7a5d313e60ca
SHA1

322bfcfc2f2cfcfb759bc61b021a498c1955937b
SHA256

7c805f51ee3b2994e742d73954e51d7c2c24c76455b0b9a1b44d61cb4e280502
SHA512

772e0ae703b9cb3bb62c490366023026845aa80d793211dbc95606795659f88fa58e510ab1fdb129ee01159560ae071312c9de98cbcdbf574b015a791a0960ac
SSDEEP

98304:zQEneeg1QRd7c43GVDssvvO9h9CwfLyEefawrQ:zQEnzg2RD2Vjgfzyzawk

Score

10^/10

sova banker infostealer trojan

Malware Config

Signatures

SOVA_v5 payload 1 IoCs

resource	yara_rule
behavioral2/memory/5081-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.bean.cousin
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.bean.cousin

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.bean.cousin/app_DynamicOptDex/CtaDwII.json	5081	com.bean.cousin

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.bean.cousin

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

com.bean.cousin
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:5081

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.bean.cousin/app_DynamicOptDex/CtaDwII.json

Filesize
2.2MB

MD5
c9ea4a96385657ebb6555b6d4d5eca0c

SHA1
5bae7c22a1bc9d4d0410a9a2a66056ebe00a7e93

SHA256
11b1cbdef463227d288271c05101ed180109d372d68fc924c29db43bf518922b

SHA512
e42bbc1ab5dcea9d0c54ff9ebf71919e97ec8ea49793e05179414a95a034f9108b709cbc52fd25c8a6f1d48d249b9d0bb59bfcabdac4f4853d0177ab3fdfce8c

Download Submit
/data/data/com.bean.cousin/app_DynamicOptDex/CtaDwII.json

Filesize
2.2MB

MD5
f7f7cdf82b7b6c72882a6172213d0aff

SHA1
c423b55cb32e1c04cc8cca01cddf1d1264ab8777

SHA256
f6776bddb6a62dfaabcdf46eb1d5e22374ba0cfbabc45915ba887637b2f28c71

SHA512
e496bd409bc49ecf86bf98ed6924bfc78caa0729cc7e8277f3e53534b4aa9daee504712f885f2c46c0ee60f7b8e9e8db7b3a4e9dc20292bf24d9e81c3a6a24b7

Download Submit
/data/data/com.bean.cousin/app_DynamicOptDex/oat/CtaDwII.json.cur.prof

Filesize
3KB

MD5
ca5ebd15d687d612909471bb66002aad

SHA1
4de06fb2e3ef7a98bc9cd9e9cfe8bac6909d65b1

SHA256
c9ae6ee25f768a5c31254644902925dae5cc44cbceef1288b232a6beb51f8985

SHA512
a9d4cf9477969ffe9e2b37633ef4d901264b719e6a977e660b0579bef93910ec482992d47559d15015ede53830bacdbb86a916bd0984cf215ea6809adc1b13e8

Download Submit
/data/data/com.bean.cousin/app_DynamicOptDex/oat/CtaDwII.json.cur.prof

Filesize
3KB

MD5
2785437d91b140f0a35238318b2146fc

SHA1
cc6e62f26a68c5474560c7d668ee176dba260ed3

SHA256
2239f907663c298b10a74275332fce9817063aebd5bd5b1279aa9f0928b33275

SHA512
5bfb5bd95adfdc5c172f620a107c86ab6e76fb1499cc247e8023ac8e7fdc186301e8cdacf5c3568c14b2b657966bf1c83a006c48676316e905e2bf80fd37ec9b

Download Submit
/data/data/com.bean.cousin/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.bean.cousin/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
667eafb0b8c0aa01a2574893e5cb158c

SHA1
be74c781048eeb5c6a354f2a4bcdc9ce7356b944

SHA256
8ef551cbcbbfaa26b9d099b79a2a9a7df015a48bdfa54d3a7b7ad35c7c08aade

SHA512
107add3aa87bce01728386552dd802c28657767be024b2f6aca77b7aee722a7637fd59d451e2d94874a043ecc4945de0d7021a504747187cf906bd01e007c92a

Download Submit
/data/data/com.bean.cousin/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.bean.cousin/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
c7d0ba103f3f9a6cd3d5f43e2546e04b

SHA1
8c691a18ab8c7542e345901de903e627568b9ca7

SHA256
8eada09a7cde58e53259672668e14bdc62ee15675279a050bd1bb9d82ee3ea67

SHA512
71143563541674a177f76f5ae8fdbe80b80492bbed144bc14ad2385bdcf3ada33fb4e3c1cf5974b53827717c3237dc3e44230d5c36034c586ecb953b20735caf

Download Submit
/data/data/com.bean.cousin/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
08b0d53297bf94d42fe2f6838915c966

SHA1
096e21f0736d1ea07f8683db28e5316ad16a6fa5

SHA256
fb3737644920dd27d8b66f4a914a0868e3cca1097285d90f104892ef43be0b55

SHA512
6fa616dc7f62b04ad6ca608335ca331645388d91be6fa992e2b3bc5c187ce5de69cb9b25ed0f0354e2db58c6d9a83310d2af714e1d0d2c479faf203d2322c3d6

Download Submit
/data/data/com.bean.cousin/no_backup/androidx.work.workdb-wal

Filesize
156KB

MD5
b709b3722ad0e095eb5d12c1dce90993

SHA1
c76166c51d576bdd23d9c27367865c962ecddd61

SHA256
6d9f7da80cd7e38b73cf44f991bc55269dde1756c5665ceec83905e3a43cbf74

SHA512
16cc0d74a939879b9573c1f1136bb7f63eb1fc591bd321f75303271fb7aa8560f67a00bb4bf67943037b003345cc88f5fc68a40a4edc39bb5eb5621b49712709

Download Submit
/data/user/0/com.bean.cousin/app_DynamicOptDex/CtaDwII.json

Filesize
6.0MB

MD5
cb83525904c2bff0cb586d662c5fe2b9

SHA1
2d63ff2e85b34006a5517f85deb470ff48734df5

SHA256
acd7234022738f4e8499749de805c474879fea06de0d7ca066483d03e7ef02f5

SHA512
33eced5d3bead49bb238f08bac960044c7359262fdd58ab559cb38c47528859e24f8578e32743ba6a1630ce7e45497c9f99edb0b96c5c8fa6c0a4ca7fb15fd3e

Download Submit