Android Banking Trojan SOVA Comes Back With New Features Including Ransomware

guest · Aug 11, 2022

August 11, 2022

The Android banking Trojan SOVA has been spotted in the wild again and appears to have new features.

The news comes from Cleafy’s security researchers, who shared the findings in an advisory on Thursday.
The document explains how SOVA was first spotted in September 2021, when its developers posted a roadmap of future updates on the dark web saying the malware was entering the market, despite still being under testing.
Click to expand...

These included two-factor authentication (2FA) interception, cookie stealing and injections for new targets and countries (e.g. multiple Philippine banks).
Then, in July 2022, Cleafy spotted a new version of SOVA (v4), which the security firm is now detailing in its latest advisory.

SOVA v4 features new capabilities and is reportedly targeting more than 200 mobile applications (against the original 90 in 2021), including banking apps and crypto exchanges/wallets such as Binance.

“The most interesting part is related to the [Virtual Network Computing] capability,” Cleafy wrote. “This feature has been in the SOVA roadmap since September 2021 and that is one strong evidence that threat actors are constantly updating the malware with new features and capabilities.”
Click to expand...

In the same advisory, Cleafy also claimed to have spotted some instance of yet another variant of SOVA. The v5 of the malware shows a further refactoring of the code, the addition of new features and some small changes in the communications between the malware and the command-and-control (C2) server.

More specifically, SOVA v5 lacks the VNC module, but it instead features ransomware capabilities.

“The ransomware feature is quite interesting as it’s still not a common one in the Android banking trojans landscape,” Cleafy wrote.
Click to expand...

Cleafy: SOVA malware is back and is evolving rapidly

In September 2021, SOVA, a new Android Banking Trojan, was announced in a known underground forum. Even though at that time the author claimed the malware was still under development, it actually already had multiple capabilities and was basically almost in the go-to market phase.

Furthermore, the authors of SOVA showed a roadmap with the future update of the malware as shown in Figure 1.
In July 2022, we discovered a new version of SOVA (v4) which presents new capabilities and seems to be targeting more than 200 mobile applications, including banking apps and crypto exchanges/wallets.
Click to expand...

Log in or Sign up

Android Banking Trojan SOVA Comes Back With New Features Including Ransomware

guest Guest

Log in or Sign up

Android Banking Trojan SOVA Comes Back With New Features Including Ransomware

guest Guest

Useful Searches