The SOVA Trojan

The Sova virus is a new type of mobile banking malware campaign. It uses the virus called SOVA Android Trojan. CERT-In has informed about a new mobile banking malware campaign using SOVA Android Trojan that is attacking more than 200 mobile apps. With this everyone’s bank account is in danger, the Government warns.

Previously, Sova focused on countries like the USA, Russia and Spain and since July 2022 it is now targeting India. The latest version of this malware hides itself within fake Android apps that show up with the logo of a few famous legitimate apps like Chrome, Amazon, NFT platform to deceive users into installing them.

This virus is one of the most dangerous viruses for mobile net banking users in India. It is hard to uninstall and is the fifth version of the first detected virus in Indian cyberspace.

SOVA has other harmful capabilities like keylogging, DDoS, overlay attacks, notification manipulation, and more. Security researchers have also found a rare feature in the malware which allows the SOVA malware to steal session cookies, this feature enables the malware to login into banking accounts without the username and password of the user.

Once the fake android application is installed on the phone, it sends the list of all applications installed on the device to the Command and control server controlled by the threat actor in order to obtain the list of targeted applications, said CERT-In.

It further says, at this point, the C2 sends back to the malware the list of addresses for each targeted application and stores this information inside an XML file. These targeted applications are then managed through the communications between the malware and the C2.

It has the capability to encrypt all the data. This was reported by the country’s federal cyber security agency. The key feature of SOVA is it is a banking trojan, and is very smart in action. It recodes the protection module that aims to save itself from different victims' actions. In a scenario, when the user tries to uninstall the malware from its setting options on their device.

Then the Sova virus interrupts the actions of the user and automatically returns to the home screen. In the newer version of SOVA, the cybercrooks also added the option to create a list of applications for which to monitor for cookies automatically.

S Mohini Ratna, Editor, VARINDIA