SoumniBot: recovered C2 indicators & analysis

What SoumniBot is

SoumniBot is an Android banking trojan first publicly documented by Kaspersky (Securelist) in April 2024. It targets users in South Korea and is distinguished less by its stealing routines than by an unusual anti-analysis approach: it manipulates the way its AndroidManifest.xml is packed inside the APK so that Android's own parser installs the app correctly while many third-party analysis and unpacking tools fail to read the manifest.

The manifest evasion relies on three documented tricks against the APK/manifest parsing procedure. First, the malware sets an invalid ZIP compression-method value for the AndroidManifest.xml entry; because the Android parser treats any value other than 0x0008 (DEFLATED) as stored/uncompressed, the file loads while tools expecting standard values misparse it. Second, it declares a manifest size larger than the actual data, causing an overlay in which trailing archive bytes are appended to the unpacked manifest. Third, it uses very long XML namespace names, which the Android parser ignores but which can exhaust memory in analysis tooling. Kaspersky noted the oversized-manifest technique had been seen in other Android bankers since April 2023.

Operationally, SoumniBot runs a background service that restarts roughly every 16 minutes if killed and uploads harvested device data about every 15 seconds. It collects the device IP address (and country inferred from it), contact and account lists, SMS/MMS messages, photos, videos, and the list of installed apps, and generates a victim identifier using the trustdevice-android library. A notable capability is theft of Korean online-banking digital certificates: it searches external storage for .key and .der files under paths such as /NPKI/yessign, archives the containing directory into a ZIP, and exfiltrates it, enabling abuse of the victim's banking authentication material.

For command-and-control, SoumniBot uses two channels configured from a hardcoded address: a 'mainsite' server that receives collected data (over HTTP) and an MQTT broker the malware subscribes to for receiving commands. Documented MQTT-driven functions include exfiltrating all messages/contacts/accounts/media/certificates, sending SMS messages, adding and deleting contacts, retrieving photos/videos and the installed-app list, toggling silent mode, enabling Android debug mode, and hiding its launcher icon to hinder removal. Kaspersky detects the family as Trojan-Banker.AndroidOS.SoumniBot; reported samples were distributed outside Google Play.

Capabilities

• AndroidManifest.xml obfuscation via invalid ZIP compression-method value
• Oversized/overlaid manifest size to break third-party parsers
• Overlong XML namespace names to exhaust analysis tooling memory
• Theft of Korean online-banking digital certificates (.key/.der under /NPKI/yessign) via ZIP exfiltration
• Reads and exfiltrates SMS/MMS messages
• Sends SMS messages on command
• Adds and deletes contacts
• Harvests contact and account lists
• Exfiltrates photos, videos, and installed-app list
• Collects device IP and derives geolocation/country
• Generates a victim ID via the trustdevice-android library
• MQTT-based command reception with a separate HTTP 'mainsite' upload server
• Persistent background service that restarts about every 16 minutes
• Periodic data upload roughly every 15 seconds
• Hides its launcher icon to impede uninstallation
• Toggles device silent mode and enables Android debug mode

Known C2 / channel types: MQTT, HTTP(S).

MITRE ATT&CK (Mobile)

Techniques commonly associated with SoumniBot:

What Privara Unmask recovered

Two C2 endpoints were recovered, including an MQTT broker on port 1883 — SoumniBot's documented command channel. This matched known public reporting on the family's use of MQTT. The analysis ran on a de-emulated Android 17 device that the sample could not fingerprint as virtual, so it behaved as it would on a real handset.

Indicators of compromise (IOCs)

External references

• Analysis of the SoumniBot Android banker
  Kaspersky Securelist
• SoumniBot malware exploits Android bugs to evade detection
  BleepingComputer
• New Android Trojan 'SoumniBot' Evades Detection with Clever Tricks
  The Hacker News
• SoumniBot (apk.soumnibot)
  Malpedia (Fraunhofer FKIE)
• SoumniBot: The New Android Banker's Unique Techniques
  GBHackers on Security

Methodology & honest limits

This sample was obtained from MalwareBazaar and detonated in a controlled, isolated environment. C2 identity was recovered from the executing sample and its configuration. We report only what the analysis established: an offline sample yields a C2 identity, not a live beacon, and we say so. Nothing here is inferred beyond the evidence.