soumnibot | 5ce03fb6165f1eea6b73d524d7c5698e8e0aaf4e9e01bb898147e9cf0810a446

Analysis

max time kernel
179s
max time network
158s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
17-06-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ce03fb6165f1eea6b73d524d7c5698e8e0aaf4e9e01bb898147e9cf0810a446.apk
Size

4.2MB
MD5

436233b7c21bdaa0e04642351571ff4e
SHA1

6252134d49c7deca4a6a9cde82910caf5e30a771
SHA256

5ce03fb6165f1eea6b73d524d7c5698e8e0aaf4e9e01bb898147e9cf0810a446
SHA512

635824f5a208ae4243d4f44a0108f9ee9f7874e715e2e3aef7f8b2ad3c53dbfe782a891ceaadaa00c4b61c00466130d4972338d532f6a746905b8317f6df2258
SSDEEP

98304:mSZxv4yIIHTyT9UjrBGDk2O8gVqdoaIHrHJIIfpDBrEEjIShl:Zx4xkTyT9DnOf4in58Il

Score

10^/10

soumnibot banker discovery evasion infostealer persistence trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/vfmo.gv.krohe/app_dex/classes.dex	4283	vfmo.gv.krohe
/data/user/0/vfmo.gv.krohe/app_dex/classes.dex	4346	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/vfmo.gv.krohe/app_dex/classes.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/vfmo.gv.krohe/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/vfmo.gv.krohe/app_dex/classes.dex	4283	vfmo.gv.krohe

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	vfmo.gv.krohe

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	vfmo.gv.krohe

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	vfmo.gv.krohe

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	vfmo.gv.krohe

vfmo.gv.krohe
1⤵
- Loads dropped Dex/Jar
- Acquires the wake lock
- Queries information about active data network
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4283
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/vfmo.gv.krohe/app_dex/classes.dex --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/vfmo.gv.krohe/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4346

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/vfmo.gv.krohe/app_dex/classes.dex

Filesize
6.6MB

MD5
cb9b87b8db2f376b580d34f418cf4d5c

SHA1
c30138088eb2cedb5867deaf4ce810672bd4c1b5

SHA256
ec6d95f267df4c66e47705a198a3baac7a46214000ad27c5959d4c5e7ea9ebd6

SHA512
717dfb48fa6784974d207b97ca57fb9f37ee832140ce1560d6e17a8f7ddd5b45504d0d8db3b662cae90c6c77ab227eacc1211ddfcc9d92de13c41cae78bd2589

Download Submit
/data/data/vfmo.gv.krohe/databases/com.google.android.datatransport.events

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/vfmo.gv.krohe/databases/com.google.android.datatransport.events-journal

Filesize
512B

MD5
03b197971365e121003cf7f0c7dc1d00

SHA1
79139a23eb9ca6ee92bcbaa1ddea05f5a982a1a7

SHA256
440b0d2c0905bf29c27fff57088954245f796fdbeff9684656db8bd45fbcb1e0

SHA512
ad5dc61fe2523523a9a041f5b30facd9d16b33fa5cf386d962654d824e6a46823d9c25f946d274e4a9998d2991062ba1a1c324db392bbc1256a29d47b5b53003

Download Submit
/data/data/vfmo.gv.krohe/databases/com.google.android.datatransport.events-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/vfmo.gv.krohe/databases/com.google.android.datatransport.events-wal

Filesize
68KB

MD5
12402d2cd91e8b42d29e8d46e611a77f

SHA1
16288cb1725e8e82fd34c5d0d703a844f7cd903a

SHA256
9fc99592584a6f3ea92b3e1103fedc108671c91d309d1190ed58f200e144a1ed

SHA512
b0fc00b143b82ce73f71f936b1adde6a0412bbf51ef5b44f680432c2560a5c488dd0f0de84e7e3851b6b016e1d184696e4ee2edbde8b80eca76d815cae17fedf

Download Submit
/data/data/vfmo.gv.krohe/files/PersistedInstallation1636923130939720986tmp

Filesize
90B

MD5
e82147dc5fdd7bb3205635ea05cb9409

SHA1
e5e78c8cffe9d2ddb2c181eda139017d43985cda

SHA256
db3c5784a5834ee05b9cb4735ae5581b059bc2ebd84cec1e9e4911489d717e48

SHA512
0668f73b5229deb9125fbe9fffd0c21eef485eb1095094dabdca69b29249570e2d93df721354e21aca26fae5fd49cd1b702b3dd748cd982cab26f30e5020d982

Download Submit
/data/data/vfmo.gv.krohe/files/PersistedInstallation5068892721153043542tmp

Filesize
570B

MD5
a219113601ad793634b067898dde8293

SHA1
abc7d5c9e6165f41f651167a2017768bf6d48383

SHA256
6f3c0604f5eecbb481390ea625c35a7031bcda638993e67fd7babd1b50526eec

SHA512
4a2225289ecb1219fcf3d3e05c92932f3ada24bbfebe872d0abdf4e580fd848122e6f6aa88db2be0c679ea859c75dd872baf6507d20d6b5bc19335ebbc76d856

Download Submit
/data/data/vfmo.gv.krohe/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/data/vfmo.gv.krohe/no_backup/androidx.work.workdb-journal

Filesize
512B

MD5
9e5c46fa7e5ef3d6ec0d8056cf34c8ce

SHA1
fa1018b434032acb446b208a75f32b64baf0e3eb

SHA256
9943bab0d3a2892ce8656932cfeab5001f8057dfdfdd1a689577423fef98dd83

SHA512
a0ffc2f0cc7492e3d303877e5883a8fa085a857c6440212e5744391c3a2850176536912f5002b930ab4658fcebc3d0521d22b538225f209229339215b8d7e6fe

Download Submit
/data/data/vfmo.gv.krohe/no_backup/androidx.work.workdb-wal

Filesize
16KB

MD5
1169ce6c8e6de5d96f66b37cfe34908e

SHA1
e07c3eaf27aeb17d28bcc11ac0cafb1c722946cf

SHA256
328d337f19f0a685e70b5bdaa8fa53d7253475c191f3411faf0a13195778ba56

SHA512
d1aad978db7a4f486396740f13f209b1c7e3e4b32aaca2a0fe38e2184ecfebb7f149df973936284161676e44d4e704b7162434a99b8ceb57291400a8bebcd594

Download Submit
/data/data/vfmo.gv.krohe/no_backup/androidx.work.workdb-wal

Filesize
108KB

MD5
01f418ceddee72d8e076425022cf1f77

SHA1
7a89b903f96f0671601eb434cd6e2676f8fab03a

SHA256
6d2fd3e90e6403e7dde6241fefed4d8c9d3fac8fa8ade40927947310cac19085

SHA512
b797c2be0a398e8ac8bb3b2829f4ac55ba68627f438d5ee0b937f1e3f91962628a7fe3cd88318bf74f741b24d6837b6a818cdbbbe08213a75b1c3331b793689a

Download Submit