Overview

overview

10

Static

static

6

sova.apk

android-9-x86

10

sova.apk

android-10-x64

10

sova.apk

android-11-x64

10

Analysis

  • max time kernel
    3677016s
  • max time network
    150s
  • platform
    android_x64
  • resource
    android-x64-20231215-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
  • submitted
    05/01/2024, 19:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sova.apk
  • Size 4.0MB
  • Sample240105-yf32jsafd2
  • SHA256 7c805f51ee3b2994e742d73954e51d7c2c24c76455b0b9a1b44d61cb4e280502
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
sovabankerinfostealertrojan

Malware Config

Signatures

  • SOVA_v5 payload 1 IoCs
  • Sova

    Android banker first seen in July 2021.

    bankertrojaninfostealersova
  • Makes use of the framework's Accessibility service 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Loads dropped Dex/Jar 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Acquires the wake lock 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • com.bean.cousin
    1⤵
    • Makes use of the framework's Accessibility service
    • Loads dropped Dex/Jar
    • Acquires the wake lock
    PID:4996

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CtaDwII.json
        • Path /data/data/com.bean.cousin/app_DynamicOptDex/CtaDwII.json
        • Size 2.2MB
        • SHA256 11b1cbdef463227d288271c05101ed180109d372d68fc924c29db43bf518922b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CtaDwII.json.cur.prof
        • Path /data/data/com.bean.cousin/app_DynamicOptDex/oat/CtaDwII.json.cur.prof
        • Size 4KB
        • SHA256 54918e683f6850b0de49dfc70c0021f510609b6450a4e50a767c2f9442843298
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CtaDwII.json.cur.prof
        • Path /data/data/com.bean.cousin/app_DynamicOptDex/oat/CtaDwII.json.cur.prof
        • Size 4KB
        • SHA256 6664a79bb3bdafc4015a2feada790e04325ad468701c4ebf803d24712f1492aa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb
        • Path /data/data/com.bean.cousin/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-journal
        • Path /data/data/com.bean.cousin/no_backup/androidx.work.workdb-journal
        • Size 512B
        • SHA256 3d5e404b909e4efbceaafd84e01c9787da7b1a033642961e9c8a1349ae64e330
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/data/com.bean.cousin/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.bean.cousin/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 6280fa256fced63511cedb993a5b977c7f5ab916e62cc87cb69b32aaeb3cb673
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        androidx.work.workdb-wal
        • Path /data/data/com.bean.cousin/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 92c7e91dfd54b071e89ba551f5301e3fdba3d7efa5d67e067bce30e997390fa5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CtaDwII.json
        • Path /data/user/0/com.bean.cousin/app_DynamicOptDex/CtaDwII.json
        • Size 6.0MB
        • SHA256 acd7234022738f4e8499749de805c474879fea06de0d7ca066483d03e7ef02f5
        • MD5 SHA1 SHA512 SSDEEP
        Download