soumnibot | 57269694dd52f1a2ba397336c00708b2bd694618d61475217ec4e1aeedd6f2bd

Analysis

max time kernel
149s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
28/03/2025, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57269694dd52f1a2ba397336c00708b2bd694618d61475217ec4e1aeedd6f2bd.apk
Size

4.6MB
MD5

4a8a82b154359e5a36442f7e4daaa0ea
SHA1

f18ee68b172e035989ad956f5abfc9d9f8025090
SHA256

57269694dd52f1a2ba397336c00708b2bd694618d61475217ec4e1aeedd6f2bd
SHA512

c55536be1d42444ba30da63df65c100a0ad450c713192f757bb3e89e7ebcf1d28ade3f836ea93ac75e9304d2073922e581ce7b12a55829f1c728ecd4892d3468
SSDEEP

49152:JJWu0JGQRxTV3AnRpJM34m2C+Z7f+9rusvQW4zFJ:JcJGS+Xd7f+9pC

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot
behavioral1/files/fstream-4.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/regblt.ewlgvlrfe.ewdf/app_regblt.ewlgvlrfe.ewdf.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs	4827	regblt.ewlgvlrfe.ewdf
/data/user/0/regblt.ewlgvlrfe.ewdf/app_regblt.ewlgvlrfe.ewdf.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs	4827	regblt.ewlgvlrfe.ewdf

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	regblt.ewlgvlrfe.ewdf

regblt.ewlgvlrfe.ewdf
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4827

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/regblt.ewlgvlrfe.ewdf/app_regblt.ewlgvlrfe.ewdf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
5eba302fbc9fa1302f18a7d9718b1b2d

SHA1
cbb5e86115804d78352f565cf5d829e238cfa598

SHA256
df28507bfcfd95b164fecd28f54cb3766d9eacb49990bdcb54ac365da8774feb

SHA512
b7c75d6caaecff1bd1af1eb24ba2e47dd0dec8d495b985e2ef50422f53cf9a728c83c33c4ad4fcfdda0d2966efcbe2aa1608924f4aa24600a62b17c2539d7cb7

Download Submit
/data/user/0/regblt.ewlgvlrfe.ewdf/app_regblt.ewlgvlrfe.ewdf.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs

Filesize
1.8MB

MD5
6883071e10a4eeacaaa40b21ade236ea

SHA1
d38ab99b48cfcb3bb153f0a0493989615411238a

SHA256
dfe7d9322f19c3d469fb5666250cc3dc1898f71fb6a278f724ef93201d343025

SHA512
262e3562dcac18269940d1f6f8cc08f5cda73f0864e1f78362094435d76b547093f6965d8930decc7cafa0ca8c6538e1cbb2c9099cdc9b7e3d42011ff28569c7

Download Submit