soumnibot | 0f7f74948cb0fc3a5f61983eddc8b3503316e5b3c2c6720df2cbf122daf13e64

Analysis

max time kernel
149s
max time network
153s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
03/04/2025, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f7f74948cb0fc3a5f61983eddc8b3503316e5b3c2c6720df2cbf122daf13e64.apk
Size

2.6MB
MD5

54d3aea9796a01bb54fd2123d8112946
SHA1

634e9d437014ab3a87c9cba2e983c12b2afcf1d5
SHA256

0f7f74948cb0fc3a5f61983eddc8b3503316e5b3c2c6720df2cbf122daf13e64
SHA512

7cd35611faa4a2b9610d458363b8c535c68caa39a5b97c9a9dcf2ff86d082cf534c04be1045bd26f0e4460df16bcd9afb49884e088219c84b5f33821447bc702
SSDEEP

24576:d4m51+WtE0Tmv8iZ32NNl4jo29SD/mzONPJrpjhDpvVq5rKKPqXbl9FpGPg69nfN:+JWu0To2NI9SDjPHj3ONCq7

Score

10^/10

soumnibot banker defense_evasion evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot
Soumnibot family
soumnibot

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/rgvk.ewpfver.welfdv/app_rgvk.ewpfver.welfdv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs	4514	rgvk.ewpfver.welfdv

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

defense_evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	rgvk.ewpfver.welfdv

rgvk.ewpfver.welfdv
1⤵
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4514

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/rgvk.ewpfver.welfdv/app_rgvk.ewpfver.welfdv.AAbaseZZ.AABaseApplicationZZ/newobfs/0.pobfs

Filesize
1.8MB

MD5
7ee51b48af5a90d9a9d4cfdda66a7dd6

SHA1
fc0b1eb14d57713c0317d92c5ec04b44411776a1

SHA256
3c1d79f373a3084cd39e386072391733fb1d62f8caba95bd2cbc1b3f052e5e8b

SHA512
fa5627ab9e269bc05c28948fef87081eb94fc7d67074f7a1c304ac035a2ee5423866b5b96d10d86505c94a36ed867fb8785691a4cd8f9dc93119a1cdd000bd22

Download Submit