soumnibot | 4ce976ca41a16d8650d0063b75518a11617fe4854238c3893346edec68650dc8

Analysis

max time kernel
149s
max time network
150s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
27/03/2025, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ce976ca41a16d8650d0063b75518a11617fe4854238c3893346edec68650dc8.apk
Size

2.6MB
MD5

24b1d9f75e257c26d4adff6cbc35ee49
SHA1

3c5c35aea96d50f8665afb755b07a156b78e53a5
SHA256

4ce976ca41a16d8650d0063b75518a11617fe4854238c3893346edec68650dc8
SHA512

32de1fde1314cdc039f8244d21b73c141f8bad2f72bec88169a5ab05de7424614cdff919ab30c1fdae0e9f2efd405a3fce930f5509f8a14bd4316d09fe6f5ce1
SSDEEP

24576:d4m51+WtE0Tmv8iZ32NNl4jo29SD/mzONPJrpjhDpvVq5rKKPqXbl9FpGPg69nfI:+JWu0To2NI9SDjPHj3ONCrj

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/rgvk.ewpfver.welfdv/app_rgvk.ewpfver.welfdv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4469	rgvk.ewpfver.welfdv

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	rgvk.ewpfver.welfdv

rgvk.ewpfver.welfdv
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4469

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rgvk.ewpfver.welfdv/app_rgvk.ewpfver.welfdv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
7ee51b48af5a90d9a9d4cfdda66a7dd6

SHA1
fc0b1eb14d57713c0317d92c5ec04b44411776a1

SHA256
3c1d79f373a3084cd39e386072391733fb1d62f8caba95bd2cbc1b3f052e5e8b

SHA512
fa5627ab9e269bc05c28948fef87081eb94fc7d67074f7a1c304ac035a2ee5423866b5b96d10d86505c94a36ed867fb8785691a4cd8f9dc93119a1cdd000bd22

Download Submit