soumnibot | 583c99ffd90b78e2109dfd701ec3bf895fa41c5194d62ec8472c128e163b7a7b

Analysis

max time kernel
149s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
03/04/2025, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

583c99ffd90b78e2109dfd701ec3bf895fa41c5194d62ec8472c128e163b7a7b.apk
Size

2.6MB
MD5

2c818a320108e8dec687b75f8355097a
SHA1

a8244bf031c2e9c8625d78ba1bca31f96e852f81
SHA256

583c99ffd90b78e2109dfd701ec3bf895fa41c5194d62ec8472c128e163b7a7b
SHA512

417f1efbeae33e6c966294b38c57972849869258a2f1916b55dd1de3d78ac3eba27ade8ec2e82d9936252f07ab071e6269afd93fa8314641db4732e81806744c
SSDEEP

24576:IF54m51+WtE0ANhf6DJfdD5nIRkE6r0lgCNcsij34w4k/CQPg:PJWu0uysij3zCQI

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/rfegov.ewrpgvore.erf/app_rfegov.ewrpgvore.erf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4799	rfegov.ewrpgvore.erf
/data/user/0/rfegov.ewrpgvore.erf/app_rfegov.ewrpgvore.erf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4799	rfegov.ewrpgvore.erf

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	rfegov.ewrpgvore.erf

rfegov.ewrpgvore.erf
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4799

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rfegov.ewrpgvore.erf/app_rfegov.ewrpgvore.erf.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
55b375afc965a0cb6e33a4750f181a30

SHA1
b4fbe7f2160cfa35db3a16fe042be78a47745119

SHA256
edc699ecaa4f1f82c12a5c03210b3914f9889200328ad2ceadf80f0b7dfe3257

SHA512
b587c5385a762c354c20439bfe7cc6a1a21b9d876ba59b46b77001a121dc05f62a7a2edbf30105a4c2a014c0215db8bc8d39063be2fb9fdf25eec2467be26516

Download Submit