soumnibot | 5918e2b6e0c7ac00b366247a34f3e5f5a6fb8ceb97b16e468014fbb720155a31

Analysis

max time kernel
149s
max time network
150s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
03/04/2025, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5918e2b6e0c7ac00b366247a34f3e5f5a6fb8ceb97b16e468014fbb720155a31.apk
Size

2.6MB
MD5

39f17a1970ac8605277902cbc62456d5
SHA1

c1c7708cf92bc992f374082fb81337ee8edf11e1
SHA256

5918e2b6e0c7ac00b366247a34f3e5f5a6fb8ceb97b16e468014fbb720155a31
SHA512

232f99f6674fd9a7073a19a3e89ab10361c0c7e1e527937259f5fecb5f49b49afd76c44ed10ca5dc9d7877638d09e1643b8bf39a26562a3f97eac0a4a7ef9405
SSDEEP

24576:3HzhW/4m51+WtE09B1FiQHJ/zdsFdoztuM/Pc//Zmmc8I/qfC5W1:XfJWu09VJ/TE//ZmebC5u

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/reogo.eswpgfvrd.frdblg/app_reogo.eswpgfvrd.frdblg.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4629	reogo.eswpgfvrd.frdblg
/data/user/0/reogo.eswpgfvrd.frdblg/app_reogo.eswpgfvrd.frdblg.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4629	reogo.eswpgfvrd.frdblg

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	reogo.eswpgfvrd.frdblg

reogo.eswpgfvrd.frdblg
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4629

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/reogo.eswpgfvrd.frdblg/app_reogo.eswpgfvrd.frdblg.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
4fbd445e22bd7404f2866506a295cb98

SHA1
4667cb3c7f5f8dca7c36f7253f2966e92336d9b3

SHA256
a12606a57d3ad307642d963e07d22d014ed481b32ee0547af2c59944831d03e2

SHA512
aff72ced79517df2188ad23f5433bbba966e34a179567b87d7ab8d7beea73100f2fc4529ec82580e7e47682d202cc803ade469a99271507cafbaabe2a9a45cd1

Download Submit