Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    android-13_x64
  • resource
    android-33-x64-arm64-20240910-en
  • resource tags

    arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
  • submitted
    03/04/2025, 22:05

General

  • Target

    f636b31d60db339f6f25414d30ad5dff1d61c888583bdea5f345e11680a83562.apk

  • Size

    4.6MB

  • MD5

    0f1d58d82c7697426e131a5ea69f2332

  • SHA1

    e559378be62d6e0ba7d67eec88b0c97b88867576

  • SHA256

    f636b31d60db339f6f25414d30ad5dff1d61c888583bdea5f345e11680a83562

  • SHA512

    7d7ed3d25adf1f85d7bbf18a6deb943c624358cec062e8734e063649a590d7ab4618e69fc129e45dfb545e89c28a1d73048d3e86fa4f23fb712d6589c64504bc

  • SSDEEP

    49152:vAJWu04F3r8PtLxej5aC1dGuK9wZdR5KmUS1wX:YcHmFdVK9wZ/5K3X

Malware Config

Signatures

  • Android SoumniBot payload 2 IoCs
  • SoumniBot

    SoumniBot is an Android banking trojan first seen in April 2024.

  • Soumnibot family
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

Processes

  • edsvfkdsk.awspfvsed.sdefv
    1⤵
    • Loads dropped Dex/Jar
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    PID:4499

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/edsvfkdsk.awspfvsed.sdefv/app_edsvfkdsk.awspfvsed.sdefv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

    Filesize

    1.8MB

    MD5

    25cc6e0380b052d44964f7d7584977ba

    SHA1

    9b4e992b4d91dbff9c1b9e038a5a474490f73b03

    SHA256

    c724f6aa08eb4ab74b185451fa750f860b0c7450679159ac4ad243ceb1a839c5

    SHA512

    b1ec21d8d1c57c7a31172260f0a8add1fc3e49e38b4e6bc09c763f67d61c5d89ea78b68ea1c1d751c554c07d0267f4910427492e987d3af587bbe1db298bfee4

  • /data/user/0/edsvfkdsk.awspfvsed.sdefv/app_edsvfkdsk.awspfvsed.sdefv.AAbaseZZ.AABaseApplicationZZ/newobfs/1.pobfs

    Filesize

    1.8MB

    MD5

    74d05fabbe99129f21f25713d312bbe9

    SHA1

    e303db50213d33723df0668131829976ba64a4ca

    SHA256

    1afafc1e209f3982e1dad6732d2c60d124d2c7ba9e2d761c84250ac7726a47d3

    SHA512

    f69121e8d05d0a0d8d953bbbbabc946d8be4874a6f0b1c9eb348f9626fd99ea04e07e8bf38fdd85b481f8f43ebdc391288ceb12c65213387ba0fdfa802d0aeae