sova | bcbabb9b07b4d8e4b592dfaf3c8e261b66896134121b576b17f069eaeaeaa01f

Resubmissions

08-03-2024 06:59

240308-hr38paaa23 10

27-03-2023 09:49

230327-lthxbacg65 10

Analysis

max time kernel
300s
max time network
310s
platform
android_x64
resource
android-33-x64-arm64-20240229-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
submitted
08-03-2024 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GossApp.apk
Size

4.7MB
MD5

5cee458cb64d9c7a76783b571053adca
SHA1

b89773087c9796b8088cfc4271829dffa156b4bc
SHA256

bcbabb9b07b4d8e4b592dfaf3c8e261b66896134121b576b17f069eaeaeaa01f
SHA512

8ea6bff4e67afc35a52ea5dfdb58cdb2e7dc26073d4ddfd2cc4e9757b1e769e9dca0fc5b43c56325aa54b98655d3dfa4a302e883bc9ffd33135894c8c30647a6
SSDEEP

98304:Gwpw2RmWRq8ePkCcbBfowwD+6Qw+zJgT/gh002GD:G72Rb1eMCc4DiFdKa

Score

10^/10

sova banker collection evasion infostealer trojan

Malware Config

Extracted

Family

sova

http://85.217.144.114

http://85.217.144.115

Signatures

SOVA_v5 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4284-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pulp.high
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.pulp.high

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json	4284	com.pulp.high

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.pulp.high

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pulp.high

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.pulp.high

com.pulp.high
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Reads the contacts stored on the device.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4284

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pulp.high/app_DynamicOptDex/SjP.json

Filesize
1.9MB

MD5
fa38f343e0e1accbbae962536353d7ab

SHA1
c3ae14aa9ce3fd637e22d326e3126313d7f383ab

SHA256
5a39f979d2f10622139e271908f474fc750a5ca548b1ecc50a020c27ff6dc4c2

SHA512
40253b5f640de3df595d085bf59cedc61eca13b3532d595c48f1bc8cf92beab6471c301e2d8ecd5e7282dff887dfdd6d7facaddcce1f2c11af7f380bc918b066

Download Submit
/data/data/com.pulp.high/app_DynamicOptDex/SjP.json

Filesize
2.2MB

MD5
17f313ce36446626bdc5ac9d7d12f2c5

SHA1
e04f6236b2888dd711f00e2f2a92bce50098e428

SHA256
6137ead111797d23124ee7088015d0961c07cb0f15c05b2008fbb417bc522635

SHA512
ff7e878391587aab6472ad0b6d239f8716a1f9d20e58301695417aef8752fd77dda5598d57fa1810174fe150eee733d26ff44a121b93bda5e3894263eb536230

Download Submit
/data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof

Filesize
4KB

MD5
dd14bffa9f76541e268205835f958528

SHA1
d8e72608779ee9df4439ef7c93fdc308f31b55b7

SHA256
ef3e75002e55f9e96f0ea692a8c789f26ad75a407fed60f737a8bdc63bc7136f

SHA512
3028dc59aaabf67793fe457186ba431c2efb357211966a481b442d49bb770ee77e5ea0495c7063d747bc3f8ecc271801eeb4b65920719a166e637dc7200bd798

Download Submit
/data/data/com.pulp.high/app_DynamicOptDex/oat/x86_64/SjP.vdex

Filesize
113KB

MD5
80924678d4e2b170af20d1e3600d074b

SHA1
85c116fce36ac73cd8034b3889f504dcff44f876

SHA256
a28c4d459271d70240a85dbf22ab58b89dec753ab3605fc7d1cbfa66b7ac11f0

SHA512
8a88c5875a7cad9a2cd534206b9a25f3476dba9edb1f418697c6c68c7b33ecff84527a9bada254a2c0f4b85b32d03fba0a51e49dc3eae2b7ccd2fe120fa696da

Download Submit
/data/data/com.pulp.high/no_backup/androidx.work.workdb

Filesize
4KB

MD5
0eb157e1a86d4d00aa601dd2f6ff3ee3

SHA1
fee434f784e73cc7916322e949f727caf8363102

SHA256
b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4

SHA512
b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8

Download Submit
/data/data/com.pulp.high/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
7beb62c70b8573b9a8092e17da5f4485

SHA1
aac68f757afafd5b88b792f8a4b16d0eb1afa417

SHA256
03b5c6a8e9e6c160538c5cd703139e8ce43ef7b5c1c10ef6e670f4a95f7eae82

SHA512
644ecec8ce7621d1c57534177344db18ffeb569336e4621ec08e56f46066b92879205c90123caa059473768e6f59c2c6d5ad652b3724ba1727389cb1cf75d51c

Download Submit
/data/data/com.pulp.high/no_backup/androidx.work.workdb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.pulp.high/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
6262f5d94047d62cd7e7fd99c2968ee6

SHA1
6488ccbccabda657bb68627032542cd640abeab8

SHA256
2cfc3f772065ad36d6d93edcb6c7f49835fa0f6b4d760130539384bf992f7144

SHA512
e8d3e970e6b14ce09f797c2bfa16dd0fa49b37a01f55d8c30e7fbce2246f0370c7622a85a7de2638821149e00f8a02818c9a28621efae4da45c704cca8c958cb

Download Submit
/data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json

Filesize
6.1MB

MD5
282078461929bd3e1a32d5d7b822c737

SHA1
61b8e90dec9e53b195de009ee21a3fef29b2ed64

SHA256
6832e8722db811e07879b8bba0d608017745d67a0174be5fd8506b030efc1a07

SHA512
c973cd5127a29f5dfae57d58180c7391031487870d16be4f772e5489edb5c5dff2a9e13247b59bbc2b2c9d1a749dbee470db300c8d6b01791ecef1a6ed8114c3

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads