(ThreatFabric) Sova is the Russian word for owl. This name was chosen by the threat actor himself/herself possibly because of owl’s nature as nocturnal birds of prey, quiet but efficient in stalking and capturing their victims. This identifies a completely new, to the best of our knowledge, Android banking trojan. The trojan is currently in development and testing phase, and has the objective to add to his overlay and keylogging mechanisms, other higly dangerous features like DDoS and Ransomware in future versions. There are a few interesting aspects that differentiate this trojan to already existing ones, both in features as well as in development.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|---|
| 5.161.105.24:5000 | 2023-03-24 |
| 5.161.116.222:5000 | 2023-03-24 |
| 45.81.243.180:80 | 2023-03-24 |
| 45.81.243.181:80 | 2023-03-24 |
| 45.81.243.203:80 | 2023-03-24 |
| 45.81.243.204:80 | 2023-03-24 |
| 85.31.45.128:80 | 2023-03-24 |
| 85.31.45.130:80 | 2023-03-24 |
| 109.206.240.7:80 | 2023-03-24 |
| 176.107.160.28:80 | 2023-03-24 |
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
2023-04-09 by LianSecurity from LianSecurity
2023-03-09 by Cyble from cyble
2022-09-01 by Muhammad Hasan Ali from muha2xmad
2022-08-11 by Francesco Iubatti from Cleafy
2021-09-14 by Cyble from cyble
2021-09-10 by ThreatFabric from ThreatFabric
Tool: S.O.V.A.
Names: S.O.V.A.
Description: (ThreatFabric) Sova is the Russian word for owl. This name was chosen by the threat actor himself/herself possibly because of owl’s nature as nocturnal birds of prey, quiet but efficient in stalking and capturing their victims. This identifies a completely new, to the best of our knowledge, Android banking trojan. The trojan is currently in development and testing phase, and has the objective to add to his overlay and keylogging mechanisms, other higly dangerous features like DDoS and Ransomware in future versions. There are a few interesting aspects that differentiate this trojan to already existing ones, both in features as well as in development.
Category: Malware
Type: Banking trojan, Backdoor, Info stealer, Credential stealer, Keylogger
Information: https://www.threatfabric.com/blogs/sova-new-trojan-with-fowl-intentions.html
Information: https://blog.cyble.com/2021/09/14/deep-dive-analysis-of-s-o-v-a-android-banking-trojan/
Information: https://www.cleafy.com/cleafy-labs/sova-malware-is-back-and-is-evolving-rapidly
Mitre-attack: https://attack.mitre.org/software/S1062
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/apk.sova
Last-card-change: 2023-06-22
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |