soumnibot | d978d7616a104438e2a998baac6ca57513938c76dd92c867e4f5669711fca42a

Analysis

max time kernel
149s
max time network
156s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
27/03/2025, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d978d7616a104438e2a998baac6ca57513938c76dd92c867e4f5669711fca42a.apk
Size

1.5MB
MD5

98d31719fea6c3fe19b6ec0425755be3
SHA1

df498e2e49c221cca0ae51cfc3bdaa03eb84c6e4
SHA256

d978d7616a104438e2a998baac6ca57513938c76dd92c867e4f5669711fca42a
SHA512

0f7df492372fd2c78a068669dc07db1785eb2cdadadf648023a79890721616d471ec93555cbabfd319a6c47b7b16d6c7e0758e5c4876329735a6292aecb499d2
SSDEEP

24576:oWX4m51+WtE0RmQte6EtJTzJs/RqpoPv3vYmYZZ18MelS39As:otJWu0RPbACPKiMYSNAs

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/segkvre.wpfvwer.weslf/app_segkvre.wpfvwer.weslf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4606	segkvre.wpfvwer.weslf
/data/user/0/segkvre.wpfvwer.weslf/app_segkvre.wpfvwer.weslf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4606	segkvre.wpfvwer.weslf

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	segkvre.wpfvwer.weslf

segkvre.wpfvwer.weslf
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4606

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/segkvre.wpfvwer.weslf/app_segkvre.wpfvwer.weslf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
a2137ab12b1b06746515c1ccc2d1b413

SHA1
107fac6d41408aaacedd9f2d251b691f55878337

SHA256
3343a28d9a9e4e43da1fef2527f3643c481db0fe9a5ae7729565de57f07b8b5c

SHA512
067ee9cb6f392203b8f36e3f4c2c9e80c39a60f4a60e17135eb3bd9f63ed8853c3e86e60abfa2c370ef504ad6c2c675c8829998aae858673d0d5c161157c1cd7

Download Submit