sova | bcbabb9b07b4d8e4b592dfaf3c8e261b66896134121b576b17f069eaeaeaa01f

Resubmissions

08/03/2024, 06:59

240308-hr38paaa2310

27/03/2023, 09:49

230327-lthxbacg6510

Analysis

max time kernel
300s
max time network
309s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
08/03/2024, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GossApp.apk
Size 4.7MB
Sample240308-hr38paaa23
SHA256 bcbabb9b07b4d8e4b592dfaf3c8e261b66896134121b576b17f069eaeaeaa01f
MD5 5cee458cb64d9c7a76783b571053adca
SHA1 b89773087c9796b8088cfc4271829dffa156b4bc
SHA512 8ea6bff4e67afc35a52ea5dfdb58cdb2e7dc26073d4ddfd2cc4e9757b1e769e9dca0fc5b43c56325aa54b98655d3dfa4a302e883bc9ffd33135894c8c30647a6
SSDEEP 98304:Gwpw2RmWRq8ePkCcbBfowwD+6Qw+zJgT/gh002GD:G72Rb1eMCc4DiFdKa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sova banker collection evasion infostealer stealth trojan

Malware Config

Extracted

Family

sova

http://85.217.144.114
http://85.217.144.115

Signatures

SOVA_v5 payload 2 IoCs

resource	yara_rule
behavioral4/memory/4305-0.dex	family_sova_v5
behavioral4/memory/4277-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.pulp.high
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.pulp.high

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4277	com.pulp.high
4277	com.pulp.high

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json	4305	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pulp.high/app_DynamicOptDex/oat/x86/SjP.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json	4277	com.pulp.high

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.pulp.high

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.pulp.high

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.pulp.high

com.pulp.high
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the contacts stored on the device.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4277
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.pulp.high/app_DynamicOptDex/oat/x86/SjP.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4305

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

SjP.json

Path /data/data/com.pulp.high/app_DynamicOptDex/SjP.json
Size 2.2MB
SHA256 c2c885c6181e300e48b63da3087f6d1bf5031f39fc8f519147d25e5f829d5516
MD5 3b6bd6be37bf8b85ea8062cbdc5794de
SHA1 a1cdc1bfb25bd9b74e29000597f3c9eb5b6beb1f
SHA512 b5b01094fb759c5fdc45737111dd112157a3d47e57974d56db43b134ffab43c175ceb2eb70a35b2dce787a503b06e224a34a5e0271e49d111399b5c345875af8
SSDEEP 49152:fhG2KakDNBAQG0+psWeeA0pjAUrGZRf6DRu055:fU2oz22WeipjOffyXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjP.json

Path /data/data/com.pulp.high/app_DynamicOptDex/SjP.json
Size 2.2MB
SHA256 6137ead111797d23124ee7088015d0961c07cb0f15c05b2008fbb417bc522635
MD5 17f313ce36446626bdc5ac9d7d12f2c5
SHA1 e04f6236b2888dd711f00e2f2a92bce50098e428
SHA512 ff7e878391587aab6472ad0b6d239f8716a1f9d20e58301695417aef8752fd77dda5598d57fa1810174fe150eee733d26ff44a121b93bda5e3894263eb536230
SSDEEP 49152:W+lLwzt+0fcfAtKKQIRI03O5gcxigIw5S3LttsOoa7wVoiaC:W+lqfcqDQIV+5g4igImoxtsOoaa8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjP.json.cur.prof

Path /data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof
Size 2KB
SHA256 b917fd3674ea3c2cc88ca38d83434a44731132b808f448a524729171314414bc
MD5 8ac14dd52374163834cf746b414729a1
SHA1 f66af2d6223351617cfe5b390c05f92fd960ca52
SHA512 a58af52ac39552b18bf046ce3d9181463bf6dfd0750c3b9eed9da8c98e22fc9c154f6a66e004a8f4e526429898745a369d25179bc1bc6e68b35c1f55379a2eaf
MD5 SHA1 SHA512

Submit Download

SjP.json.cur.prof

Path /data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof
Size 2KB
SHA256 908e3d3f3b042cdff12d25367ac81d39cea0f1aabf40fd9b739ecd8855559991
MD5 f1cd9c2b6d2895b5dcbf6cd41716666b
SHA1 810b9333d2a8f5da2fc601905359b3bef3af1a20
SHA512 9afe05f9c6d8bfa53fa4256ecca2f455b748c48e9dfaf76c464de78323691408930b5a32ed61a982c12f72896930110be29c33df6002c4b5f0dddaa5a97e27ca
MD5 SHA1 SHA512

Submit Download

SjP.json.cur.prof

Path /data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof
Size 2KB
SHA256 814577a798314ca3a9ea338ba9f0571a1a53b22833db197a9c2f5ff297648446
MD5 0727065f808bb0dbf7f189f4d998adf9
SHA1 c8daad8a517b3beb4f5649893b01abcbde9fb1cd
SHA512 0e098b1362bfe2fa647dd4f0bcf551ebe530ec05fe541c1e79f814a03238577cc991206031e9fe792c98bd2f4d85e62d57666a328281739a6a458cd1ee718420
MD5 SHA1 SHA512

