soumnibot | 3a36b482f8e5c8095b578e8fba131ba68f9143c8f7328a3d824295c34e9bea06

Analysis

max time kernel
149s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
16-02-2025 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a36b482f8e5c8095b578e8fba131ba68f9143c8f7328a3d824295c34e9bea06.apk
Size

2.6MB
MD5

1479701713461763120868530052b08f
SHA1

149ed89fc14e9f0add4eeffdd3623d2d6eb161e7
SHA256

3a36b482f8e5c8095b578e8fba131ba68f9143c8f7328a3d824295c34e9bea06
SHA512

9cddf5e4564a2aeff22efe914ad10c45c19c02f50fe575f1379ba77a99e59f9e592c6ad09385c589742c1b40fdc646836afe329cb83e0fa891f10ddcd13adacb
SSDEEP

24576:Z4m51+WtE0GCCe9NR5QNf2caFEd+hpUS3Zkr/1yaumJ8n0n6J4Yma4x:CJWu0GC3BlC+ky+Jmi

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/dfrgker.sedpgvoer.swedgv/app_dfrgker.sedpgvoer.swedgv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4783	dfrgker.sedpgvoer.swedgv
/data/user/0/dfrgker.sedpgvoer.swedgv/app_dfrgker.sedpgvoer.swedgv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4783	dfrgker.sedpgvoer.swedgv

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	dfrgker.sedpgvoer.swedgv

dfrgker.sedpgvoer.swedgv
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4783

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/dfrgker.sedpgvoer.swedgv/app_dfrgker.sedpgvoer.swedgv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
a498a4aed23e3c09070191c45566ec53

SHA1
17508350b3472a7982713c500595ed623139ece1

SHA256
0c07a0d9b5ac37e2969cacc98105502f6820ee9ceef024c4994d01dab8860cb0

SHA512
25abccf23fc3e006284492396158fa8398023347785d2c2d0fcba02bed1b51bc09c5f934912b3e8afb81d9d39b3332488d320f0be4d39a290d947e20aa1ac69f

Download Submit