sova | bcbabb9b07b4d8e4b592dfaf3c8e261b66896134121b576b17f069eaeaeaa01f

Resubmissions

08-03-2024 06:59

240308-hr38paaa23 10

27-03-2023 09:49

230327-lthxbacg65 10

Analysis

max time kernel
304s
max time network
313s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
08-03-2024 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GossApp.apk
Size

4.7MB
MD5

5cee458cb64d9c7a76783b571053adca
SHA1

b89773087c9796b8088cfc4271829dffa156b4bc
SHA256

bcbabb9b07b4d8e4b592dfaf3c8e261b66896134121b576b17f069eaeaeaa01f
SHA512

8ea6bff4e67afc35a52ea5dfdb58cdb2e7dc26073d4ddfd2cc4e9757b1e769e9dca0fc5b43c56325aa54b98655d3dfa4a302e883bc9ffd33135894c8c30647a6
SSDEEP

98304:Gwpw2RmWRq8ePkCcbBfowwD+6Qw+zJgT/gh002GD:G72Rb1eMCc4DiFdKa

Score

10^/10

sova banker collection evasion infostealer trojan

Malware Config

Extracted

Family

sova

http://85.217.144.114

http://85.217.144.115

Signatures

SOVA_v5 payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5043-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

Processes:

com.pulp.high

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pulp.high
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.pulp.high

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.pulp.high

ioc	pid	Process
/data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json	5043	com.pulp.high

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

Processes:

com.pulp.high

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.pulp.high

Acquires the wake lock 1 IoCs

Processes:

com.pulp.high

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pulp.high

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
6	ip-api.com

com.pulp.high
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Reads the contacts stored on the device.
- Acquires the wake lock
PID:5043

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pulp.high/app_DynamicOptDex/SjP.json

Filesize
499KB

MD5
a5a4e9aa6facb5aa734ac9cdf5938d78

SHA1
76735d203777dc7ea6bc4444e91b4544057b6cb2

SHA256
bbdb0165ce2f08456d389121e6098edfcaf6215c95972ccf82250e507ef3dfe4

SHA512
abcc388673bd0b74f73eea0e65fe7d3a89ef5a7c0a48a40db20a4d72b4b7bd42a26767fe7468beb65f816eeeca0bf81928e3f985f80578b109d036bde3c3b646

Download Submit
/data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof

Filesize
5KB

MD5
b8cc34bc16df820e6f1ef790597ec286

SHA1
377f68c52ba855af9d9a9498d7576792bc2a79ae

SHA256
13fe649a24bfd2d72008186dd73c34c33c5ddf7f054b77d7fdd8a2a323884cde

SHA512
90a5fb423545025761917ee01758e4db9bbfa792f261e20ccb3a5d16e9d6f1fb23f17cedcb705cb6a5a602b8ed4e402b13fd29c5144eea190571de534b6cf50f

Download Submit
/data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof

Filesize
5KB

MD5
85af9ac7bcb29eb611573c561f9f1e8b

SHA1
12695c8e5ddf2577d742f7eb9d821997880d4537

SHA256
af8d6497f2faa3171387c625864eafd871f319c1510b4359f0f1f8aaccf1b6c5

SHA512
00a3fad930197ea4f89fe17409b7f17847b67e5513187ae8f0f75a2c79b62ff5b9a0eda3be346d8b734917811eab112df3dd8c18c96681d93517a9a7503cff39

Download Submit
/data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof

Filesize
5KB

MD5
cffa5a8e5ff196c99617b2d9c73fcb24

SHA1
a83b62d47c2b16395e27dac0ada47a63e8050d69

SHA256
a12ba3145c590efd9aeae0be586206292ca9005b6741f308e06bc70c7e3827eb

SHA512
784e990cc29659c49b7b4481a0383d9efbaaec581c79f03498899a1dadc67043dd1c54d0a6f6cd934ad4dd9051a83b2318216f029a8a03a0053255565fe14118

Download Submit
/data/data/com.pulp.high/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.pulp.high/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
fff18e7e22912dcf62be28fdc5045f82

SHA1
54e5416371f35a49c30d2760fa2a7581415a59ff

SHA256
41cfc746d7ffa4cf97197707206327c6802114711691a02115d12d6aced74119

SHA512
9fdb7090dca95ab8482d2fc00413f3013d78cb6fbe0e2aa3787b80a44762d5826a274a419ac9acd930ae6b67996fbe64dd2dbe5c737c545de515c731b7cb5d19

Download Submit
/data/data/com.pulp.high/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.pulp.high/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
f4646bea245b359e2df341ef62d05b78

SHA1
b8528814f0d6db16862aa164ef25250144ad333a

SHA256
e82e7c27b7771a58cdc0970d749acdcc8b92404fdb017b136b81bca13a9279d5

SHA512
921e0adca4c328823c9dc434a401c5565e4bd206780bbe03b3a5472f8cbed8becf164ec2970a987e96686528841447100ed90f863fbfeb3bdd458a2c99247fcc

Download Submit
/data/data/com.pulp.high/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
99293be22d3abd62181e67baa161ee06

SHA1
8b54a0c80d327a235b3298cdee37e167028e5ca9

SHA256
ee2f733b07a3e5e7f7a32dd98e52d5c664de6406411162d58290ad4bf35aa31d

SHA512
ab7c1ae7df09565f8dcc2a9be718aea80ebb0ff734e0c9c00e6888cbf9928b116d04ea084f64b4e4c1caf2f8211dbc440874af2c66e6849af65b12b4cf8aefbe

Download Submit
/data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json

Filesize
6.1MB

MD5
282078461929bd3e1a32d5d7b822c737

SHA1
61b8e90dec9e53b195de009ee21a3fef29b2ed64

SHA256
6832e8722db811e07879b8bba0d608017745d67a0174be5fd8506b030efc1a07

SHA512
c973cd5127a29f5dfae57d58180c7391031487870d16be4f772e5489edb5c5dff2a9e13247b59bbc2b2c9d1a749dbee470db300c8d6b01791ecef1a6ed8114c3

Download Submit