sova | 0c78489423101d08e47d67ab467a45edacf84ea46ef1f7c0370084dc7a956867

Resubmissions

08/04/2024, 12:28

240408-pnlb2acd6t10

08/03/2024, 09:07

240308-k3bc6abc6910

23/03/2023, 01:50

230323-b89y8scg8210

Analysis

max time kernel
100s
max time network
128s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
08/03/2024, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4.apk
Size 4.6MB
Sample240308-k3bc6abc69
SHA256 376d13affcbfc5d5358d39aba16b814f711f2e81632059a4bce5af060e038ea4
MD5 d4c6871dbd078685cb138a499113d280
SHA1 60b64c8481f9de5b92634efc70a9ff42f451c78f
SHA512 e8823b7c73140af88ad6fd8c52a6619d245281170ddb31feb9d4e726ee47a8f34575f687048947272fabfb13dbed2c24f50d6fbd6117d40c1db577305955af59
SSDEEP 98304:M0C+HR25SOeU0lhoBenZFOw2QxW74PNTcG/bZ7vf0sc:jCmtO/07oEOw2QU74PNT9/t7nc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sova banker collection evasion infostealer stealth trojan

Malware Config

Extracted

Family

sova

http://193.42.32.84/
http://193.42.32.87/

Signatures

SOVA_v5 payload 2 IoCs

resource	yara_rule
behavioral4/memory/4346-0.dex	family_sova_v5
behavioral4/memory/4288-0.dex	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.help.marine
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.help.marine

Removes its main activity from the application launcher 1 TTPs 2 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4288	com.help.marine
4288	com.help.marine

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.help.marine/app_DynamicOptDex/nx.json	4346	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.help.marine/app_DynamicOptDex/nx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.help.marine/app_DynamicOptDex/oat/x86/nx.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.help.marine/app_DynamicOptDex/nx.json	4288	com.help.marine

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.help.marine

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.help.marine

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.help.marine

com.help.marine
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Reads the contacts stored on the device.
- Acquires the wake lock
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4288
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.help.marine/app_DynamicOptDex/nx.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.help.marine/app_DynamicOptDex/oat/x86/nx.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4346

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Input Injection

T1516

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

nx.json

Path /data/data/com.help.marine/app_DynamicOptDex/nx.json
Size 1.2MB
SHA256 c3815866e0d21bcc90c03e26b374e8150c32b75b38ac8c5ccdec6a2fd808998d
MD5 fb022f45fc63455ecc1d53ce277a1199
SHA1 f4373d0a637e280dcd5c220754b4d483e2fbeca9
SHA512 29bf2549a23313821b474e0f229ea17467b1144893065868550c6c30cee4a2c897a4db7a9a549da2ec1bbe6eac29d0bf79ce31cfa47a582388709aa0918e6327
SSDEEP 24576:h4oRkD3HtkA4Hi2qN0nUX2O9g22gu7WNdIVNSgSVuNMsFvxarNtNlu:h7kjHt9F2c0Q2Om22guudIVvS45a5tNs
MD5 SHA1 SHA512 SSDEEP

Submit Download

nx.json.cur.prof

Path /data/data/com.help.marine/app_DynamicOptDex/oat/nx.json.cur.prof
Size 2KB
SHA256 159150fc8282c45cfd4a5187fc229d0c7ce614098815f2266ea47ca4c6fd62da
MD5 618e2b8623d9728899b5348b6d9e1817
SHA1 864e7ae0aa6128982e8aa94ec2e958a576551240
SHA512 49a23128b19f8558fbfcb4f155af35679f98199ace609d1f2a4f5558ea274ab784f99330cdb83d65936f80d99ec4e0e001c1eebd9cddf1c3c478dc664d803470
MD5 SHA1 SHA512

Submit Download

nx.json.cur.prof

Path /data/data/com.help.marine/app_DynamicOptDex/oat/nx.json.cur.prof
Size 2KB
SHA256 1764f716ecd3f4c6ffcf34cde42074c7170b97fa186244f9331a42556c8bdba2
MD5 a928a74235774cfdf3496eaeda6181a3
SHA1 76af2410da25c22ab9372ab8e6430d7acd9d2ac7
SHA512 d825d6d20b4660c1457bc6f565a41ffdd00946b4ea69652b951c3175d10fe8a5ced3a98bec492b88ed9975078be9f9919ef1ef6f1cbfec4db4a4378eab469ba6
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb

Path /data/data/com.help.marine/no_backup/androidx.work.workdb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-journal

