General
- Target sova.apk
- Size 569KB
- Sample240412-ravpnaah86
- SHA256 8a6889610a18296e812fabd0a4ceb8b75caadc5cec1b39e8173c3e0093fd3a57
Score
10/10
Malware Config
Targets
-
- Target sova.apk
- Size 569KB
- SHA256 8a6889610a18296e812fabd0a4ceb8b75caadc5cec1b39e8173c3e0093fd3a57
Score10/10Sova
Android banker first seen in July 2021.
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Removes its main activity from the application launcher
Queries the phone number (MSISDN for GSM devices)
Requests enabling of the accessibility settings.
Acquires the wake lock
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Requests disabling of battery optimizations (often used to enable hiding in the background).