Previously, #Sova focused on countries like the USA, Russia and Spain and since July 2022 it is now targeting India. The latest version of this malware hides itself within fake Android apps that show up with the logo of a few famous legitimate apps like Chrome, Amazon, NFT platform to deceive users into installing them.

This virus is one of the most dangerous viruses for mobile net banking users in India. It is hard to uninstall and is the fifth version of the first detected virus in Indian cyberspace.

SOVA has other harmful capabilities like keylogging, DDoS, overlay attacks, notification manipulation, and more. Security researchers have also found a rare feature in the malware which allows the SOVA malware to steal session cookies, this feature enables the malware to login into banking accounts without the username and password of the user.

Once the fake android application is installed on the phone, it sends the list of all applications installed on the device to the Command and control server controlled by the threat actor in order to obtain the list of targeted applications, said #CERTIn.

It further says, at this point, the C2 sends back to the malware the list of addresses for each targeted application and stores this information inside an XML file. These targeted applications are then managed through the communications between the malware and the C2.

It has the capability to encrypt all the data. This was reported by the country’s federal #cybersecurity agency. The key feature of SOVA is it is a banking trojan, and is very smart in action. It recodes the protection module that aims to save itself from different victims' actions. In a scenario, when the user tries to uninstall the malware from its setting options on their device.

Then the Sova virus interrupts the actions of the user and automatically returns to the home screen. In the newer version of SOVA, the cybercrooks also added the option to cr.