soumnibot | 99bc71635288a4b3c1b89938917c26e52352a96f4f8ea727bd35d2cd3bc3f072

Analysis

max time kernel
149s
max time network
146s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
09-02-2025 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99bc71635288a4b3c1b89938917c26e52352a96f4f8ea727bd35d2cd3bc3f072.apk
Size

2.6MB
MD5

46248fdc3a70eb14e4c8c205ba226bc6
SHA1

f653c68b452761a4fdef68916f6ee2ad8fdc028a
SHA256

99bc71635288a4b3c1b89938917c26e52352a96f4f8ea727bd35d2cd3bc3f072
SHA512

cd600762b71ee0190ad24aae35a50fcb8e8c52107dc622d33125d27e9d48e11d22129311d636121973720ba5459cc466c3e441ddb2738e506e3fae0c6a099657
SSDEEP

24576:E4m51+WtE0tCtoQgh+zRnadKTmguavUTZmImS+ci2w6p4Ctj3jbB7q:jJWu0tC1nyguaqFi2w6pRttW

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/rgewefc.sdpvodesv.ewfdl/app_rgewefc.sdpvodesv.ewfdl.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4617	rgewefc.sdpvodesv.ewfdl
/data/user/0/rgewefc.sdpvodesv.ewfdl/app_rgewefc.sdpvodesv.ewfdl.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4617	rgewefc.sdpvodesv.ewfdl

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	rgewefc.sdpvodesv.ewfdl

rgewefc.sdpvodesv.ewfdl
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4617

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rgewefc.sdpvodesv.ewfdl/app_rgewefc.sdpvodesv.ewfdl.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
2e8c089d4e7dec26949d2cf31417b1ca

SHA1
c395cae3189bb321fd72d5b575b7fd9baeb2aab5

SHA256
864f99727c0fe13cce0b551cddd0bae2db973b94579f70a64d043c9ab1fade13

SHA512
47df3a1335969592730fb54a8d4051615e8c01bf339ba7295a53a5f0b6d9716986374b8c8340ac74c09d5cf9ef70bd98b59963968750a3f73092bf6456fbe5d9

Download Submit