soumnibot | b36a9e05332bdc76692c585d0349f905dc684f6515b55d3e59c397d70f6ef7e2

Analysis

max time kernel
149s
max time network
160s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
03/04/2025, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b36a9e05332bdc76692c585d0349f905dc684f6515b55d3e59c397d70f6ef7e2.apk
Size

2.6MB
MD5

36850c62ab613134ee010798f2dabc3d
SHA1

65e8707d73f172044e7e2d0524cb461ed8c97aac
SHA256

b36a9e05332bdc76692c585d0349f905dc684f6515b55d3e59c397d70f6ef7e2
SHA512

5109bfc7d4e96cfb6128605296c86d99a50b103636e2b40779641b70c18a002c2ac7ba5311d4ff47e8c8b8b58d50296349ad8a640f792149938fdbed402d9510
SSDEEP

24576:PN4m51+WtE0FmHvFqfE6T73A69zpzmu5njRhVMZleC1qy:PuJWu0FUi73AUCu5nRjC1z

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/edwglvle.pwegdover.flbdr/app_edwglvle.pwegdover.flbdr.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4486	edwglvle.pwegdover.flbdr

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	edwglvle.pwegdover.flbdr

edwglvle.pwegdover.flbdr
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4486

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/edwglvle.pwegdover.flbdr/app_edwglvle.pwegdover.flbdr.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
44a67b20ddf9e8d370f3773f8df7dc57

SHA1
8b2b611f91bc83f744baf367448dca426e004820

SHA256
e53a5aa1490b18a6d2995a7fa9e7568769433e84949ff5b02d786129fbdfbb9d

SHA512
c43a315928dd40aa60e93612f92ce22c544395f522cdb211fc88f8aac3f7b7edd85f4eb78324b17fcf4b965f62a761bcedda2d70506d71ba56cb79528fc66e60

Download Submit