soumnibot | f369ed5ebd9ad3a79f84b0103bfdc1cd6b1e01928cabf6d3d7e6f3d5e276b26f

Analysis

max time kernel
149s
max time network
151s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
27/03/2025, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f369ed5ebd9ad3a79f84b0103bfdc1cd6b1e01928cabf6d3d7e6f3d5e276b26f.apk
Size

2.6MB
MD5

d2b196e1e993a5543e30e30a10ca2629
SHA1

a64967c5e2b5f5ed5f65dce95b4db968385fa7ea
SHA256

f369ed5ebd9ad3a79f84b0103bfdc1cd6b1e01928cabf6d3d7e6f3d5e276b26f
SHA512

a3e477d2d6a8b80908e04043db804c7202b952002e52eecdfdeb75ceb121f94db1c1ee0188c25295c016b7f239d71d1b08926078ee9727df1a29b68e0f54b589
SSDEEP

24576:d4m51+WtE0Tmv8iZ32NNl4jo29SD/mzONPJrpjhDpvVq5rKKPqXbl9FpGPg69nfw:+JWu0To2NI9SDjPHj3ONCSy

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/rgvk.ewpfver.welfdv/app_rgvk.ewpfver.welfdv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4500	rgvk.ewpfver.welfdv

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	rgvk.ewpfver.welfdv

rgvk.ewpfver.welfdv
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4500

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rgvk.ewpfver.welfdv/app_rgvk.ewpfver.welfdv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
7ee51b48af5a90d9a9d4cfdda66a7dd6

SHA1
fc0b1eb14d57713c0317d92c5ec04b44411776a1

SHA256
3c1d79f373a3084cd39e386072391733fb1d62f8caba95bd2cbc1b3f052e5e8b

SHA512
fa5627ab9e269bc05c28948fef87081eb94fc7d67074f7a1c304ac035a2ee5423866b5b96d10d86505c94a36ed867fb8785691a4cd8f9dc93119a1cdd000bd22

Download Submit