Path /data/data/com.help.marine/no_backup/androidx.work.workdb-journal
Size 512B
SHA256 8abb5b1a392d1489ae2c98b3fa4947ba7b143a9ac1cf49ebc498226923814c3e
MD5 e5ccf9bdd93f08818aad03b042f5af63
SHA1 0ae7b749f6a4f033f9984d5f96f71c65f30774ec
SHA512 52419309d8c8928b70eacee91404fbf1ee2d46f0fcf9eb76a9e6842b70bba04ad6d2e37089db72528f1ddb8d782fef5184665fa4b1cb211c7f81277e63ef8f55
MD5 SHA1 SHA512

Submit Download

androidx.work.workdb-wal

Path /data/data/com.help.marine/no_backup/androidx.work.workdb-wal
Size 108KB
SHA256 6db37e2e770f81ddd17e7a41e79de3b8e17b219d67f18cd4280546ff77963f1f
MD5 02e2b7c048da1719b6487116081ce062
SHA1 87a3484a019e1cbbc7aca7764ddba1196c4e5590
SHA512 1fe983362928f98bc53cf143908b91414f0fc33bb786a956ccf5477f41c07f06c86d896a61c8b090f18393e268885f88551974e970ef9f27f837529cde0fdb31
SSDEEP 96:z6+hdjnHtDRMpf8UzS6+BD8q0ExPKWrldpP:TdjnHt9Mpf8UzS6+BD8q0E5hrlbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.help.marine/no_backup/androidx.work.workdb-wal
Size 148KB
SHA256 f2ba226f16893ed010bdd232485b603f24e2c3397e968d7743e99615e06aca09
MD5 a327f1dfe66d001a20a93cb8409b28ec
SHA1 a1315c7c0a3b8338e2f69923d88c69ea3f7efb86
SHA512 269fa82c2c2b0653534a1710e524421797d737f53df413ca744beb69ed446da880c75eda2c0d3f5ef41ac994a74e61fe068960f3508a64be515e5e6747ceb3af
SSDEEP 12:HAvlk3XtkqZZ7p2inhtMXrXDsebZsXOf0Za1L6ib2ibZsK72ibZsDfPbZs2+xZsb:iOB/7pttY3s9aRsGRsJstsQs6E
MD5 SHA1 SHA512 SSDEEP

Submit Download

androidx.work.workdb-wal

Path /data/data/com.help.marine/no_backup/androidx.work.workdb-wal
Size 16KB
SHA256 6ce7d80d16a6ecbf4f3a05bc07c1b4d8873b2a8d4e9a6f8557fe9c70202af131
MD5 4bc164dae625baf0de8fec853c7c9177
SHA1 f0f890d9bee5d5bc670ee63716a411f6981533da
SHA512 312cc296ededde383ff9ea41236935e8a6bf39abba0c6e52cc7419ba8dc08c1c1355f49898f5c05829d14ae3aa66c3a26024d0cf3c0c46a03d2fedb2def1614c
SSDEEP 6:KcmUyUUevo9FZdrlOERX4PBX4ogLugMBX4suuK+/vUB/W7l0PlyX4+Ow2:Kcm6HyzdTRmBEyPbP/vGEXVOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

nx.json

Path /data/user/0/com.help.marine/app_DynamicOptDex/nx.json
Size 6.1MB
SHA256 051b52ef6e08ee095ee9f6b3a9de041fb653ab51d9ec9fa638202d1939443c56
MD5 6ba5d8b283cb3d7df00d355c9d6cb055
SHA1 4f1a98fc354850f0093f74e0e9a642bcfb259b6e
SHA512 ba71c02f9b087a0ebed42d4ceb0f01af45a4e1c9a737f5e391ca2958038879df1e732f6c6b55161905514d231942dd5589c32835d1ca7eff38a8385594c467c2
SSDEEP 49152:KDkI0S2chK622dLb2tcMcyNxAX88puTEWLqpxRGl4ZX0uO9SiTwD7pFjuOXbYecz:WlK62AMcyNxATWoRGkYW2BZFx
MD5 SHA1 SHA512 SSDEEP

Download

nx.json

Path /data/user/0/com.help.marine/app_DynamicOptDex/nx.json
Size 4.5MB
SHA256 a1974a882bbaad3510746be4e3ea50710d096010940bab2c4eb99c42187aa7ec
MD5 748ad5765a6a3fc265ce3048037511a4
SHA1 a4ab9afb6cfa52683864771f3cfd7acde27f7cd4
SHA512 5599aaf61a85fd1cefba64a462cbe2bd210f62648affb8ef742325f1035ce0814bf2d0e03b70062db3ab3db624d3ef3fc87a075eeaf6fefb4f0e9e7ada3f755a
SSDEEP 49152:KDkI0S2chK622dLb2tcMcyNxAX88puTEWLqpxRGl4ZX0uO9SiTwD7pFjuOXbYecA:WlK62AMcyNxATWoRGkd+9S
MD5 SHA1 SHA512 SSDEEP

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads