SoumniBot

Analysis of the SoumniBot Android banker | Securelist

Researchers reported that SoumniBot, an Android banking Trojan targeting users in South Korea, abuses weaknesses in APK and AndroidManifest.xml handling to evade detection and frustrate analysis tools. The malware uses malformed ZIP compression values, incorrect manifest size fields, and unusually long XML namespace names, allowing the malicious app to install on Android devices while causing some security and inspection tools to fail; the report noted that Google’s apkanalyzer could not properly process certain samples, and Google was notified. Once executed, SoumniBot retrieves configuration data for exfiltration and MQTT-based command-and-control, hides its app icon, and continuously uploads contacts, messages, account details, and device information. It can also receive commands to steal more data, alter contacts and device settings, send SMS messages, and enumerate installed apps, with a notable focus on locating Korean online banking certificate files under /NPKI/yessign, archiving them, and sending them to its command-and-control server.