Eyes on Android/S.O.V.A botnet sample

Summary

• Sample c1642ac3f729701223043b16ac2c6c5f64adc7080f474c181067b0f1335218f2


• Poses as a Minecraft app


• Malicious Android/S.O.V.A botnet client


• Packed


• Implemented in Kotlin


• Uses Retrofit2 for communication with C2


• The C2 is down currently

An excellent analysis here.

I try to highlight different aspects:

1. How to unpack with Medusa


2. How the malware sets up on first launch


3. How to reverse Retrofit2 communications


4. Support for encrypted logs

Unpacking with Medusa

This sample is packed, and can be unpacked with Medusa, using memory_dump/dump_dex.

analysis android app botnet client communication communications down kotlin malicious malware malware analysis medusa minecraft reverse sample support