soumnibot | d6477dd8d3992c3586254e6dd27fc667489d3548ef1c35da57155aeddb237337

Analysis

max time kernel
5s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
10-07-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6477dd8d3992c3586254e6dd27fc667489d3548ef1c35da57155aeddb237337.apk
Size

3.0MB
MD5

914779630cdb5fc78176708389d91442
SHA1

af297bc026c7c9debf58af82805cd785dec10239
SHA256

d6477dd8d3992c3586254e6dd27fc667489d3548ef1c35da57155aeddb237337
SHA512

efef23b69ae7e59a6e548a0a91fde16dd7894804c0578357a245485afb57b49229b28bd60581084fdcb5163acee464dd8b975c33e3602cf90a36c8d2b7d5fb13
SSDEEP

49152:xjwT+sZ3ry8N0/9v+D6npXjMO2p1V2esLNumVicjg1qHP2Zr9Kx6:xNS3ry8mRDnFN2pGe8uSHP2Zr9N

Score

10^/10

soumnibot banker evasion infostealer trojan

Malware Config

Signatures

Android SoumniBot payload 1 IoCs

resource	yara_rule
behavioral1/memory/4452-0.dex	family_soumnibot

SoumniBot
SoumniBot is an Android banking trojan first seen in April 2024.
trojan infostealer banker soumnibot

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/economy.termination.diagrams/[email protected]	4452	economy.termination.diagrams
/data/user/0/economy.termination.diagrams/[email protected]	4452	economy.termination.diagrams

economy.termination.diagrams
1⤵
- Loads dropped Dex/Jar
PID:4452

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/economy.termination.diagrams/.jiagu/libjiaguv2.so

Filesize
277KB

MD5
5e204ef07df65032c7c4ce6de4962e35

SHA1
16dfabde15ea7b30564bda5155bffa8cdb7d7bbf

SHA256
8ee0cf93b8b9ed6a53cf545211a7bf73dddcb0bdec2288fa97b5a94ec7359414

SHA512
53518af00b16f4885b88618e9a1c3f5fb4f9e95e6f55a3b13b142a0e18ee4b4b53f001d99a82b0db6e1020406e197d93d404798937a1b34b0a4b20331772507d

Download Submit
/data/user/0/economy.termination.diagrams/[email protected]

Filesize
1.8MB

MD5
e9791ac9465f58e30a83e61e23dbe03b

SHA1
e5248c376d3b255a85d641ff2effb43ec86188cc

SHA256
05b2bf3229946338cbb655683a0cf81835fa33162c84e1f93615b22adc1bf218

SHA512
921d5a08af93ce3e8e4e371c6fb2797b09017fb9f59f7543ca08756a6dff069721eca7524776bcecb1b185c6ea18b909fade6f9a5f4191297145106c3dbca33e

Download Submit
/data/user/0/economy.termination.diagrams/oat/x86_64/[email protected]

Filesize
410B

MD5
6322d75cfd600ad75b180e0a4de7c9c6

SHA1
00f57464f8184a96a236e35f76e955bdd4402b59

SHA256
743d38bd133abbde8937cac3509e7327fe5ce436aa83d6dce740390acba9db26

SHA512
4f0e54983f37c8d2a85f18bfd7a511c155ab3f70b0fa3fe58cf603f506c6f57ec41f1732f82a8125a9377942c30ff27d61c2fbbcaf92c99a2b8fdd8cde238766

Download Submit