Pierluigi Paganini August 15, 2022

Security researchers from Cleafy reported that the SOVA Android banking malware is back and is rapidly evolving.

The SOVA Android banking trojan was improved, it has a new ransomware feature that encrypts files on Android devices, Cleafy researchers report.

The malware has been active since 2021 and evolves over time. The latest version of the SOVA Trojan, 5.0, targets over 200 banking and cryptocurrency exchange apps.

The authors also enhanced its evasion capabilities.

In March 2022, SOVA authors released version 3.0 which was able to capture 2FA codes and cookies, it also implemented new injections to target applications from multiple banks.

Version 4, which was released in July, unlike previous versions includes several new codes. The most interesting capability is the VNC (virtual network computing).

“Starting from SOVA v4, TAs can obtain screenshots of the infected devices, to retrieve more information from the victims. Furthermore, the malware is also able to record and obtain any sensitive information, as shown in Figure 5. These features, combined with Accessibility services, enable TAs to perform gestures and, consequently, fraudulent activities from the infected device, as we have already seen in other Android Banking Trojans (e.g. Oscorp or BRATA).” reads the analysis published by Cleafy. “With SOVA v4, TAs are able to manage multiple commands, such as: screen click, swipe, copy/paste and the capability to show an overlay screen to hide the screen to the victim.”

In SOVA v4, the author has further improved and refactored the cookie stealer mechanism. Another interesting feature updated in SOVA v4 is the protection module, which was designed to protect the malware from the victim’s actions, such as the manual uninstall of the malicious code.

If the user tries to uninstall the malware from the settings or pressing the icon, SOVA is able to intercept these actions and prevent them from abusing the Accessibilities services by returning to the home screen and showing a popup displaying “This app is secured”.

The SOVA v4 also includes a new module designed to target the Binance exchange and the Trust Wallet (official crypto wallet of Binance). The module allows operators to obtain different information, including the balance of the account, the history of the actions performed by the victim, and the seed phrase to access the crypto wallet.

Version 5 was completely refactored and new features and changes were added, including the communications between the malware and the C2 server. Experts noticed that the VNC module has yet to be integrated into the latest version.

The most interesting feature added in SOVA v5 is the ransomware module, which was already announced in the roadmap for September 2021.

The malware encrypts the files inside the infected devices using an AES algorithm and renaming them with the extension “.enc”.

“The ransomware feature is quite interesting as it’s still not a common one in the Android banking trojans landscape. It strongly leverages on the opportunity arises in recent years, as mobile devices became for most people the central storage for personal and business data.” concludes the report. “

With the discovery of SOVA v4 and SOVA v5, we uncovered new evidence about how TAs are constantly improving their malware and the C2 panel, honouring the published roadmap. Although the malware is still under development, it’s ready to carry on fraudulent activities at scale.“

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, SOVA Android banking malware)

[adrotate banner=”5″]

[adrotate banner=”13″]