Analysis
-
max time kernel
9s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
28-10-2024 00:41
General
-
Target
76c81a68d7dcd0bf9d77a7bfbb06178e_JaffaCakes118.apk
-
Size
7.0MB
-
MD5
76c81a68d7dcd0bf9d77a7bfbb06178e
-
SHA1
811b4b899eb962baee4347d291eb1cb1e7a91e86
-
SHA256
173a8591dcb43aa7e4b5d0dc5f9034d69aa78bc8827407d56047336614795cce
-
SHA512
593cbc1663d1c122064b918ff6bf5e513e4925b69de074a35f7e7958a48a00146f3dbcce7499c0ada4448af93fb215288d15a64c621c9c92ddcb74eccb1820f7
-
SSDEEP
196608:/4YBf9vwERe7BpxoPx0Lizxgxc3pwmfmCvfyNFsW:AYlewe7Bzo5oizxocZwNCvf2FsW
Malware Config
Signatures
-
SOVA_v3 payload 1 IoCs
-
Sova
Android banker first seen in July 2021.
-
Sova family
-
Checks if the Android device is rooted. 1 TTPs 3 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Requests enabling of the accessibility settings. 1 IoCs
Processes
-
com.esavzt.kkjsdzp.jjy1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Requests enabling of the accessibility settings.
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.2MB
MD5c52a9f66fb6565240003baec90de10ab
SHA1c8000accbdd9a3e8bf0dbad80a05b85126a14483
SHA2564fe33f9876c4a099688f052466d896f914afbbfe58f010ff267d6d4c201c4565
SHA5122d575872f8bfe0f78c24b326986d4659c2ca3e51a1b1939cc11da1c211679661c39a6aa54cb5eb76abf96260f98f36707004f131eb0796445419fddca7c58679
-
Filesize
3.8MB
MD5af18359e73a8cb9220e1cb36651a20a8
SHA1d59e4bfc5ce264785f69cbcfe9e4ea441995957f
SHA256559809e7f090330fcd407ef32b6cd7bd3aa3555eea05b69fbf1d163ef1f961d1
SHA512b1d8eca5ee2e35887a52ae528f77f4da1ebd3ce8f8cf1b523315d8eaab8e987d27d2c0f0963f6b98ecdd37edb3a82a857bf7ef1929a208341019096624ff087c