MITRE ATT&CKsoftware (malware)
S1062 S.O.V.A.
- Domain
- mobile
- Platforms
- Android
- Version
- 1.0
- Created
- 2023-02-06
Description
S.O.V.A. is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. S.O.V.A., which is Russian for "owl", contains features not commonly found in Android malware, such as session cookie theft.
Related
Uses · MITRE ATT&CK (19)
- T1641.001 Transmitted Data Manipulation sub-technique
- T1417.001 Keylogging sub-technique
- T1417.002 GUI Input Capture sub-technique
- T1638 Adversary-in-the-Middle technique
- T1437.001 Web Protocols sub-technique
- T1629.001 Prevent Application Removal sub-technique
- T1636.004 SMS Messages sub-technique
- T1406.002 Software Packing sub-technique
- T1628.001 Suppress Application Icon sub-technique
- T1630.001 Uninstall Malicious Application sub-technique
- T1582 SMS Control technique
- T1516 Input Injection technique
- T1517 Access Notifications technique
- T1513 Screen Capture technique
- T1409 Stored Application Data technique
- T1418 Software Discovery technique
- T1426 System Information Discovery technique
- T1464 Network Denial of Service technique
- T1471 Data Encrypted for Impact technique
References
- https://www.cleafy.com/cleafy-labs/sova-malware-is-back-and-is-evolving-rapidly cleafy_sova_1122
- https://www.threatfabric.com/blogs/sova-new-trojan-with-fowl-intentions.html threatfabric_sova_0921