soumnibot | 3e1c684a5c9eed928cf832c5da9deacd4b95c617b5199406ccda01d1a5abae6e

Analysis

max time kernel
149s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
27/03/2025, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e1c684a5c9eed928cf832c5da9deacd4b95c617b5199406ccda01d1a5abae6e.apk
Size

1.5MB
MD5

a1b02b5f58d2f5a136631481ef632edc
SHA1

979e74694332bbe3ae82cd021fe1cd24cb9bd65d
SHA256

3e1c684a5c9eed928cf832c5da9deacd4b95c617b5199406ccda01d1a5abae6e
SHA512

732071f4a309f96bca9d3c69913eab3ab1127ab034694171860959005547d5d2598c253db283e27a5373af412fd5651508a33459112e0ba79638c436219f073c
SSDEEP

24576:oWX4m51+WtE0RmQte6EtJTzJs/RqpoPv3vYmYZZ18MelS39A5:otJWu0RPbACPKiMYSNA5

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/segkvre.wpfvwer.weslf/app_segkvre.wpfvwer.weslf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4739	segkvre.wpfvwer.weslf
/data/user/0/segkvre.wpfvwer.weslf/app_segkvre.wpfvwer.weslf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4739	segkvre.wpfvwer.weslf

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	segkvre.wpfvwer.weslf

segkvre.wpfvwer.weslf
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4739

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/segkvre.wpfvwer.weslf/app_segkvre.wpfvwer.weslf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
a2137ab12b1b06746515c1ccc2d1b413

SHA1
107fac6d41408aaacedd9f2d251b691f55878337

SHA256
3343a28d9a9e4e43da1fef2527f3643c481db0fe9a5ae7729565de57f07b8b5c

SHA512
067ee9cb6f392203b8f36e3f4c2c9e80c39a60f4a60e17135eb3bd9f63ed8853c3e86e60abfa2c370ef504ad6c2c675c8829998aae858673d0d5c161157c1cd7

Download Submit