Loading malware…
S.O.V.A. is an Android banking trojan first publicly observed in 2021 and developed as a modular mobile malware platform focused on financial fraud, credential theft, and device takeover. It targets Android devices and has been distributed through malicious applications masquerading as legitimate software, including fake Adobe Flash Player and trojanized apps delivered via phishing pages or app-binding services such as Zombinder. Later malware families including Nexus and MaliBot have shown code lineage or substantial reworking derived from S.O.V.A., underscoring its influence in the Android banking malware ecosystem.
S.O.V.A. heavily abuses Android Accessibility Services to obtain broad control over infected devices. Once granted accessibility access, it can auto-approve permissions, hinder removal, hide its icon, monitor on-screen activity, and trigger phishing overlays when targeted banking or cryptocurrency applications are opened. It uses WebView-based injects to impersonate legitimate login pages and steal credentials and session material. Reported capabilities also include keylogging, cookie theft through Android web session mechanisms, interception and reading of SMS and notifications to capture one-time passwords, sending SMS messages, harvesting contacts and device information, and exfiltrating stolen data to command-and-control infrastructure over HTTP-based channels, including implementations using Retrofit2.
Observed variants also include broader post-compromise functionality beyond classic banking fraud. S.O.V.A. has been documented monitoring clipboard contents, including cryptocurrency wallet addresses, and replacing or harvesting wallet-related data. Some versions support hidden SMS and push-notification interception, call-related actions, and periodic device status reporting. The malware has shown anti-analysis and regional exclusion logic in some samples, including emulator checks and avoidance of selected CIS-region targets.
S.O.V.A. evolved beyond credential theft into impact-oriented behavior. Later variants and related reporting indicate ransomware capability that encrypts files on compromised Android devices using AES, adding destructive or extortion-oriented functionality to an already mature banking trojan. The malware has also been advertised with additional planned features such as man-in-the-middle, VNC-style remote control, and DDoS, though only directly observed capabilities should be treated as confirmed. Overall, S.O.V.A. is a significant Android financial malware family combining overlay phishing, SMS and notification interception, accessibility abuse, session theft, and, in some variants, file encryption for impact.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware uses this service AppAccessibilityService to declare an Accessibility Service in the Android manifest... This allows the malware to get SMS notifications when the device gets SMS message.
We get the Entry point of the malicious application com.devapprove.a.ru.news.ui.LauncherActivity which is not found the classes.dex. So this an indication that the malware is packed and other classes will be loaded into application at run-time.
the actor used a third-party service provided on darknet to “glue”, or bind, dropper capabilities to a legitimate application... Such apps disguised as modified version of Instagram, WiFi Auto Authenticator, Football Live Streaming, etc.
The first thing startApp is anti-emulation (call to isEmulator). It checks for the presence of generic names in product brand, fingerprint etc.
The malware will perform overlay attack when the victim opens a specific app usually banking apps or cryptocurrency apps to steal the victim’s credentials... The command openinject will open the downloaded WebView... when a targeted app opened.
@FormUrlEncoded @POST("/keylog.php") Call sendKeyLog(@Field("botid") String arg1, @Field("inputLog") String arg2);
The malware will steal Cookies from the opened apps using scancookie using cookieManager . After collecting Cookies the malware will stop scan using stopcookie command. The malware sends the stolen Cookies to /testpost.php .
Xenomorph’s latest version also added Cookie stealer capabilities to its already very extensive arsenal of weapons.
The malware will receive a command related to two factor authentication 2FA to start or stop collecting 2FA authentication codes from victim device then send 2FA message to the C2 server. The malware will run the Google Authenticator app and get the content of the opened interface by abusing Accessibility Service.
counter coroutine: tell the C2 if the smartphone is rooted or not
The first thing startApp is anti-emulation (call to isEmulator). It checks for the presence of generic names in product brand, fingerprint etc.
The malware will perform overlay attack when the victim opens a specific app usually banking apps or cryptocurrency apps to steal the victim’s credentials... The command openinject will open the downloaded WebView... when a targeted app opened.
@FormUrlEncoded @POST("/keylog.php") Call sendKeyLog(@Field("botid") String arg1, @Field("inputLog") String arg2);
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android banking trojan family name referenced via AV signatures; associated with device takeover and man-in-the-browser capabilities to compromise banking sessions and facilitate fraud.
Referenced as another banking trojan known to use JsonPacker-like packing techniques.
Android malware posing as a Minecraft app. It is packed, implemented in Kotlin, communicates with a C2 over Retrofit2, performs country and emulator checks, requests accessibility permissions, starts background services, pings its C2, can hide itself, open the SMS app, report root status, log keystrokes/cookies/2FA data, and hijack cryptocurrency clipboard addresses.
Referenced as the Android banking malware family that earlier introduced cookie-stealing capabilities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.