Submit Download

SjP.json.cur.prof

Path /data/data/com.pulp.high/app_DynamicOptDex/oat/SjP.json.cur.prof
Size 2KB
SHA256 cb699e099828802d598696e2f66a782a443aebbbc4c204dd8bf72e54474a3c44
MD5 c62b52204f642dfe65cbcb041ce06078
SHA1 3518d6a8649a1b9584ad5848aababb41974250bc
SHA512 e0488e6207b8b49c2181fa03c9e47b7c33ccf309158f5e5281fe8d6a41912f03e20d897889cf1699b65fcf9132749a5fb99f0ab1bad98ea5371db9969c5ce070
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 7807160ae3ab2e5ecc19dafe4a6e4adc0d26734a701ebf4cb528434fb6781434
MD5 c5d953e413eb65877b73768a06c5e38b
SHA1 d68c488aaf56573142a626ce95dc069fa9b87329
SHA512 556cb2846e87fa8ef040e43c8c9a5f89ae9b40f4dae46ebc6e8efb8aa7fd6dea5a995a1076c8c9886dffc5b31e2c260c75f1953f720d9c8796a604cb101f2c45
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 7eb3640af7f07ffb61067da674f8973ba187dd8a0c70aad5efa766e6181b3d23
MD5 bca9d32e534a928fb96bad932e692fa8
SHA1 316d53a8cdd2101ff0c608b9c59a13b915c66f46
SHA512 2405603d119e65cfa0b34e67af52aea4a303875c7fda3d966968602bc7e0e9dad38b89eb6f989d39e51c60b8a2d34eaed121c6d516c8e05bc169478f12677257
SSDEEP 96:F6+hdjnHtDRMpf8UzS6+BD8q0ExP53kBBU:JdjnHt9Mpf8UzS6+BD8q0E5pwBU
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb-wal
Size 156KB
SHA256 c24e993197067c004f7686c70b039daef5083a2061b96df1ff9728c14a32827a
MD5 2dd2b57991f5fad22cc52187085717c8
SHA1 e8d6a2432f22b94b0888ce417210eeb87c44c362
SHA512 cbbb9e20857b3420c2c403440739de3ae078168d2b06aa8d4099061c5da6a11ed9f90497ce3d6f66af3e4598c7a4debde3044a3b82df02dee9153d65b0d85d15
SSDEEP 12:P8mXtkmIpPyA2inhtMXrXDRod3fIpPyv0b0XdO1ZEPb2ivIpPyvDc2ivIpPyvt3P:PllAttY0sAX4GhghHuZH430AttYAr9f
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.pulp.high/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 bb6498eb7892400c84b0e2101a0c68e976bff66c667f0de6cda82fedd7584b12
MD5 811717eb2e81d3c4431c872424e1830f
SHA1 b2126c7745e4de9300fad3d8ad96a1eeb080db1d
SHA512 777132595d957d521e56fc1c7af8e925c8430b8d3956dc774cc19933f2c80cbb41efc31886b95a9d00e1f1369e681783cdb0e9ec0189313250d955217e84ec6f
SSDEEP 6:K2CgH5zQg9FZdrlOERX4PBX4ogLugMBX4suuK+/3QOX0U4tJFrtkTOw2:K25zlzdTRmBEyPbP/Au0U4COw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjP.json

Path /data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json
Size 6.1MB
SHA256 009e048ee999b81d70156045b122927ee4f78d2d408f60eaf0d43b674d026d2b
MD5 7abdd291fd926bcfca1dbfbe9e6d2809
SHA1 776883386dde6515f84bae2a221a89c91b5ffc7e
SHA512 340a19bb6ccc9b39df85663a483430d61ef904d6ff4b5790b7234c23a66b4695fdfbba3daf0d3895643cc72eb0af2f024f4d435020986b22ab65acf032a04e81
SSDEEP 98304:yogF9K62GMcyNxAlWyVRQjd1eCu4HpezO:youR3Qjd8CuiWO
MD5 SHA1 SHA512 SSDEEP

Download

SjP.json

Path /data/user/0/com.pulp.high/app_DynamicOptDex/SjP.json
Size 5.3MB
SHA256 a2d1bdccde35c5bf837cd0ecd37e4b420934286ac8071d4c7c1d7086049ddb07
MD5 134396a8b1e9ecb3dfec1798ab6a3f44
SHA1 1c59c9d5a69ca01630bb34951b3875c37d86c789
SHA512 8936845a4de6326bffbc777f00c4543ed344652f55a3522c57d3e180d51f0b69a1315ddaca72321c903910b07b6d8d538456eda014fa0fd9d0d64afe06d6de96
SSDEEP 49152:yodcBRZjGeBTK6222e42tbMcyNxAN88puTEWLqpBVRQjl0rFry1bbHmUCrnuF:yogF9K62GMcyNxAlWyVRQjd1HGUnF
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads