sova | bcbabb9b07b4d8e4b592dfaf3c8e261b66896134121b576b17f069eaeaeaa01f

Resubmissions

08/03/2024, 06:59

240308-hr38paaa2310

27/03/2023, 09:49

230327-lthxbacg6510

Analysis

max time kernel
304s
max time network
313s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
08/03/2024, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GossApp.apk
Size 4.7MB
Sample240308-hr38paaa23
SHA256 bcbabb9b07b4d8e4b592dfaf3c8e261b66896134121b576b17f069eaeaeaa01f
MD5 5cee458cb64d9c7a76783b571053adca
SHA1 b89773087c9796b8088cfc4271829dffa156b4bc
SHA512 8ea6bff4e67afc35a52ea5dfdb58cdb2e7dc26073d4ddfd2cc4e9757b1e769e9dca0fc5b43c56325aa54b98655d3dfa4a302e883bc9ffd33135894c8c30647a6
SSDEEP 98304:Gwpw2RmWRq8ePkCcbBfowwD+6Qw+zJgT/gh002GD:G72Rb1eMCc4DiFdKa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sova banker collection evasion infostealer trojan

Malware Config

Extracted

Family

sova

http://85.217.144.114
http://85.217.144.115

Signatures

SOVA_v5 payload 1 IoCs

resource	yara_rule
behavioral1/memory/5043-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pulp.high
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.pulp.high

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json	5043	com.pulp.high

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.pulp.high

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pulp.high

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

com.pulp.high
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Reads the contacts stored on the device.
- Acquires the wake lock
PID:5043

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

SjP.json

Path /data/data/com.pulp.high/app_DynamicOptDex/SjP.json
Size 499KB
SHA256 bbdb0165ce2f08456d389121e6098edfcaf6215c95972ccf82250e507ef3dfe4
MD5 a5a4e9aa6facb5aa734ac9cdf5938d78
SHA1 76735d203777dc7ea6bc4444e91b4544057b6cb2
SHA512 abcc388673bd0b74f73eea0e65fe7d3a89ef5a7c0a48a40db20a4d72b4b7bd42a26767fe7468beb65f816eeeca0bf81928e3f985f80578b109d036bde3c3b646
SSDEEP 12288:8VxYCfaq4YoFNGsS10FwVwtYxF16b4saspRGVf392vWN2V:ArahGsS6KdAkDVfN2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjP.json.cur.prof

Path /data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof
Size 5KB
SHA256 13fe649a24bfd2d72008186dd73c34c33c5ddf7f054b77d7fdd8a2a323884cde
MD5 b8cc34bc16df820e6f1ef790597ec286
SHA1 377f68c52ba855af9d9a9498d7576792bc2a79ae
SHA512 90a5fb423545025761917ee01758e4db9bbfa792f261e20ccb3a5d16e9d6f1fb23f17cedcb705cb6a5a602b8ed4e402b13fd29c5144eea190571de534b6cf50f
SSDEEP 96:Ph7VkOL/OIZZJR7IUZpwop+UY3fi8uCNi72wPpzuQSbT0xt0b3DzBfItDInuT:57Vk8/OGZJHLCUY68uwfX0xt0zDuyn2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjP.json.cur.prof

Path /data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof
Size 5KB
SHA256 af8d6497f2faa3171387c625864eafd871f319c1510b4359f0f1f8aaccf1b6c5
MD5 85af9ac7bcb29eb611573c561f9f1e8b
SHA1 12695c8e5ddf2577d742f7eb9d821997880d4537
SHA512 00a3fad930197ea4f89fe17409b7f17847b67e5513187ae8f0f75a2c79b62ff5b9a0eda3be346d8b734917811eab112df3dd8c18c96681d93517a9a7503cff39
SSDEEP 96:5FLmJpPollXgJ3AcabQplf794uMc387gQmJDwuaq+LGYgsexICGqnCCbad1U:DwppQciK87NmFwq+L/eUPm
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjP.json.cur.prof

Path /data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof
Size 5KB
SHA256 a12ba3145c590efd9aeae0be586206292ca9005b6741f308e06bc70c7e3827eb
MD5 cffa5a8e5ff196c99617b2d9c73fcb24
SHA1 a83b62d47c2b16395e27dac0ada47a63e8050d69
SHA512 784e990cc29659c49b7b4481a0383d9efbaaec581c79f03498899a1dadc67043dd1c54d0a6f6cd934ad4dd9051a83b2318216f029a8a03a0053255565fe14118
SSDEEP 96:KkwWC81UNqsBG9UA5EWGGmiCbE8/2T4RiXJyuieHQ5oupkbsR5x5LPgA3/PRRP:rjUNqsBUU+XZK/2TgEJDfHYomTnPgA3L
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 41cfc746d7ffa4cf97197707206327c6802114711691a02115d12d6aced74119
MD5 fff18e7e22912dcf62be28fdc5045f82
SHA1 54e5416371f35a49c30d2760fa2a7581415a59ff
SHA512 9fdb7090dca95ab8482d2fc00413f3013d78cb6fbe0e2aa3787b80a44762d5826a274a419ac9acd930ae6b67996fbe64dd2dbe5c737c545de515c731b7cb5d19
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 e82e7c27b7771a58cdc0970d749acdcc8b92404fdb017b136b81bca13a9279d5
MD5 f4646bea245b359e2df341ef62d05b78
SHA1 b8528814f0d6db16862aa164ef25250144ad333a
SHA512 921e0adca4c328823c9dc434a401c5565e4bd206780bbe03b3a5472f8cbed8becf164ec2970a987e96686528841447100ed90f863fbfeb3bdd458a2c99247fcc
SSDEEP 6:KIa7u8Dl9FZdrlOERX4PBX4ogLugMBX4suuK+/Ct4erTpXTdTDOw2:KIaS8DTzdTRmBEyPbP/CtHr/Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 ee2f733b07a3e5e7f7a32dd98e52d5c664de6406411162d58290ad4bf35aa31d
MD5 99293be22d3abd62181e67baa161ee06
SHA1 8b54a0c80d327a235b3298cdee37e167028e5ca9
SHA512 ab7c1ae7df09565f8dcc2a9be718aea80ebb0ff734e0c9c00e6888cbf9928b116d04ea084f64b4e4c1caf2f8211dbc440874af2c66e6849af65b12b4cf8aefbe
SSDEEP 48:u8a49Y66M/31pp8aEKeWrFhVtD/ymmumWAhrBlOymdGWOWKuWov6xl73JcXSMmca:76+hdjnHtDRMpf8UzS6+BD8q0ExP1zs
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjP.json

Path /data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json
Size 6.1MB
SHA256 6832e8722db811e07879b8bba0d608017745d67a0174be5fd8506b030efc1a07
MD5 282078461929bd3e1a32d5d7b822c737
SHA1 61b8e90dec9e53b195de009ee21a3fef29b2ed64
SHA512 c973cd5127a29f5dfae57d58180c7391031487870d16be4f772e5489edb5c5dff2a9e13247b59bbc2b2c9d1a749dbee470db300c8d6b01791ecef1a6ed8114c3
SSDEEP 98304:yogF9K62GMcyNxAlWyVRQjd1HGUn6WezO:youR3QjdlGa6VO
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads