sova | dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165

Resubmissions

14-02-2024 07:37

240214-jfx3zaea42 10

10-09-2021 11:39

210910-nsawesdbcl 10

Analysis

max time kernel
17s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20231215-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20231215-enlocale:en-usos:android-11-x64system
submitted
14-02-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165.apk
Size

2.9MB
MD5

1698651d6b8fd95574f62b046b4f68e5
SHA1

ed0558bbfd7929cb4a28d6b095f68f26fcea4370
SHA256

dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165
SHA512

74d932cda56d661ade9dbf4ebcb0c092bee262a5475eded9b98010d00a97cbb6dc2083948e6ca568b238c1a801e52f096df35daa76160bfa8683bab41eb046a9
SSDEEP

49152:l3rn6XGN9GpBBCY2MTUf0JRBvZY5AN1dtX1Oqasd09Iqufd9BBT8AIubi0DEZKzG:l3D9kBBD24UgbG2brX1wsd0qfr7T8Aot

Score

10^/10

sova banker infostealer stealth trojan

Malware Config

Signatures

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.clqg.sbtkqsb.ixrooga
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.clqg.sbtkqsb.ixrooga

Removes its main activity from the application launcher 1 IoCs

stealth trojan

pid	Process
4628	com.clqg.sbtkqsb.ixrooga

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/base.apk.classes1.zip	4628	com.clqg.sbtkqsb.ixrooga

Requests enabling of the accessibility settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.ACCESSIBILITY_SETTINGS	com.clqg.sbtkqsb.ixrooga

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.clqg.sbtkqsb.ixrooga

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
25	api.ipify.org

com.clqg.sbtkqsb.ixrooga
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Acquires the wake lock
PID:4628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/base.apk.classes1.zip

Filesize
1.8MB

MD5
3a37d9161a5fb141a103d43cea7ea958

SHA1
e579b581976eb284771c3c8736326e2380e74656

SHA256
2c8f41711f9c4f661f1fd8f7f28d347fc4ee0ff587019fa1b5991db9523749b1

SHA512
2907fcf135a20559e0a7b67aa43db3df0531f3ea93eb2260f67eef78311da3839476e363c3375b61b55861eca8605f1ef4a0bab07338bb7e78f0c80c5b2021d9

Download Submit
/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/tmp-base.apk.classes8593887725730627612.zip

Filesize
847KB

MD5
871c68a6717989f1beecef87a19c5178

SHA1
28411a705e692cafab727c5a01891eaf99ea9733

SHA256
57065cf34ef357d85fdf6586dfc209e3cbdd716fb0be8bea053bc2e8fe26e18b

SHA512
edd8eb26e59b235d62a4bbcad1c02c7b7d22659d5c4bbfee5c303f44c9e5fb479fa4e1bf788fb37e61c83ef478113026eddc58e9493d3a44a928ccddaf5ab74d

Download Submit