soumnibot | e205a53437b758668018ffdb0732e56e7b76886e86f42e4f47deb350e38b11d9

Analysis

max time kernel
149s
max time network
160s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
28/03/2025, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e205a53437b758668018ffdb0732e56e7b76886e86f42e4f47deb350e38b11d9.apk
Size

2.6MB
MD5

1135d069557982f37d42249340fb0bd0
SHA1

6cc0a655e9749c91d7a5fe862813dabafd771e7e
SHA256

e205a53437b758668018ffdb0732e56e7b76886e86f42e4f47deb350e38b11d9
SHA512

9f1722bb12ba750b3bd5413897873054d8bc3daaffe6efff44b50ad6d018c36b742fa2fc79f88531d147b50f6cf42471bd8ed174ef36223961ba0cc12f016472
SSDEEP

24576:r6lk4m51+WtE0P057IPeK1lhFdzlt7vGgOwvoqWFwRGer0GuMokDnuApvgkCPapj:mJWu0EQ1vJ4Ao8Ci

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/ewkgvkrf.ewlgvled.fewldw/app_ewkgvkrf.ewlgvled.fewldw.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4828	ewkgvkrf.ewlgvled.fewldw
/data/user/0/ewkgvkrf.ewlgvled.fewldw/app_ewkgvkrf.ewlgvled.fewldw.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4828	ewkgvkrf.ewlgvled.fewldw

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	ewkgvkrf.ewlgvled.fewldw

ewkgvkrf.ewlgvled.fewldw
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4828

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ewkgvkrf.ewlgvled.fewldw/app_ewkgvkrf.ewlgvled.fewldw.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
e9f4cf6e7fc30a57af41ad58d164c8f6

SHA1
cb42ab802e7a08e9ce563f733528d30ba2b18588

SHA256
78440731e07b9666dfc9443654843e36eddd67afab56f7793f103e796a26ec4f

SHA512
f08639cd23cf2ac4cb88f5cd884783b9c4360bc7ef11ec106ef9941dae9bad82e600798cb407bf5933bce7d36b291a926c45a741cc34eeff848b296d5eb51205

Download Submit