Security News > 2024 > April > SoumniBot malware exploits Android bugs to evade detection
A new Android banking malware named 'SoumniBot' is using a less common obfuscation approach by exploiting weaknesses in the Android manifest extraction and parsing procedure.
The method enables SoumniBot to evade standard security measures found in Android phones and perform info-stealing operations.
The malware was discovered and analyzed by Kaspersky researchers, who provide the technical details on the methods the malware uses to take advantage of the Android routine to parse and extract APK manifests.
First, SoumniBot uses an invalid compression value when unpacking the APK's manifest file, which diverges from the standard values expected by the Android 'libziparchive' library tasked with the role.
Anatsa Android malware downloaded 150,000 times via Google Play.
Vultur banking malware for Android poses as McAfee Security app.
News URL
Related news
- Hackers exploit WordPress plugin flaw to infect 3,300 sites with malware (source)
- Malware Campaign Exploits Popup Builder WordPress Plugin to Infect 3,900+ Sites (source)
- PixPirate Android malware uses new tactic to hide on phones (source)
- Hackers exploit Windows SmartScreen flaw to drop DarkGate malware (source)
- Vultur banking malware for Android poses as McAfee Security app (source)
- CoralRaider Malware Campaign Exploits CDN Cache to Spread Info-Stealers (source)
- New Brokewell malware takes over Android devices, steals data (source)
- New 'Brokewell' Android Malware Spread Through Fake Browser Updates (source)
- New Wpeeper Android malware hides behind hacked WordPress sites (source)
- Android Malware Wpeeper Uses Compromised WordPress Sites to Hide C2 Servers (source)