soumnibot | 815744d6db373c14db8830b433ea56d32057dc9bc7bce93a01cccf6c66d5ead5

Analysis

max time kernel
149s
max time network
151s
platform
android-11_x64
resource
android-x64-arm64-20240910-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240910-enlocale:en-usos:android-11-x64system
submitted
03/04/2025, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

815744d6db373c14db8830b433ea56d32057dc9bc7bce93a01cccf6c66d5ead5.apk
Size

4.5MB
MD5

0d926e9ff9e7da39dbbc228540ffb558
SHA1

0b1f66bb4ba1a9c150beb761922acb9dd8d94d79
SHA256

815744d6db373c14db8830b433ea56d32057dc9bc7bce93a01cccf6c66d5ead5
SHA512

94e81cbcee4620f95a333153126df9432a399a718dd122d8784936ab658478b4ba3d05ceef62b9b4dd8d15550af16602c92dcaf70b77083bd8e621f14355c6e8
SSDEEP

49152:LJWu0/9Sn0DhYXU+OI2dbHBighsD98OVBZepkPh8CrzcbPk73o7:LcIn091+OI2dbHBighsBFVBZ5E7

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot
behavioral1/files/fstream-4.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/srgvksrd.wepfvesd.rbefd/app_srgvksrd.wepfvesd.rbefd.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs	4780	srgvksrd.wepfvesd.rbefd
/data/user/0/srgvksrd.wepfvesd.rbefd/app_srgvksrd.wepfvesd.rbefd.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs	4780	srgvksrd.wepfvesd.rbefd

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	srgvksrd.wepfvesd.rbefd

srgvksrd.wepfvesd.rbefd
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4780

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/srgvksrd.wepfvesd.rbefd/app_srgvksrd.wepfvesd.rbefd.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
e37a0f9eec43e80ff23bf1415d6621c2

SHA1
0f75819cd26b4f38ece481140485ea1554b012d9

SHA256
64bcebd80ec022425c536c39b20f13718c42ecd7de9367438417525617b9e86d

SHA512
77e9567716eb971d8e46d6646d2e6cc6cc4ae38f930307f0ddbddde221c573cb8e953a5415963748dc04233502e4721baccb490eb61786ed5ba49e098f83472b

Download Submit
/data/user/0/srgvksrd.wepfvesd.rbefd/app_srgvksrd.wepfvesd.rbefd.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs

Filesize
1.8MB

MD5
5db6f923ae09b5b5ac4585240c1ab3de

SHA1
6e2bd0d309ad8111fbfa45f551576bfdb0e19196

SHA256
712d4bd8072577c539dea657fcb0b30b444b51718c95057c249bd6413baca11c

SHA512
2a2392181a639fb0c9e82bf426234e306ddc7d2ad7aa5ca9ffad595b410e4224e092b34ebdf469311c3d568caf8ac3832bb3ea6bef6bd25b89e68c9696836093

Download Submit