General

  • Target

    c17d5c8b8b68e6e574688e93b9c80e4cdcb15162614f465be0baecec0f261974

  • Size

    4.2MB

  • Sample

    240702-j51v6atene

  • MD5

    00aa9900205771b8c9e7927153b77cf2

  • SHA1

    b43094c27584f5e0fc5feaa5c621e56d7c2f3ccb

  • SHA256

    c17d5c8b8b68e6e574688e93b9c80e4cdcb15162614f465be0baecec0f261974

  • SHA512

    a19d2e339b25bea61b158bbd13f632793aeb4c3f20776793dd0bee15c4bd9283644d7915d55b46b6adf5803ca30651392dc6ccb40f843bdf0c72208fb70890d1

  • SSDEEP

    98304:FZxlRoI9e3PxUjrBbuF1voH30PITIgN/S6zYx/EmZMRye0vLOYrlQEjLE:Huke3Px0u/QH70OYdEmGye0jLc

Malware Config

Targets

    • Target

      c17d5c8b8b68e6e574688e93b9c80e4cdcb15162614f465be0baecec0f261974

    • Size

      4.2MB

    • MD5

      00aa9900205771b8c9e7927153b77cf2

    • SHA1

      b43094c27584f5e0fc5feaa5c621e56d7c2f3ccb

    • SHA256

      c17d5c8b8b68e6e574688e93b9c80e4cdcb15162614f465be0baecec0f261974

    • SHA512

      a19d2e339b25bea61b158bbd13f632793aeb4c3f20776793dd0bee15c4bd9283644d7915d55b46b6adf5803ca30651392dc6ccb40f843bdf0c72208fb70890d1

    • SSDEEP

      98304:FZxlRoI9e3PxUjrBbuF1voH30PITIgN/S6zYx/EmZMRye0vLOYrlQEjLE:Huke3Px0u/QH70OYdEmGye0jLc

    • Android SoumniBot payload

    • SoumniBot

      SoumniBot is an Android banking trojan first seen in April 2024.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Acquires the wake lock

    • Queries information about active data network

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks