New Android Trojan 'SoumniBot' Evades Detection with Clever Tricks

SoumniBot is a recently observed Android banking trojan targeting users in South Korea that exploits weaknesses in Android manifest parsing (invalid compression method, misreported archived size, and long XML namespaces) to obfuscate its behavior and hinder analysis; after installation it collects device metadata, contacts, SMS, photos, videos, installed apps and South Korean GPKI banking certificates, maintains persistence, can manipulate contacts/SMS and hide its icon, and communicates with hard-coded C2 servers over MQTT. Google reported no samples on the Play Store and Play Protect protects against known variants.