soumnibot | 1c9d76686ad2e5b6a7311f76d94edbf6afd49ebf3aa8d5f37f1ae8dfa9ac4998

Analysis

max time kernel
149s
max time network
152s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
28/03/2025, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c9d76686ad2e5b6a7311f76d94edbf6afd49ebf3aa8d5f37f1ae8dfa9ac4998.apk
Size

2.6MB
MD5

bc3176be014ab54f1695ac5bc1f5b4dd
SHA1

fe2035d3bffafb9877eba4ce2e90498b29bce9b0
SHA256

1c9d76686ad2e5b6a7311f76d94edbf6afd49ebf3aa8d5f37f1ae8dfa9ac4998
SHA512

caf72c130f793eed29816f0a8b0efa1e139b651d1f67086b1e4de19dabb8b2afe69b2e7ef4ed11348bd6de8a82607ad51309dced95c145577906bbb9d575d61c
SSDEEP

24576:NWS4m51+WtE09Bt4sgkdSUHqq22LyfuCSI8biYcAgJEotrD/7CUaK8:ERJWu0JReFXAgJztrC1

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/rkgkrd.ewfgrveodb.lsdefv/app_rkgkrd.ewfgrveodb.lsdefv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4742	rkgkrd.ewfgrveodb.lsdefv
/data/user/0/rkgkrd.ewfgrveodb.lsdefv/app_rkgkrd.ewfgrveodb.lsdefv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4742	rkgkrd.ewfgrveodb.lsdefv

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	rkgkrd.ewfgrveodb.lsdefv

rkgkrd.ewfgrveodb.lsdefv
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4742

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rkgkrd.ewfgrveodb.lsdefv/app_rkgkrd.ewfgrveodb.lsdefv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
0409d3d406bef5fdcc0293255027448a

SHA1
a9d1da5483a54739a5a7f5f1f557fa1d48fe0f5e

SHA256
4b7f823fe3aa8d81a2dd956a36e51c9a6b93dfab9b28179adac8f2f5f9934ede

SHA512
d9189af5e44bd1d7f59dc9e78c953951cf1ed63b3769b230adc94df2cdba5c2eb151d88c68e7612b1dac0198d15b86a13a59fce6edf502515b8867c0a0fabd92

Download Submit