General
- Target sova.apk
- Size 569KB
- Sample240412-ravpnaah86
- SHA256 8a6889610a18296e812fabd0a4ceb8b75caadc5cec1b39e8173c3e0093fd3a57
Score
10/10
Malware Config
Targets
-
- Target sova.apk
- Size 569KB
- SHA256 8a6889610a18296e812fabd0a4ceb8b75caadc5cec1b39e8173c3e0093fd3a57
Score10/10-
Sova
Android banker first seen in July 2021.
-
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Removes its main activity from the application launcher
-
Queries the phone number (MSISDN for GSM devices)
-
Requests enabling of the accessibility settings.
-
Acquires the wake lock
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Requests disabling of battery optimizations (often used to enable hiding in the background).