sova | 0c78489423101d08e47d67ab467a45edacf84ea46ef1f7c0370084dc7a956867

Resubmissions

08/04/2024, 12:28

240408-pnlb2acd6t10

08/03/2024, 09:07

240308-k3bc6abc6910

23/03/2023, 01:50

230323-b89y8scg8210

Analysis

max time kernel
64s
max time network
139s
platform
android_x64
resource
android-33-x64-arm64-20240229-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240229-enlocale:en-usos:android-13-x64system
submitted
08/03/2024, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4.apk
Size 4.6MB
Sample240308-k3bc6abc69
SHA256 376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4
MD5 d4c6871dbd078685cb138a499113d280
SHA1 60b64c8481f9de5b92634efc70a9ff42f451c78f
SHA512 e8823b7c73140af88ad6fd8c52a6619d245281170ddb31feb9d4e726ee47a8f34575f687048947272fabfb13dbed2c24f50d6fbd6117d40c1db577305955af59
SSDEEP 98304:M0C+HR25SOeU0lhoBenZFOw2QxW74PNTcG/bZ7vf0sc:jCmtO/07oEOw2QU74PNT9/t7nc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sova banker collection evasion infostealer trojan

Malware Config

Extracted

Family

sova

http://193.42.32.84/
http://193.42.32.87/

Signatures

SOVA_v5 payload 1 IoCs

resource	yara_rule
behavioral3/memory/4288-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.help.marine
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.help.marine

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.help.marine/app_DynamicOptDex/nx.json	4288	com.help.marine

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.help.marine

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.help.marine

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ip-api.com

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.help.marine

com.help.marine
1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Reads the contacts stored on the device.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4288

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

nx.json

Path /data/data/com.help.marine/app_DynamicOptDex/nx.json
Size 2.0MB
SHA256 8de419336106908cb4e8b8bd2a274e1e4fb2548b5b8c5f246bbbb498d5d4c0d7
MD5 450844b54bb850691892f23de4993683
SHA1 9655f1a8b45b5611ea16d2d07e229a67eb7b7d29
SHA512 e9931b77172a38988954b4132a7f270e84e1b5bc37941dd7a7b705f3b0af635290cda14d87a63b42be6448d1dafeba666d65277e2eea766168e7fa9ea1f8c7cb
SSDEEP 49152:h7kjHt9F2c0Q2Om22guudIVvS45a5tNlQSksr3As6VqZVXpn7xw:tkjHfKQ2OXa1m5l3AMZTn76
MD5 SHA1 SHA512 SSDEEP

Submit Download

nx.json.cur.prof

Path /data/data/com.help.marine/app_DynamicOptDex/oat/nx.json.cur.prof
Size 4KB
SHA256 8f1dad8456eb2ba9f182d7157e635a6a376e2f5dae34c8f17be3dc294241904b
MD5 d8a3982b47d26de534b78fa746dcadf0
SHA1 1dc846fee1621e2571f937858e0a32841687d2e7
SHA512 a98574f390001d7e482478e136d5ba2474def2254b0d3e33ef8cbcf5ff50487573f2f4546f9b1ad77c68862b2479ebb1e1e2bb9f8fb8301d4a33e787475fe1cd
SSDEEP 96:F3GSyc+d1FPALIfCTXnAloBBBFS5V10dkfyEFUPZfOGyFQArZ:1wc+bFAIfuQlurFS5Ydk5UPZflaQAV
MD5 SHA1 SHA512 SSDEEP

Submit Download

nx.vdex

Path /data/data/com.help.marine/app_DynamicOptDex/oat/x86_64/nx.vdex
Size 113KB
SHA256 5153d8b9cbfa226d0b8e5fe022adf412f44a563e05d67c239091d445bff0a6e6
MD5 ccc40097c44dec170c02a59f9412cbe4
SHA1 7d8b300fa0e1f2f96545b4f6f5b9e8ccc108a01a
SHA512 dab7dc19ba7d0a3ab9ca88acd3b53880119cbbb1cb1c449f4b7b9381028cdcdb1b36401d4c7a737ce7e62962d9ca8814010b87aa8d2cf72fe5482f874b692d33
SSDEEP 3072:/+aaaaaaaaaaaaaaaaaaaaaaaa11zzzzzzzgrjz2SHgD1D//BxADTi5D/piS:Waaaaaaaaaaaaaaaaaaaaaaaafzzzzzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb

Path /data/data/com.help.marine/no_backup/androidx.work.workdb
Size 4KB
SHA256 b9a8194b71a046e8c0eb30995827b582b4bea834f630a5df2483b778a7d7d8a4
MD5 0eb157e1a86d4d00aa601dd2f6ff3ee3
SHA1 fee434f784e73cc7916322e949f727caf8363102
SHA512 b9b79b8c3af8a3f140df230fd89e95206358ba50ff214e7323a2dbbe2937b795f970e588302ffd5d721318bd597ce0a27af26d6cdb07f45569c30209845082a8
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.help.marine/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 8923809dbda8e2a6697d8caf8225195703f21023a8ac00d6eeda5aa1136270f3
MD5 9f83d0cbee4d61df0068a08e62982e64
SHA1 f8256f0200c68737926ddc57e4d6972ebef9d348
SHA512 50729847648e742ed4195de6e0e8b0aed7c32794914100858ea69327377a36775310b3dcdf22d692c36ec45a4d90fe5af441a1510ae612c228279d9da7208770
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-shm

Path /data/data/com.help.marine/no_backup/androidx.work.workdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.help.marine/no_backup/androidx.work.workdb-wal
Size 156KB
SHA256 65293140f7d51b2d3337503a03620baa17f2ee8f1071a7dd52ccd9c943bcf52c
MD5 c62ecc99c9fe74c2bc707387a3baf712
SHA1 a4f0cf95ce9d5128fa35a0cbc836e3e4e4fcc7c6
SHA512 0b28355b5767d85df020f5031e74a0647b4f7596584a8f0665a3b73dbb77885638ef34364d907eca7309190297ba34ae0bc520e581dd544e62021d0d83c5cbb4
SSDEEP 48:Plr0qttYwR0lnJl5Ht0lq6t0l7fr0lepkV0lPS/C0lNh0lpH0qttYu:PlZttYwynJl5HGq6G7Ae7Pidkp9ttYu
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.help.marine/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 281256779e064ceca3d3507299f9e079894549dc0829ffbca3ae38216ceb3801
MD5 d7cd8553e95daa87b23fce5b7c5c5be4
SHA1 c4104b3b01ee0c6a01b722f384d720003ae54af5
SHA512 aa943ed879ae62a3b233eeb616893922b762878836545e6c137bb05a364acd5def21dce2dac77a5ff342e5c43646a56980476b5288cf0e8fd8d0da69ca94d0f0
SSDEEP 6:KYSBUuLzBu9FZdKEAlOERX4PBX4ogLugMBX4suuK+/nNNfktXYfQro4Ow2:KYSBUuZozdKBRmBEyPbP/nbkcGo4Ow2
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.help.marine/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 5479da3de7e8d292451fb5cc49b4c57da21fd6c99db4096cbaf9240217e2a367
MD5 0ec4329612a7e9306646664cfa161d3f
SHA1 b1a126fe791a016e3b46de6fcb879c7e93c4e406
SHA512 8fabbdd0409b2c403095dc14346e2d8a897a59bd55398fd4f5ec12645a9086da286e32f469ad63c0da201581ae3430494c5f467e067ce783634948a46aa070fb
SSDEEP 96:c76+hdjnHtDRMpf8UzS6+BD8q0ExPf1EsKaax6o3aN7MgxanE5WZAqDw:8djnHt9Mpf8UzS6+BD8q0E5MzCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

nx.json

Path /data/user/0/com.help.marine/app_DynamicOptDex/nx.json
Size 3.3MB
SHA256 4aca18c39191facf8bc852fc0632ad3fa6ce19a8638ca9919e6e9e2027fe43b9
MD5 fbad39910d9b4b84aa1ea5e7e2f29e27
SHA1 0a02ff88bfb760791c09d2f51f1bd9bd1f5d52b5
SHA512 027c1067317ab5057860bdd808ae01e26bc993cae3f05273825a8a3bec030eb40b8a484e1870237434a5ac1b6edb4375d54fc46964a349fca061fb3f54f9cfe6
SSDEEP 49152:KDkI0S2chK622dLb2tcMcyNxAX88puTEWLqpxRGl4H:WlK62AMcyNxATWoRGO
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads