Deep-dive Analysis of S.O.V.A. Android Banking Trojan

Cyble Research Labs analyzed S.O.V.A., a new Android banking trojan advertised on a darkweb forum that targets Android 7–11 (planned Android 12 support) and a wide list of banking/crypto apps. The report documents APK metadata (SHA256 hashes), dangerous permissions, manifest components (accessibility, notification listener, default SMS handling), detailed source-code behaviors (C2 commands, overlays/webview injections, cookie stealing, keylogging, SMS/clipboard monitoring), C2 URLs, and IoCs, and provides mitigation guidance and mappings to MITRE ATT&CK techniques.