soumnibot | 41e6a34e85a40cbe8036c3e3d94ad4211113bf46b8198d13cc0a8068b66046b4

Analysis

max time kernel
149s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
28/03/2025, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41e6a34e85a40cbe8036c3e3d94ad4211113bf46b8198d13cc0a8068b66046b4.apk
Size

4.6MB
MD5

f5d0d03ae1b183be41325a4e30780ad0
SHA1

4334bca23ab1c692889863017ae9d893d4e55974
SHA256

41e6a34e85a40cbe8036c3e3d94ad4211113bf46b8198d13cc0a8068b66046b4
SHA512

97375e3d0c20fb3ff27286fa8870d8ee8a557e3ff3191639474cc8293049b7ad64e76bcfccae84264bb03859f9f87f491bf3daebccb80b99920f0b9c413616fb
SSDEEP

49152:JJWu0JGQRxTV3AnRpJM34m2CnByf+9rusvQW4zFG:JcJGS+XQyf+9pH

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot
behavioral1/files/fstream-4.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/regblt.ewlgvlrfe.ewdf/app_regblt.ewlgvlrfe.ewdf.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs	4608	regblt.ewlgvlrfe.ewdf
/data/user/0/regblt.ewlgvlrfe.ewdf/app_regblt.ewlgvlrfe.ewdf.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs	4608	regblt.ewlgvlrfe.ewdf

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	regblt.ewlgvlrfe.ewdf

regblt.ewlgvlrfe.ewdf
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4608

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/regblt.ewlgvlrfe.ewdf/app_regblt.ewlgvlrfe.ewdf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
5eba302fbc9fa1302f18a7d9718b1b2d

SHA1
cbb5e86115804d78352f565cf5d829e238cfa598

SHA256
df28507bfcfd95b164fecd28f54cb3766d9eacb49990bdcb54ac365da8774feb

SHA512
b7c75d6caaecff1bd1af1eb24ba2e47dd0dec8d495b985e2ef50422f53cf9a728c83c33c4ad4fcfdda0d2966efcbe2aa1608924f4aa24600a62b17c2539d7cb7

Download Submit
/data/user/0/regblt.ewlgvlrfe.ewdf/app_regblt.ewlgvlrfe.ewdf.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs

Filesize
1.8MB

MD5
6883071e10a4eeacaaa40b21ade236ea

SHA1
d38ab99b48cfcb3bb153f0a0493989615411238a

SHA256
dfe7d9322f19c3d469fb5666250cc3dc1898f71fb6a278f724ef93201d343025

SHA512
262e3562dcac18269940d1f6f8cc08f5cda73f0864e1f78362094435d76b547093f6965d8930decc7cafa0ca8c6538e1cbb2c9099cdc9b7e3d42011ff28569c7

Download Submit