Analysis
-
max time kernel
10s -
max time network
122s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
14-02-2024 07:37
General
-
Target
dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165.apk
-
Size
2.9MB
-
MD5
1698651d6b8fd95574f62b046b4f68e5
-
SHA1
ed0558bbfd7929cb4a28d6b095f68f26fcea4370
-
SHA256
dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165
-
SHA512
74d932cda56d661ade9dbf4ebcb0c092bee262a5475eded9b98010d00a97cbb6dc2083948e6ca568b238c1a801e52f096df35daa76160bfa8683bab41eb046a9
-
SSDEEP
49152:l3rn6XGN9GpBBCY2MTUf0JRBvZY5AN1dtX1Oqasd09Iqufd9BBT8AIubi0DEZKzG:l3D9kBBD24UgbG2brX1wsd0qfr7T8Aot
Malware Config
Signatures
-
Sova
Android banker first seen in July 2021.
-
Removes its main activity from the application launcher 1 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Requests enabling of the accessibility settings. 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
com.clqg.sbtkqsb.ixrooga1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests enabling of the accessibility settings.
- Acquires the wake lock
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.clqg.sbtkqsb.ixrooga/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
847KB
MD5871c68a6717989f1beecef87a19c5178
SHA128411a705e692cafab727c5a01891eaf99ea9733
SHA25657065cf34ef357d85fdf6586dfc209e3cbdd716fb0be8bea053bc2e8fe26e18b
SHA512edd8eb26e59b235d62a4bbcad1c02c7b7d22659d5c4bbfee5c303f44c9e5fb479fa4e1bf788fb37e61c83ef478113026eddc58e9493d3a44a928ccddaf5ab74d
-
Filesize
1.8MB
MD56f214c6194a031ff3bd47cadd3f808ae
SHA1046ee3fd704af1bab0f634091e11b66955f22860
SHA25651cf587fdabe9d66dc4567e5e749916e741f5d81cb388b6df00148a849ad98ae
SHA51249e9b0d3ebe4a305dab53207f640ea3d5f3a621bb1ee7a263da6420234404f4a9e2afd7ed7f52b2331dc2e937dfd2dcf7216245dcda4c12c14fbacd92aeeed9b
-
Filesize
1.8MB
MD53a37d9161a5fb141a103d43cea7ea958
SHA1e579b581976eb284771c3c8736326e2380e74656
SHA2562c8f41711f9c4f661f1fd8f7f28d347fc4ee0ff587019fa1b5991db9523749b1
SHA5122907fcf135a20559e0a7b67aa43db3df0531f3ea93eb2260f67eef78311da3839476e363c3375b61b55861eca8605f1ef4a0bab07338bb7e78f0c80c5b2021d9