sova

Resubmissions

24/04/2024, 11:50

240424-nzl72ahe3w10

12/04/2024, 13:59

28/02/2024, 13:25

28/02/2024, 13:01

28/02/2024, 12:56

19/02/2024, 08:01

03/01/2024, 08:46

Sharing

Copy URL Twitter E-mail

General

Target
sova.apk
Size 569KB
Sample240424-nzl72ahe3w
SHA256 8a6889610a18296e812fabd0a4ceb8b75caadc5cec1b39e8173c3e0093fd3a57
MD5 01b6f0220794476fe19a54c049600ab3
SHA1 eb9dfde47a393bca666e947f285f16c20baf6c32
SHA512 ac3031a6dbc5bb0d1e609979336487f14efe58f8e87480e5ef7f79c2abae56977ca444bbb5bbc7970d9c416f9c754b9fedf2bdef3b7b311c2e95e07350f9c892
SSDEEP 12288:C89uYjYV1jiNQ7l5DFQo2d8GmEFDipRdWp8+iZiZ5t:9jYniCF6d8iiXg825t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  sova.apk
- Size 569KB
- SHA256 8a6889610a18296e812fabd0a4ceb8b75caadc5cec1b39e8173c3e0093fd3a57
- MD5 01b6f0220794476fe19a54c049600ab3
- SHA1 eb9dfde47a393bca666e947f285f16c20baf6c32
- SHA512 ac3031a6dbc5bb0d1e609979336487f14efe58f8e87480e5ef7f79c2abae56977ca444bbb5bbc7970d9c416f9c754b9fedf2bdef3b7b311c2e95e07350f9c892
- SSDEEP 12288:C89uYjYV1jiNQ7l5DFQo2d8GmEFDipRdWp8+iZiZ5t:9jYniCF6d8iiXg825t
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

sova banker collection credential_access discovery evasion impact infostealer persistence stealth trojan
- Sova
  Android banker first seen in July 2021.
  banker trojan infostealer sova
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
behavioral1