8a6889610a18296e812fabd0a4ceb8b75caadc5cec1b39e8173c3e0093fd3a57

Resubmissions

24/04/2024, 11:50

240424-nzl72ahe3w10

12/04/2024, 13:59

28/02/2024, 13:25

28/02/2024, 13:01

28/02/2024, 12:56

19/02/2024, 08:01

03/01/2024, 08:46

Analysis

max time kernel
3464605s
max time network
32s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
03/01/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sova.apk
Size 569KB
Sample240103-kpajpscdcp
SHA256 8a6889610a18296e812fabd0a4ceb8b75caadc5cec1b39e8173c3e0093fd3a57
MD5 01b6f0220794476fe19a54c049600ab3
SHA1 eb9dfde47a393bca666e947f285f16c20baf6c32
SHA512 ac3031a6dbc5bb0d1e609979336487f14efe58f8e87480e5ef7f79c2abae56977ca444bbb5bbc7970d9c416f9c754b9fedf2bdef3b7b311c2e95e07350f9c892
SSDEEP 12288:C89uYjYV1jiNQ7l5DFQo2d8GmEFDipRdWp8+iZiZ5t:9jYniCF6d8iiXg825t
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

stealth trojan

Malware Config

Signatures

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.adobe.flashplayer
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.adobe.flashplayer

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4496	com.adobe.flashplayer

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.adobe.flashplayer

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.adobe.flashplayer

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api.ipify.org
33	api.ipify.org

com.adobe.flashplayer
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Requests enabling of the accessibility settings.
- Acquires the wake lock
PID:4496

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads