SOVA sample is not unpacking

eybisi / kavanoz

Statically unpacking common android banker malware.

MIT License

131 stars 21 forks source link

SOVA sample is not unpacking #8

Closed cryptax closed 8 months ago

cryptax commented 8 months ago

Hi,

This sample of SOVA botnet is not unpacking with kavanoz

c1642ac3f729701223043b16ac2c6c5f64adc7080f474c181067b0f1335218f2 sova.apk

# kavanoz sova.apk 
❌ Cannot unpack

The Application class is com.wikipedia.subways.k. Analysis: https://cryptax.medium.com/eyes-on-android-s-o-v-a-botnet-sample-fb5ed332d08

eybisi commented 8 months ago

needed additional descriptor filter for zip function. Also there is another function that does multidex thingy in "com.aliott.agileplugin.multidex.MultiDexExtractor.d" which makes return early, before finding real multidex. fixed in commit