soumnibot

General

Target
c17d5c8b8b68e6e574688e93b9c80e4cdcb15162614f465be0baecec0f261974
Size 4.2MB
Sample240702-h74t6awbpr
SHA256 c17d5c8b8b68e6e574688e93b9c80e4cdcb15162614f465be0baecec0f261974
MD5 00aa9900205771b8c9e7927153b77cf2
SHA1 b43094c27584f5e0fc5feaa5c621e56d7c2f3ccb
SHA512 a19d2e339b25bea61b158bbd13f632793aeb4c3f20776793dd0bee15c4bd9283644d7915d55b46b6adf5803ca30651392dc6ccb40f843bdf0c72208fb70890d1
SSDEEP 98304:FZxlRoI9e3PxUjrBbuF1voH30PITIgN/S6zYx/EmZMRye0vLOYrlQEjLE:Huke3Px0u/QH70OYdEmGye0jLc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  c17d5c8b8b68e6e574688e93b9c80e4cdcb15162614f465be0baecec0f261974
- Size 4.2MB
- SHA256 c17d5c8b8b68e6e574688e93b9c80e4cdcb15162614f465be0baecec0f261974
- MD5 00aa9900205771b8c9e7927153b77cf2
- SHA1 b43094c27584f5e0fc5feaa5c621e56d7c2f3ccb
- SHA512 a19d2e339b25bea61b158bbd13f632793aeb4c3f20776793dd0bee15c4bd9283644d7915d55b46b6adf5803ca30651392dc6ccb40f843bdf0c72208fb70890d1
- SSDEEP 98304:FZxlRoI9e3PxUjrBbuF1voH30PITIgN/S6zYx/EmZMRye0vLOYrlQEjLE:Huke3Px0u/QH70OYdEmGye0jLc
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

soumnibot banker collection discovery evasion execution infostealer persistence stealth trojan
- Android SoumniBot payload
- SoumniBot
  SoumniBot is an Android banking trojan first seen in April 2024.
  trojan infostealer banker soumnibot
- Checks if the Android device is rooted.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of photos stored on the user's device.
  collection
- Reads the content of the MMS message.
  collection
- Reads the content of the SMS messages.
  collection
- Acquires the wake lock
- Queries information about active data network
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Checks the presence of a debugger
  evasion
behavioral1 behavioral2 behavioral3 behavioral4