sova | dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165

Resubmissions

14-02-2024 07:37

240214-jfx3zaea42 10

10-09-2021 11:39

210910-nsawesdbcl 10

Analysis

max time kernel
8s
max time network
132s
platform
android_x64
resource
android-x64-20231215-en
resource tags

androidarch:x64arch:x86image:android-x64-20231215-enlocale:en-usos:android-10-x64system
submitted
14-02-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165.apk
Size

2.9MB
MD5

1698651d6b8fd95574f62b046b4f68e5
SHA1

ed0558bbfd7929cb4a28d6b095f68f26fcea4370
SHA256

dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165
SHA512

74d932cda56d661ade9dbf4ebcb0c092bee262a5475eded9b98010d00a97cbb6dc2083948e6ca568b238c1a801e52f096df35daa76160bfa8683bab41eb046a9
SSDEEP

49152:l3rn6XGN9GpBBCY2MTUf0JRBvZY5AN1dtX1Oqasd09Iqufd9BBT8AIubi0DEZKzG:l3D9kBBD24UgbG2brX1wsd0qfr7T8Aot

Score

10^/10

sova banker infostealer stealth trojan

Malware Config

Signatures

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
5062	com.clqg.sbtkqsb.ixrooga

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/base.apk.classes1.zip	5062	com.clqg.sbtkqsb.ixrooga

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.clqg.sbtkqsb.ixrooga

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org
7	api.ipify.org

com.clqg.sbtkqsb.ixrooga
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:5062

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/tmp-base.apk.classes6835644810084602096.zip

Filesize
474KB

MD5
863658d76b6bc2e2debe638c3120e526

SHA1
5cb3f32dfe8512da8d17eb4c4397a2b13c3b7979

SHA256
7bbe12635ead752a551d9eb9b7d149cdd67c774621880c6cb8b4e514144d3463

SHA512
f2b825a75f4333363b5e396298a13968fdb4284463b0bcec1706fd65889132be1fe6183c229c1c9c764055e5d394becc497671f0b66a827b7132d0fed240dce4

Download Submit
/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
1.8MB

MD5
3a37d9161a5fb141a103d43cea7ea958

SHA1
e579b581976eb284771c3c8736326e2380e74656

SHA256
2c8f41711f9c4f661f1fd8f7f28d347fc4ee0ff587019fa1b5991db9523749b1

SHA512
2907fcf135a20559e0a7b67aa43db3df0531f3ea93eb2260f67eef78311da3839476e363c3375b61b55861eca8605f1ef4a0bab07338bb7e78f0c80c5b2021d9

Download Submit