soumnibot | d2511a80ee7ff4d1427bf18c9709e977be64162d66a4f4018ad2cbb7820d3f1f

Analysis

max time kernel
149s
max time network
150s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
27/03/2025, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2511a80ee7ff4d1427bf18c9709e977be64162d66a4f4018ad2cbb7820d3f1f.apk
Size

2.6MB
MD5

d7628e9146c4061f919e3c4fba167cb1
SHA1

e5f656a217af2fd07c6599e80f7216eaa2319364
SHA256

d2511a80ee7ff4d1427bf18c9709e977be64162d66a4f4018ad2cbb7820d3f1f
SHA512

6b893475acfcdad42a36eb85d00144b0fe2ef784fc26aede7bb5a628f67252bd38117380ce444415c5999f2942eb37162251d2f1c96733cf5fe8ffaa6af07ab5
SSDEEP

24576:r6lk4m51+WtE0P057IPeK1lhFdzlt7vGgOwvoqWFwRGer0GuMokDnuApvgkCua/n:mJWu0EQ1vJ4Ao8Cj

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/ewkgvkrf.ewlgvled.fewldw/app_ewkgvkrf.ewlgvled.fewldw.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4436	ewkgvkrf.ewlgvled.fewldw

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	ewkgvkrf.ewlgvled.fewldw

ewkgvkrf.ewlgvled.fewldw
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4436

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ewkgvkrf.ewlgvled.fewldw/app_ewkgvkrf.ewlgvled.fewldw.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
e9f4cf6e7fc30a57af41ad58d164c8f6

SHA1
cb42ab802e7a08e9ce563f733528d30ba2b18588

SHA256
78440731e07b9666dfc9443654843e36eddd67afab56f7793f103e796a26ec4f

SHA512
f08639cd23cf2ac4cb88f5cd884783b9c4360bc7ef11ec106ef9941dae9bad82e600798cb407bf5933bce7d36b291a926c45a741cc34eeff848b296d5eb51205

Download Submit