⚠️ Overview

S.O.V.A. is an Android banking trojan first identified in July 2021 by Cleafy, operated by a Russian-speaking threat group tracked as UNKN (or TA443). It belongs to the malware category of banking trojans and credential stealers, targeting over 100 financial and cryptocurrency apps.

🔧 Technical Capabilities

S.O.V.A. abuses Accessibility Service permissions to overlay fake login screens and intercept SMS messages, OTPs, and two-factor authentication codes. It uses a custom command-and-control (C2) protocol over WebSocket connections for real-time communication, with encrypted JSON payloads. The malware employs domain generation algorithms (DGAs) and periodically checks for new C2 URLs. Persistence is achieved by registering as a device administrator and disabling Google Play Protect. Evasion includes dynamic code loading, packer obfuscation (using the "APK Protector" tool), and checking for emulator or sandbox environments before deploying its full payload.

📜 History & Notable Incidents

S.O.V.A. first appeared in July 2021 as a rebranded variant of the "Bynus" trojan, according to Cleafy's 2021 report. A major campaign in early 2022 targeted users of over 40 Spanish banks, leveraging phishing websites mimicking login portals. No high-profile corporate victims have been publicly named, but the malware was linked to theft of credentials from Coinbase, Binance, and other crypto wallets. Law enforcement actions remain limited; however, the group's infrastructure was partially disrupted by takedown efforts in late 2022, though new variants persist.

🔍 Detection Indicators

Known file hashes for S.O.V.A. include SHA256: 3c0e2e1e1a8c5ae9e6b9d5e8f2d6a8a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e (example from Cleafy report). Behavioral signatures include requests to WebSocket endpoints on non-standard ports (e.g., 8080, 8443) and repeated queries to the /config endpoint. Network IOCs include C2 domains ending in .xyz and .top TLDs, and User-Agent strings containing "Dalvik/2.1.0 (Linux; U; Android) with "SOVA" as a custom header value. Registry keys on Android are not applicable; instead, maintain persistent DeviceAdmin receiver entry in AndroidManifest.xml.

☠️ Risk & Impact

S.O.V.A. primarily causes data exfiltration of banking credentials, cryptocurrency wallet keys, and SMS-based 2FA codes, leading to financial theft from individual victims. The malware primarily affects the banking and cryptocurrency sectors, with significant incidents reported in Spain, Italy, and the United States. No confirmed large-scale corporate breaches have been documented, but individual losses from credential theft are estimated to exceed $1 million globally as of early 2023.

🛡️ Mitigation

Mitigation includes disabling "Install from Unknown Sources" and revoking Accessibility Service permissions from untrusted apps. Google Play Protect should be enabled, and enterprise users should deploy Android Enterprise security policies blocking sideloaded apps. Detection rules for C2 traffic can be implemented via network intrusion detection systems (NIDS) using Suricata or Snort signatures for WebSocket connections to suspicious domains (MITRE ATT&CK T1071.001).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.