General
- Target dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165.apk
- Size 2.9MB
- Sample240214-jfx3zaea42
- SHA256 dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165
Score
10/10
Malware Config
Targets
-
- Target dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165.apk
- Size 2.9MB
- SHA256 dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165
Score10/10-
Sova
Android banker first seen in July 2021.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher
-
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings.
-
Acquires the wake lock
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target vk_dex.apk
- Size 106KB
- SHA256 da37cf4de83a645e1b3241879abe4a9e1a2fdb8a5e3f8bbe634509ac660a480d
Score1/10