soumnibot | f1a6f7c65a91cc2e78c75e5eebd10b294ee132795d70e5d5104e5a8812f5acd4

Analysis

max time kernel
148s
max time network
152s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
03/04/2025, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1a6f7c65a91cc2e78c75e5eebd10b294ee132795d70e5d5104e5a8812f5acd4.apk
Size

2.6MB
MD5

0ae3f2ff02b4c7c43df449664b54c35a
SHA1

a3b5aa9bd4cb6ee24e956d857807d1e41567791d
SHA256

f1a6f7c65a91cc2e78c75e5eebd10b294ee132795d70e5d5104e5a8812f5acd4
SHA512

6b0919ff838356028957b61dc76bd2cdab6fa688260416ba05ffdb786fc75c144e7590911f83e8e3fda731f29aba3b0156810c6e2d69e17eed206ead515b1eb0
SSDEEP

24576:K2An4m51+WtE0x0J534E7fYOpPseljmkIrPN98m0eCffEDh3nMFl59zYXg7VHLz3:K74JWu0IJSeljo4R9jCIzp

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/rfgbrd.ewsdgvfr.edwksg/app_rfgbrd.ewsdgvfr.edwksg.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4509	rfgbrd.ewsdgvfr.edwksg

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	rfgbrd.ewsdgvfr.edwksg

rfgbrd.ewsdgvfr.edwksg
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4509

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rfgbrd.ewsdgvfr.edwksg/app_rfgbrd.ewsdgvfr.edwksg.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
9edef51a372b9073da1568cda37f023c

SHA1
3a6ac385f43c0d413a06607f5f6dbb6d542105b3

SHA256
548222c021b9d62acb63b094da05a35987c2e18f35e60ff48904afffddbb9410

SHA512
c3129d4928623e545f06a388fe950b1217796de8a224157b84b0af870d45909f9f2ec5738d2c9f6cd908221df3770b311453feb1b00a5f7dbd387e22dd687dc2

Download Submit