soumnibot | 0f8bea787a83d2723ff2386b732771f836c48ac39272da07f9e283b0e94b9b6c

Analysis

max time kernel
179s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
15-06-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f8bea787a83d2723ff2386b732771f836c48ac39272da07f9e283b0e94b9b6c.apk
Size

4.6MB
MD5

48609f0ad63ae087999b3dfb310821f4
SHA1

ea27f6b6740ee70e44b3cff90a9ed7d56255d9c8
SHA256

0f8bea787a83d2723ff2386b732771f836c48ac39272da07f9e283b0e94b9b6c
SHA512

a659cd1b5ad761b426411e1ba9382e1e5ba3f57ae787c66a71838e0e56dc8004f28298a7595bb250aa76a346fa92822c8b49356b0023b270f9d26e01ab552666
SSDEEP

98304:z94x9Dx8+DAVPCJlggxDz91LaXbtDGH6UPEeR8HCf+eIW0AGEjt:sF8+eCJlBDzjcDVGENHvvCJ

Score

10^/10

soumnibot banker discovery evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 2 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot
behavioral1/memory/4296-1.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/eulmf.zko.wad/app_dex/classes.dex	4296	eulmf.zko.wad
/data/user/0/eulmf.zko.wad/app_dex/classes.dex	4334	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eulmf.zko.wad/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/eulmf.zko.wad/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/eulmf.zko.wad/app_dex/classes.dex	4296	eulmf.zko.wad

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	eulmf.zko.wad

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	eulmf.zko.wad

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	eulmf.zko.wad

eulmf.zko.wad
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4296
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/eulmf.zko.wad/app_dex/classes.dex --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/eulmf.zko.wad/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4334

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/eulmf.zko.wad/app_dex/classes.dex

Filesize
7.9MB

MD5
1bf3ede75b2f382508a7e2f3596012c8

SHA1
290f72b2a2a856f01735d9d25bbf1e270e4589e4

SHA256
616e826d75a348a8e92bd8c34063b4d9d806c71c816c3a0125064e3f4f31a4b0

SHA512
4396623bf3404263868ba320a200677eec586d57d4acc26bf3b32b87232568b23e77841c4c4266d943dc73c76878c36132e26945c6dfbf0fef610b44acaf0cbe

Download Submit
/data/data/eulmf.zko.wad/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/eulmf.zko.wad/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
576dfad5d847c40b9f1a489e212f20a4

SHA1
97fe7a0358037ef4c9406f3b35cb4025f80d654c

SHA256
9c9652b94e9990ee51294bf168f748f90721a6aef23226f31a41f1484942c808

SHA512
b039325510a478af1058b4f0cddaf542879a7d6d8b4f872041f34782ecb614ef756ead6ae284b12f15bb58e342c8b09f7c01517f676fea9273be62c8474d72f1

Download Submit
/data/data/eulmf.zko.wad/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/eulmf.zko.wad/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
4b82ed7d53ad9868a5d692325d38fecb

SHA1
7c210128f67e96a3111630f68d2327e69c01b487

SHA256
e11d998c6f6a87972bfc9e7f0c45efeb2adcab385ad254e36a01a7bc3c762791

SHA512
8f7d978710736ae6488e068be7be27462846c333ad5631b81666b29144241e6e259a16a42e25939519422f58920eaa61933fe197a67aa54bddfaa4d49c69b575

Download Submit
/data/data/eulmf.zko.wad/files/PersistedInstallation3337621178039368502tmp

Filesize
90B

MD5
97183849e4e59acf1096ecc6a9864481

SHA1
e8930b1ed351dc1c12a8474f7d8862011fee0bd2

SHA256
8201428a4d8f81fb51c420a091d3863b93f7d42b1c285c3c9e6be0b005363299

SHA512
0817f8d18d40bf60ee4d0d84ba6693f0d413984e89468f51e4d7b763cf1aa1b1dbfb2d58a1dc5df337aa3689dcdaa8b76cdd2a7c5b77500425dd99cd1650e011

Download Submit
/data/data/eulmf.zko.wad/files/PersistedInstallation5601794566686365224tmp

Filesize
567B

MD5
cf0f31de9a766e43708fad0d46a14e72

SHA1
00a55b1b2315df51e520a5534fb7e52e7b023331

SHA256
4d06356b35baf755744d2782a3134a20d30c7efe120f920025cd939e18b01437

SHA512
5350ebdc6094b9047a6de7f73138825fe665f6c27193a22440b5c26a85265ae3326bc4b855af400885d39cf26dcf3574dc3fba807dca0dcd955eee9eece3844c

Download Submit
/data/data/eulmf.zko.wad/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/eulmf.zko.wad/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
94727399bb68e63336b9594d244d53ee

SHA1
b4933bc5373acb2710ec24e3b3a62f21e8c64d2b

SHA256
e5f76dda15d25c9b5b78f8c0b17bd32fba58a84c989b52c97b02fa001994c4c7

SHA512
876ec42cac3a8176bef6b61a16b779fafa0aff6371ddeb22b427065d5c9b95f1cbd31e5d84166e563e0bcf34f3b2a9d736ca7bb217dfe8294761e8e022a4df81

Download Submit
/data/data/eulmf.zko.wad/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
48987504b674aa7ba207eb850c4eda67

SHA1
0d2a2db67b25f284d90b62403d790c38b6d02627

SHA256
063fa2620fadb907401730cad0db3a8d1564febda262658e418506a1fe753d72

SHA512
0c09d655c86710fb5b9ac6766254fea802e74f0b97e8be605f54812728788699ff6a7b3819b88fd8cff3a58576435a5924fa3b61cbc7f5cf416e4c576be965b6

Download Submit
/data/data/eulmf.zko.wad/no_backup/androidx.work.workdb-wal

Filesize
112KB

MD5
41d195a70925514a7efee50cb884400a

SHA1
3affc5bbeca5a0552645687a35265008f34da184

SHA256
7cf8236be0712b02e1c4a31cff4e0b0f637fc8e31405e8b8c92a7bad6e3d9b5f

SHA512
060cbf1d8334f6cf4a46bd4498e018bb07d88a6b7c9394f6cadd64c00082c61f84e11b4031b4745999ff39458fc24c333ac7a3bd16fa81c12ee7b3e146c1b1b1

Download Submit
/data/data/eulmf.zko.wad/no_backup/androidx.work.workdb-wal

Filesize
120KB

MD5
00f4e32815459fa581786eb31eda2d17

SHA1
5b902f9b993d255325cdf6c455d0b9571331fa78

SHA256
0c82cbd59fcc6100d218c207feec0e3b09f8900b823c957c8b804c05a042b2c1

SHA512
8a0e29ded7d72b5279f881dbaf28d8900d95d07958beaf487ec2352eee8851c2f373d7d46941acb99e4fc81ecc010b45e3d64fc550a80ddb3be928177f4cda1e

Download Submit
/data/user/0/eulmf.zko.wad/app_dex/classes.dex

Filesize
7.9MB

MD5
ec85afa0aaf9df6bf4d6f3eef1910805

SHA1
ccd08ada6f267ff6cd14fe4db109bad78732e027

SHA256
c2284854498feff9f741dcabab4f2b850eb94343f42aa7407f98d4c5b9fba6c0

SHA512
50c1da00636caccdfff9ce0bb1446a62075e3b000cdc9c6c1cf0e974f38e8df37c2279aa59d5bcb8c92ede909a1869aa1e95e626300b76b8cb7ad848eed37b8c

Download Submit