soumnibot | f7bfb1fb5e20a0febb56ff4a2205416bcaf69a4b9f27064cde0f6e9909372a86

Analysis

max time kernel
149s
max time network
154s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
03/04/2025, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7bfb1fb5e20a0febb56ff4a2205416bcaf69a4b9f27064cde0f6e9909372a86.apk
Size

2.6MB
MD5

8d273d8229ecd9d76cf7bda9e56c2737
SHA1

85b058743092146942a819917aa477f3b383e93e
SHA256

f7bfb1fb5e20a0febb56ff4a2205416bcaf69a4b9f27064cde0f6e9909372a86
SHA512

e97b05b440e81fcaa83c91a881c757aa9bd72f02ba6559e16a79087809d0d4c99c564a88096a7ac71c208eb9ecc5a4206176ae2464385846915986b910a09356
SSDEEP

24576:Z4m51+WtE0GCCe9NR5QNf2caFEd+hpUS3Zkr/1yaumJ8n0n6J4Y5aDH:CJWu0GC3BlC+ky+JmI

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/dfrgker.sedpgvoer.swedgv/app_dfrgker.sedpgvoer.swedgv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4819	dfrgker.sedpgvoer.swedgv
/data/user/0/dfrgker.sedpgvoer.swedgv/app_dfrgker.sedpgvoer.swedgv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4819	dfrgker.sedpgvoer.swedgv

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	dfrgker.sedpgvoer.swedgv

dfrgker.sedpgvoer.swedgv
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4819

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/dfrgker.sedpgvoer.swedgv/app_dfrgker.sedpgvoer.swedgv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
a498a4aed23e3c09070191c45566ec53

SHA1
17508350b3472a7982713c500595ed623139ece1

SHA256
0c07a0d9b5ac37e2969cacc98105502f6820ee9ceef024c4994d01dab8860cb0

SHA512
25abccf23fc3e006284492396158fa8398023347785d2c2d0fcba02bed1b51bc09c5f934912b3e8afb81d9d39b3332488d320f0be4d39a290d947e20aa1ac69f

Download Submit