sova

General

Target

76c81a68d7dcd0bf9d77a7bfbb06178e_JaffaCakes118
Size

7.0MB
Sample

241028-a116paxaqj
MD5

76c81a68d7dcd0bf9d77a7bfbb06178e
SHA1

811b4b899eb962baee4347d291eb1cb1e7a91e86
SHA256

173a8591dcb43aa7e4b5d0dc5f9034d69aa78bc8827407d56047336614795cce
SHA512

593cbc1663d1c122064b918ff6bf5e513e4925b69de074a35f7e7958a48a00146f3dbcce7499c0ada4448af93fb215288d15a64c621c9c92ddcb74eccb1820f7
SSDEEP

196608:/4YBf9vwERe7BpxoPx0Lizxgxc3pwmfmCvfyNFsW:AYlewe7Bzo5oizxocZwNCvf2FsW

Score

10^/10

Malware Config

Targets

- Target
  
  76c81a68d7dcd0bf9d77a7bfbb06178e_JaffaCakes118
- Size
  
  7.0MB
- MD5
  
  76c81a68d7dcd0bf9d77a7bfbb06178e
- SHA1
  
  811b4b899eb962baee4347d291eb1cb1e7a91e86
- SHA256
  
  173a8591dcb43aa7e4b5d0dc5f9034d69aa78bc8827407d56047336614795cce
- SHA512
  
  593cbc1663d1c122064b918ff6bf5e513e4925b69de074a35f7e7958a48a00146f3dbcce7499c0ada4448af93fb215288d15a64c621c9c92ddcb74eccb1820f7
- SSDEEP
  
  196608:/4YBf9vwERe7BpxoPx0Lizxgxc3pwmfmCvfyNFsW:AYlewe7Bzo5oizxocZwNCvf2FsW
Score

10^/10

sova banker collection credential_access discovery evasion impact infostealer persistence stealth trojan
- SOVA_v3 payload
- Sova
  Android banker first seen in July 2021.
  banker trojan infostealer sova
- Sova family
  sova
- Checks if the Android device is rooted.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Acquires the wake lock
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about active data network
  discovery
- Requests enabling of the accessibility settings.
behavioral1 behavioral2 behavioral3